Understanding Token TTL and Max TTL in HashiCorp Vault
Exhibit
Refer to the exhibit. ``` $ vault token lookup s.abc123 Key Value --- ----- accessor a.xyz789 creation_time 1712345678 expiration_time 1712355678 creation_ttl 2h display_name mytoken entity_id entity-uuid-123 meta map[team:dev] num_uses 0 orphan true path auth/token/create policies [default my-policy] renewable true type service ```
Refer to the exhibit. A developer reports that a token they created using `vault token create -policy=my-policy -ttl=2h` is no longer working after 1 hour. The token lookup output shows the token details. What is the most likely cause?
Quick Answer
The correct answer is that the token's max_ttl was set to 1h when created, and the token reached its max_ttl. This happens because when you issue `vault token create -ttl=2h`, the requested TTL is the desired lifetime, but the token's actual validity is always the lower of the requested TTL and the max_ttl value—here, the max_ttl of 1h overrides the 2h request, causing expiration after just one hour. On the HashiCorp Vault Associate VA-003 exam, this scenario tests your understanding of how token TTL vs max_ttl interact, often appearing as a trap where candidates assume the `-ttl` flag alone determines expiry. The key distinction is that `ttl` is the initial lease duration, while `max_ttl` is an absolute ceiling enforced by the token's configuration or system defaults. Remember the memory tip: "TTL is the ask, max_ttl is the cap—the token lives by the lower lap."
⚠ Common exam trap
HashiCorp often tests the distinction between `ttl` and `max_ttl`, where candidates mistakenly assume the token will last for the full `ttl` value without checking the overriding `max_ttl` limit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token's max_ttl was set to 1h when created, and the token reached its max_ttl.
The token was created with a `-ttl=2h` but the token lookup output shows `max_ttl=1h`. The `max_ttl` is an upper limit enforced by the token's configuration or the system's maximum TTL setting. Even though the requested TTL was 2 hours, the token's effective lifetime is capped by the lower of the two values, so it expired after 1 hour.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The token's max_ttl was set to 1h when created, and the token reached its max_ttl.
Why this is correct
If max_ttl is less than the requested TTL, the token will expire at max_ttl, causing it to stop working after 1 hour.
- ✗
The token has num_uses set to 0, meaning it can only be used once.
Why it's wrong here
num_uses=0 means unlimited use, not a single use.
- ✗
The token is a service token and cannot be renewed.
Why it's wrong here
Service tokens can be renewed; this is not the issue.
- ✗
The token is an orphan token and requires the parent token to be valid.
Why it's wrong here
Orphan tokens have no parent; they are independent.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team is using Vault tokens with short TTLs for CI/CD jobs. They notice that some jobs fail intermittently with 'permission denied' errors even though the token policy grants the required capabilities. The token is created with a TTL of 10 minutes and renewed automatically by the client library. What is the most likely cause of the failures?
medium- ✓ A.The token's max_ttl has been exceeded, causing renewal to fail.
- B.The token's parent token has been revoked.
- C.The token's max_ttl is being reset each time the token is renewed.
- D.The token's TTL is too short and the client library is not renewing in time.
Why A: Vault tokens have both a TTL (time-to-live) and a max_ttl (maximum time-to-live). When a token is renewed, its TTL is reset to the original TTL (10 minutes) but only if the cumulative lifetime has not exceeded the max_ttl. If the max_ttl is reached, renewal fails, the token expires, and subsequent operations using that token return 'permission denied' errors, even though the policy itself grants the required capabilities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.