Assess Vault tokens →hardMultiple ChoiceObjective-mapped

VA-003 Assess Vault tokens Practice Question

Exhibit

```
$ vault token create -policy=my-policy -ttl=12h -explicit-max-ttl=24h
Key                  Value
---                  -----
token                s.f2g3h4j5k6l7
token_accessor       a1b2c3d4e5f6
token_duration       12h
token_renewable      true
token_policies       ["default" "my-policy"]
identity_policies    []
policies             ["default" "my-policy"]
```

Refer to the exhibit. A user attempts to renew the token after 20 hours. What will happen?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The token will be renewed for another 4h, after which it will expire.

The explicit max TTL is 24h. After 20h, the remaining time until max TTL is 4h. Renewal will set the token duration to the minimum of the requested TTL (12h) and the remaining max TTL (4h), resulting in a 4h TTL. After that, the token expires.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The renewal will fail because the token has exceeded its explicit max TTL.
Why it's wrong here
Renewal does not fail; the TTL is capped to the remaining time until max TTL.
✗
The token will be renewed for another 12h and can be renewed indefinitely.
Why it's wrong here
The explicit max TTL will limit total lifetime to 24h, so indefinite renewal is not possible.
✗
The token will be renewed for 12h, but the total lifetime cannot exceed 24h.
Why it's wrong here
Renewal will not grant a full 12h if it would exceed max TTL; the TTL is capped at 4h.
✓
The token will be renewed for another 4h, after which it will expire.
Why this is correct
The remaining time until max TTL is 4h, so renewal grants a 4h TTL.

Go deeper

VA-003 Assess Vault tokens Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question