HashiCorp Vault Associate (003) Question 78
Single answer3b Describe root token uses and lifecycleA security team is rotating ownership of a production Vault cluster. During the handoff, the outgoing administrator reveals that the original root token created during initialization is still stored in a password vault and has never been revoked. The new team wants to follow Vault best practices while preserving the ability to perform emergency break-glass operations later. Which action should they take next?
- A
Keep the existing root token stored securely because root tokens are intended for long-term administrative use
- B
Revoke the existing root token and rely on non-root administrative tokens for routine work; generate a new root token only when a specific privileged operation requires it
- C
Renew the existing root token periodically so it remains valid for future recovery operations
- D
Convert the existing root token into a periodic token so it can be controlled by TTL settings
Show answer and explanation
Correct answer: B
Explanation
The root token has unrestricted privileges in Vault and should be treated as a break-glass credential, not a normal admin credential. The initial root token created by vault operator init is intended for initial configuration tasks. After setup, best practice is to revoke it and perform routine administration using least-privilege policies attached to non-root tokens or identities. If a root token is later required for a narrowly scoped privileged action, Vault supports generating a new root token through the generate-root workflow, which requires quorum from key holders. This approach reduces long-term exposure while preserving emergency access. See HashiCorp Vault documentation on root tokens, token concepts, and generate-root operations for the recommended lifecycle and usage pattern.
- A. Incorrect.
Incorrect. Root tokens are extremely powerful and bypass normal ACL policy checks. Best practice is to avoid using them for routine administration and to revoke them when not needed. Keeping a long-lived root token increases risk if it is exposed or misused.
- B. Correct.
Correct. HashiCorp guidance is to use the initial root token for setup only, then revoke it. Day-to-day administration should be performed with appropriately scoped non-root tokens. If a root token is needed later for a rare privileged task or recovery scenario, a new one can be generated through the root generation process using unseal/recovery key quorum.
- C. Incorrect.
Incorrect. This reflects a common misunderstanding. Root tokens are not meant to be preserved indefinitely through renewal as a standard practice. Even if a root token can exist without expiration depending on how it was created, the security recommendation is still to revoke it when not required.
- D. Incorrect.
Incorrect. A root token cannot simply be converted into a periodic token type to make it safer. Periodic tokens are a specific token behavior created through supported token creation workflows, and this does not change the fundamental best-practice guidance that root tokens should be tightly controlled and revoked when unnecessary.