VA-003 explicit_max_ttl Practice Question
Exhibit
``` $ vault token lookup s.abc123 Key Value --- ----- accessor a1b2c3d4e5f6 creation_time 1700000000 creation_ttl 24h display_name my-app explicit_max_ttl 48h expire_time 1700014400 id s.abc123 issue_time 1700000000 meta map[service:app1] num_uses 0 orphan true path auth/token/create policies [default my-policy] renewable true ttl 24h type service ```
Refer to the exhibit. An admin wants to ensure this token can be used for 60 hours total. Which action should be taken?
⚠ Common exam trap
HashiCorp Vault exams often test the misconception that `explicit_max_ttl` can be modified on an existing token or that renewal alone can extend a token's lifetime beyond its `explicit_max_ttl`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new token with explicit_max_ttl=60h.
The token's current `explicit_max_ttl` is set to 48h, and the `creation_ttl` (24h) cannot be increased beyond that bound. To achieve a total lifetime of 60 hours, a new token must be created with `explicit_max_ttl=60h`, which overrides the default or role-based TTL limits and sets the absolute maximum lifetime for the token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase the creation_ttl to 60h.
Why it's wrong here
The creation_ttl is the initial TTL; without increasing explicit_max_ttl, the token will still be capped at 48h.
- ✗
The token will expire after 48h, so increase explicit_max_ttl to 60h on the current token.
Why it's wrong here
The explicit_max_ttl cannot be changed after token creation.
- ✓
Create a new token with explicit_max_ttl=60h.
Why this is correct
A new token with appropriate max TTL is required.
- ✗
The token already can be used for 60h because it is renewable.
Why it's wrong here
Even renewable, the explicit_max_ttl of 48h limits total lifetime.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.