HashiCorp Vault Associate (003) Question 68
Single answer3 Vault tokensA platform team wants a CI/CD pipeline to authenticate to Vault and then create short-lived child tokens for individual jobs. The team also wants to ensure that if the pipeline's own token is revoked, any job tokens it created are automatically revoked as well. Which type of token should the pipeline use for its own authentication?
- A
A batch token, because batch tokens are lightweight and optimized for high-scale workloads
- B
A service token, because service tokens can create child tokens and participate in token revocation hierarchies
- C
A periodic token, because periodic tokens automatically revoke all descendant tokens when they expire
- D
A wrapped token, because response wrapping is designed for securely creating downstream child tokens
Show answer and explanation
Correct answer: B
Explanation
Vault distinguishes between service tokens and batch tokens. Service tokens support the full feature set, including renewal (when applicable), cubbyhole access, child token creation, and hierarchical revocation. Batch tokens are designed for lightweight, scalable use cases but do not support child token creation and are not suitable when parent-child revocation behavior is required. In this scenario, the platform team explicitly needs the pipeline token to mint child tokens and wants those child tokens revoked if the parent is revoked, which is a core service-token capability. HashiCorp Vault documentation on tokens and token types describes these behavioral differences and is the best reference for this design decision.
- A. Incorrect.
Incorrect. Batch tokens are intended for lightweight, high-throughput use cases, but they are not stored by Vault in the same way as service tokens and do not support the full set of token features. In particular, they cannot create child tokens. A common misconception is that 'optimized for scale' makes them the best default for CI/CD, but the requirement here is specifically about creating child tokens and having revocation relationships.
- B. Correct.
Correct. Service tokens are the appropriate choice when a client needs full token functionality, including creating child tokens and participating in the token hierarchy. Vault tracks service tokens, which allows parent-child relationships and cascading revocation. If the parent service token is revoked, its child tokens can be revoked as well, which matches the scenario's requirement.
- C. Incorrect.
Incorrect. Periodic tokens are service tokens that must be renewed within a fixed period to remain valid, but 'periodic' describes a renewal behavior, not a different token class that exists primarily for child-token revocation. While a periodic token may be useful in some automation scenarios, the key requirement here is child token creation and revocation hierarchy, which comes from using a service token. Someone might choose this option because periodic tokens are commonly discussed for machine authentication, but that is not the deciding factor in this scenario.
- D. Incorrect.
Incorrect. Wrapped tokens are not a token type used as a parent for normal operational token hierarchies. Response wrapping is a secure delivery mechanism for secrets or auth responses, typically used to hand off sensitive information securely. It does not exist to enable child token creation or revocation trees for CI/CD workloads.