HashiCorp Vault Associate (003) Question 66
Single answer3 Vault tokensA platform team uses Vault to issue tokens for a CI/CD system. Each pipeline job should receive a short-lived token that automatically becomes unusable when the job ends. The security team also wants any child tokens created by that job to be revoked when the parent token is revoked. Which token type should the team use for the pipeline job token?
- A
A batch token, because it is lightweight and cannot create child tokens
- B
A service token, because it supports renewal, revocation, and hierarchical child tokens
- C
A periodic token, because it never expires as long as the CI/CD job is running
- D
A root token, because it can revoke all descendant tokens created during the job
Show answer and explanation
Correct answer: B
Explanation
The best answer is the service token. In Vault, service tokens are intended for normal client use cases and support features such as renewal, revocation, and creation of child tokens. This makes them appropriate when a workload needs a token that can participate in Vault's token hierarchy, where revoking a parent revokes its descendants. Batch tokens are optimized for scale and performance but trade off lifecycle and management features; they are not suitable when you need child-token revocation behavior. Periodic describes a TTL/renewal model rather than the core token type needed to satisfy the scenario. Root tokens should be reserved for exceptional administrative tasks. This aligns with Vault documentation and best practices around token types, TTLs, token hierarchies, and least-privilege access.
- A. Incorrect.
Incorrect. Batch tokens are lightweight and useful for high-scale machine workflows, but they are deliberately limited. They are not stored in the token store and do not support the full lifecycle features of service tokens, including child token management in the way described here. Since the scenario requires revocation behavior for descendants, a batch token is not the right choice.
- B. Correct.
Correct. Service tokens are the standard token type for most authenticated interactions with Vault. They support renewal, explicit revocation, accessors, and token hierarchies. If a parent service token is revoked, its child tokens are revoked as well, which directly matches the requirement that tokens issued by the CI/CD job should also become unusable when the parent is revoked.
- C. Incorrect.
Incorrect. Periodic tokens are a behavior pattern for token lifetime, not a separate token type that replaces service tokens in this context. They require renewal at a fixed interval and can expire if not renewed. The key requirement in the scenario is hierarchical revocation of child tokens, which is a service token capability. Choosing 'periodic token' here reflects confusion between token lifetime settings and token type.
- D. Incorrect.
Incorrect. Root tokens are highly privileged administrative tokens and are not appropriate for routine CI/CD jobs. Although a root token can perform many actions, using one for pipelines violates least-privilege best practices and is unnecessary for achieving parent-child token revocation.