An administrator notices that after a Vault unseal operation, the root token is no longer usable. The audit logs show no revocations. What is the most likely cause?
Trap 1: The root token was revoked during unseal
Incorrect. Revocation would appear in audit logs, but the logs show no revocations.
Trap 2: The root token's policy was removed
Incorrect. Policy removal would not immediately invalidate an active token; the token would still be usable until next authentication.
Trap 3: The root token was stored in memory only and lost on seal
Incorrect. While root tokens are ephemeral, they are persisted in storage after initialization; losing them on seal is expected, but they can be regenerated using recovery keys.
- A
The root token's TTL expired during unseal
Correct. The root token's TTL can expire during unseal, rendering it unusable without any revocation in audit logs.
- B
The root token was revoked during unseal
Why wrong: Incorrect. Revocation would appear in audit logs, but the logs show no revocations.
- C
The root token's policy was removed
Why wrong: Incorrect. Policy removal would not immediately invalidate an active token; the token would still be usable until next authentication.
- D
The root token was stored in memory only and lost on seal
Why wrong: Incorrect. While root tokens are ephemeral, they are persisted in storage after initialization; losing them on seal is expected, but they can be regenerated using recovery keys.