HashiCorp Vault Associate (003) Question 84
Single answer3c Explain the purpose of token accessorsA security team is investigating suspicious API activity in Vault. They have a token accessor captured from an audit log, but the full client token value is not available. The team wants to identify the token's metadata and, if necessary, revoke that token without exposing or requiring the secret token value itself. What should they do?
- A
Use the token accessor to look up the token and revoke it by accessor if needed.
- B
Convert the accessor back into the original client token, then revoke the token normally.
- C
Use the accessor to authenticate to Vault and read the token's policies directly.
- D
Use the accessor to renew the token's lease and then inspect its metadata.
Show answer and explanation
Correct answer: A
Explanation
Token accessors exist so Vault operators and automated processes can safely reference tokens for management purposes without handling the secret token value itself. In practice, this is useful because audit devices redact or avoid exposing sensitive token values, but may record accessors to support incident response and operational tasks. With an accessor, authorized users can perform token lookup and revoke the token by accessor. However, an accessor cannot be used to authenticate, access secrets, or derive the original token. This aligns with Vault token lifecycle best practices: minimize exposure of client tokens, use audit logs for traceability, and rely on accessors for safe token administration. See Vault documentation for token accessors and token lifecycle operations such as lookup-accessor and revoke-accessor.
- A. Correct.
Correct. A token accessor is a reference to a token that can be used for limited management operations, such as lookup and revocation by accessor, without revealing the token's secret value. This is especially useful in operational and security scenarios because audit logs commonly contain accessors rather than full tokens. The purpose of token accessors is to let operators identify and manage tokens safely when the token value is unavailable or should not be exposed.
- B. Incorrect.
Incorrect. A token accessor is not a reversible encoding of the token, and it cannot be transformed back into the original client token. Vault treats the token value as the secret credential; the accessor is a separate identifier for management tasks.
- C. Incorrect.
Incorrect. A token accessor is not itself an authentication credential. It cannot be presented to Vault in place of a token to access secrets or APIs as that client. This option reflects the common misconception that an accessor can be used like a weaker token.
- D. Incorrect.
Incorrect. Token renewal requires the actual token or an authenticated client with appropriate capabilities to renew it; the accessor is not used as a login credential. While accessors support certain management actions, their purpose is not to act as a substitute for the token in normal authenticated workflows.