HashiCorp Vault Associate (003) Question 76
Single answer3b Describe root token uses and lifecycleA security team is initializing a new HashiCorp Vault cluster for production. During setup, an engineer receives the initial root token and plans to keep it in a password manager for future administrative tasks. The team lead wants to follow Vault best practices for handling this token throughout its lifecycle. Which action should the team take?
- A
Store the initial root token for routine administration because it cannot be recreated later if lost
- B
Use the initial root token for daily operations, but rotate it monthly to reduce risk
- C
Revoke the initial root token after bootstrap tasks are complete, and generate a new root token only when a truly exceptional administrative task requires it
- D
Convert the initial root token into a periodic token so it can be used safely for break-glass access
Show answer and explanation
Correct answer: C
Explanation
The key concept is that the initial root token has a very limited intended lifecycle: use it to bootstrap Vault, then revoke it. Root tokens are highly privileged and can perform actions outside normal policy restrictions, so they should not be used for routine administration or stored for convenience. In production, administrators should authenticate through standard auth methods and use least-privilege policies. If root access is needed later, Vault provides the generate-root workflow, which requires participation from key holders and creates an auditable, deliberate break-glass process. This follows HashiCorp guidance around minimizing standing privileged credentials and treating the root token as an emergency-use mechanism rather than an operational credential.
- A. Incorrect.
Incorrect. This reflects a common misconception that the initial root token must be preserved indefinitely because it is unique and irreplaceable. In Vault, a new root token can be generated later through the generate-root process, which requires quorum from unseal key holders or recovery key holders depending on the seal configuration. Because the root token is extremely powerful, best practice is not to retain it for routine use.
- B. Incorrect.
Incorrect. Root tokens are not intended for day-to-day administration. Even if the team attempted to rotate operational use, the core problem remains: root tokens bypass normal policy controls and should be reserved for rare, exceptional tasks such as disaster recovery, plugin management in some cases, or recovery from misconfiguration. Routine operations should be performed with least-privilege tokens tied to policies and authentication methods.
- C. Correct.
Correct. This aligns with Vault best practices. The initial root token is typically used only for bootstrap activities, such as enabling auth methods, configuring policies, and setting up initial secrets engines or administrators. After setup, it should be revoked. If root-level access is later required, Vault supports generating a new root token through a controlled workflow rather than keeping a standing root token available.
- D. Incorrect.
Incorrect. A root token is not made safe simply by changing token characteristics. Periodic tokens are a token type with renewable behavior, but that does not change the fact that root privileges are extremely sensitive and should not be maintained as standing access. The safer pattern is to avoid long-lived root access and instead generate a root token only when necessary through the proper control process.