HashiCorp Vault Associate (003) Question 82
Single answer3c Explain the purpose of token accessorsA security team discovers that an application token may have been exposed in a build log. The team wants operations staff to be able to look up the token's metadata and revoke it if necessary, but they do not want to disclose the full token ID to those staff members or store it in incident notes. Which Vault feature best supports this requirement?
- A
Use the token accessor, which can be used to look up and revoke the token without revealing the full client token
- B
Use the token's lease ID, which uniquely identifies the token and allows token revocation without any token-specific permissions
- C
Use a response-wrapping token, which permanently replaces the original token and is the standard identifier for later token revocation
- D
Use the token's policy name, which can be used to identify and revoke a single compromised token associated with that policy
Show answer and explanation
Correct answer: A
Explanation
Token accessors exist so Vault can reference a token without exposing the token's secret ID itself. In practice, this supports safer auditing, incident response, and delegated operational tasks such as token lookup and revocation by accessor. This is preferable when the organization wants to avoid sharing the full token string broadly, since possession of the actual token may permit authentication, whereas the accessor is intended as a less-sensitive reference. Vault documentation for token auth methods and token management describes lookup and revoke operations by accessor, which is why accessors are commonly used in security investigations and automation.
- A. Correct.
Correct. A token accessor is a secondary identifier for a token. Vault supports token lookup and revocation by accessor, which is useful when teams need to manage or investigate a token without exposing the actual client token value. This is exactly the purpose of token accessors in operational and security workflows.
- B. Incorrect.
Incorrect. Lease IDs are used for leased secrets and dynamic credentials, not as the primary management handle for Vault tokens in this scenario. Tokens have their own lifecycle and can be managed directly or via accessor. Confusing token management with secret lease management is a common mistake.
- C. Incorrect.
Incorrect. Response wrapping creates a short-lived wrapping token used to securely deliver secrets or tokens, but it does not become the permanent identifier for the original token. It is not the normal mechanism for looking up or revoking an already-issued token after the fact.
- D. Incorrect.
Incorrect. A policy name may be attached to many tokens, so it does not uniquely identify one compromised token. Revoking by policy would be too broad and could disrupt multiple workloads. This option reflects a misconception that policies can act as unique token identifiers.