HashiCorp Vault Associate (003) Question 75
Single answer3b Describe root token uses and lifecycleA security team is performing the initial hardening of a newly deployed Vault cluster. During setup, an engineer used the initial root token to enable auth methods, write baseline policies, and configure audit devices. The team now wants to reduce long-term risk while preserving the ability to perform emergency recovery actions later. Which approach best reflects Vault best practices for the root token's use and lifecycle?
- A
Keep the initial root token in a password manager for daily administrative tasks because it has the fewest permission issues.
- B
Revoke or tightly control the initial root token after setup, use least-privileged tokens for routine administration, and generate a new root token only through a controlled process when break-glass access is required.
- C
Convert the initial root token into a periodic token so it can be safely renewed indefinitely for operational continuity.
- D
Use the root token only to authenticate applications that need access to multiple secrets engines, since root tokens bypass policy evaluation.
Show answer and explanation
Correct answer: B
Explanation
Vault's root token is a special token with unrestricted privileges. It is commonly used during initial bootstrap tasks such as enabling auth methods, configuring secrets engines, setting policies, and establishing audit devices. After initial setup, best practice is to avoid using the root token for routine work. Instead, administrators should use non-root tokens with policies that grant only the capabilities required. If root access is needed later for emergency recovery or specific privileged tasks, Vault provides a controlled generate-root workflow that typically requires multiple unseal key holders or recovery key holders, depending on configuration. This supports separation of duties and reduces the chance of long-lived, overprivileged credentials being misused. This aligns with HashiCorp Vault documentation and operational security best practices around root token lifecycle management.
- A. Incorrect.
Incorrect. The root token is extremely powerful and is intended for bootstrap, initial configuration, and rare emergency or recovery operations. Using it for day-to-day administration violates least-privilege principles and increases blast radius if the token is exposed. Although storing secrets securely matters, the larger issue is that the root token should not be the normal administrative credential.
- B. Correct.
Correct. This matches Vault guidance: use the initial root token sparingly for setup, then revoke or otherwise strictly control it. Routine operations should be performed with scoped, non-root tokens tied to appropriate policies. If root access is needed later, Vault supports generating a new root token through a quorum-based generate-root process, which is designed as a controlled break-glass mechanism.
- C. Incorrect.
Incorrect. Root tokens are not made safe simply by changing renewal behavior. The problem is not token longevity alone, but the unrestricted privileges attached to a root token. Best practice is to avoid routine use of root privileges and rely on policy-based access instead.
- D. Incorrect.
Incorrect. Applications should authenticate using appropriate auth methods and receive least-privileged tokens. A root token is never an appropriate application credential because it grants unrestricted access and bypasses normal policy constraints, creating severe security risk.