HashiCorp Vault Associate (003) Question 80
Single answer3c Explain the purpose of token accessorsA security team is investigating a potentially exposed Vault token used by a CI/CD pipeline. The team does not want to handle or log the full client token during the investigation, but they need a way to identify the token and revoke it if necessary. Which Vault feature best supports this requirement?
- A
Use the token accessor, which can be used to look up token information and revoke the token without exposing the full token value
- B
Use the token's lease ID, which uniquely identifies authentication tokens and allows revocation without additional permissions
- C
Use the token's entity ID, which is interchangeable with the client token for lookup and revocation operations
- D
Use the token's policy name, which lets operators revoke the specific token instance without referencing the token itself
Show answer and explanation
Correct answer: A
Explanation
The purpose of a token accessor is to provide a non-secret reference to a token. This is especially valuable in operational and security workflows where teams need to audit, look up, or revoke tokens without handling the actual client token value. In practice, accessors reduce exposure risk because the client token grants access, while the accessor is primarily an identifier for token management operations. Vault documentation describes capabilities such as token lookup by accessor and token revocation by accessor. This aligns with best practices for minimizing secret exposure in logs, tickets, and incident-response workflows.
- A. Correct.
Correct. A token accessor is a reference to a token that is safer to store or log than the token itself. In Vault, accessors can be used for operations such as token lookup and token revocation by accessor, which is useful when teams need to investigate or invalidate a token without exposing the secret-bearing client token value.
- B. Incorrect.
Incorrect. Lease IDs are associated with leased secrets and dynamic credentials, not used as the identifier for authentication tokens in the way described here. While Vault supports lease revocation for secrets, token management uses token-specific concepts such as the client token and token accessor.
- C. Incorrect.
Incorrect. An entity ID represents the identity entity in Vault's Identity system, not a specific token. A single entity can have multiple tokens over time, so an entity ID is not interchangeable with a client token or accessor for token-specific lookup and revocation.
- D. Incorrect.
Incorrect. Policies define permissions attached to tokens, but a policy name does not identify an individual token instance. Revoking by policy name is not how Vault targets a single compromised token.