VA-003 Immutable Token Properties Practice Question
Which THREE of the following token properties are immutable after token creation? (Select exactly 3 options.)
⚠ Common exam trap
A common pitfall is assuming that Renewable is immutable because it is set at creation. However, in Vault, the renewable property can be effectively changed through token renewal or role updates, making it mutable. The truly immutable properties are Period, Policies, and Max TTL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Period
In Vault, certain token properties are set at creation and cannot be changed later. The immutable properties are: Period (the renewal period), Policies (the list of policies attached to the token), and Max TTL (the maximum time-to-live). These are fixed in the token's metadata. In contrast, the Renewable flag, though set at creation, is not considered immutable because it can be effectively changed by renewing the token or by updating the token's role policies that affect renewal behavior. TTL is the current time-to-live and decreases over time, so it is mutable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Period
Why this is correct
Period is immutable. It defines the renewal period and cannot be changed after token creation.
- ✓
Policies
Why this is correct
Policies are immutable. The list of policies attached to a token is fixed at creation and cannot be modified.
- ✗
Renewable
Why it's wrong here
Renewable is not immutable. Although the renewable flag is initially set, it can be altered indirectly via token renewal or role updates, making it effectively mutable.
- ✓
Max TTL
Why this is correct
Max TTL is immutable. It sets the maximum lifetime for the token and cannot be changed after issuance.
- ✗
TTL
Why it's wrong here
TTL is mutable. The current TTL decreases over time and can be extended through renewal, so it is not fixed.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.