HashiCorp Vault Associate (003) Question 90
Single answer3e Explain orphaned tokensA platform team uses Vault to issue temporary tokens for CI jobs. Normally, each job token is created by a parent token owned by the deployment service. During a security review, the team discovers that when the deployment service token is revoked, some long-running emergency access tokens must remain valid until their own TTL expires. Which approach best meets this requirement?
- A
Create the emergency access tokens as orphan tokens so they do not have a parent-child revocation relationship
- B
Create periodic tokens, because periodic tokens are not affected by revocation of the token that created them
- C
Increase the TTL of the deployment service token so child tokens remain valid longer
- D
Use response wrapping, because wrapped tokens are independent of the token that created them
Show answer and explanation
Correct answer: A
Explanation
In Vault, tokens normally participate in a parent-child hierarchy. When a parent token is revoked, its child tokens are typically revoked as well through cascading revocation. An orphan token is a token without a parent, so it is not subject to that parent-driven revocation chain. This makes orphan tokens useful in scenarios where a token must continue functioning even if the creator's token is revoked, such as break-glass access or carefully controlled long-running processes. Candidates should distinguish orphan tokens from other token properties like periodic renewal or TTL. TTL affects how long a token can live; periodic tokens affect renewal behavior; response wrapping affects secret delivery. None of those features replace the parentless behavior of orphan tokens. This aligns with Vault documentation on token hierarchy, token revocation, and orphan tokens.
- A. Correct.
Correct. Orphan tokens have no parent token, so they are not automatically revoked when the token that created or managed other tokens is revoked. This is the key behavior needed when a token must survive parent-token revocation and expire only by its own TTL or explicit revocation.
- B. Incorrect.
Incorrect. Periodic tokens are renewable based on their period, but they are still tokens within Vault's token model and revocation behavior is not bypassed simply because a token is periodic. Being periodic is different from being orphaned.
- C. Incorrect.
Incorrect. Extending the parent token's TTL does not solve the stated problem. If the parent token is revoked, its non-orphan child tokens are revoked as well, regardless of remaining TTL. TTL controls lifetime, not parent-child revocation independence.
- D. Incorrect.
Incorrect. Response wrapping protects secret delivery by creating a single-use wrapping token, but it does not make the underlying issued token independent from Vault's token hierarchy. Wrapping addresses secure transport, not orphaning.