HashiCorp Vault Associate (003) Question 81
Single answer3c Explain the purpose of token accessorsA security team at a company uses Vault to issue service tokens to several internal applications. During an incident review, the team finds a token accessor in audit logs and wants to investigate and, if necessary, revoke the associated token without exposing the full client token value to operators. Which statement best describes the purpose of a token accessor in this situation?
- A
A token accessor is a reference to a token that can be used to look up token information and revoke the token without needing the full token ID.
- B
A token accessor is an encrypted form of the token ID that can be used anywhere a client token is accepted for authentication.
- C
A token accessor is a short-lived child token automatically created for audit devices so operators can safely log in as the original application.
- D
A token accessor is metadata stored in the token that allows Vault to renew the token but does not support lookup or revocation operations.
Show answer and explanation
Correct answer: A
Explanation
The main purpose of a token accessor is to provide a safer operational handle for a token. In Vault, operators can use an accessor to perform token lookup and token revocation without needing the full client token value. This supports incident response and audit-driven workflows because audit devices commonly record token accessors rather than raw tokens, reducing the chance of credential exposure in logs. A token accessor is not an authentication credential and cannot be used to access secrets or authenticate to Vault. This aligns with Vault token management practices documented in HashiCorp Vault documentation for token concepts, token lookup, and token revocation by accessor.
- A. Correct.
Correct. Token accessors are secondary identifiers for tokens. They are useful for operational workflows such as looking up token properties and revoking a token via its accessor, which helps reduce exposure of the actual client token value. This is especially relevant when accessors appear in audit logs and operators need to act on a token without handling the secret itself.
- B. Incorrect.
Incorrect. A token accessor is not a substitute credential and cannot be used to authenticate to Vault in place of the client token. It is not simply an encrypted token ID for normal API use. Treating it as an authentication token is a common misconception.
- C. Incorrect.
Incorrect. Vault does not create token accessors as separate child tokens for audit devices or operator impersonation. An accessor is tied to an existing token as a reference identifier, not a new login-capable token.
- D. Incorrect.
Incorrect. While token accessors are associated with token management operations, they are specifically useful for lookup and revocation. This option incorrectly limits their purpose and omits their operational value in identifying and revoking tokens safely.