HashiCorp Vault Associate (003) Question 92
Single answer3e Explain orphaned tokensA platform team uses HashiCorp Vault to issue tokens for a CI/CD system that runs long deployments. During maintenance, an administrator revokes the administrator token that originally created the CI/CD token. The team notices that the CI/CD deployment continues to access Vault successfully and wants to understand why. Which explanation best describes what happened?
- A
The CI/CD token is an orphan token, so it has no parent and is not revoked as part of parent-child token revocation.
- B
The CI/CD token automatically became a root token when its parent was revoked, so it retained access.
- C
Vault converts service tokens into batch tokens when their parent is revoked, allowing them to continue until TTL expires.
- D
The administrator token revocation only removes the administrator's policies, not any child tokens it created.
Show answer and explanation
Correct answer: A
Explanation
Vault uses a parent-child token hierarchy for most service tokens. By default, child tokens are tied to the token that created them, and revoking the parent revokes its descendants. Orphan tokens are an exception: they have no parent, so they are not automatically revoked when the creating or associated token is revoked. This is useful for workloads that must survive the lifecycle of the token used to create them, but it also requires careful governance because orphaned tokens can outlive the administrative session that issued them. In practice, operators create orphan tokens intentionally, such as with token creation settings that specify no parent relationship. HashiCorp Vault documentation on token hierarchy, token revocation, and orphan tokens describes this behavior and its operational implications.
- A. Correct.
Correct. An orphan token has no parent in Vault's token hierarchy. Normally, revoking a parent token also revokes its child tokens recursively. If a token is orphaned, it is independent of that parent-child revocation chain, so revoking the original creator token does not automatically revoke the orphan token. This behavior is important in real deployments where long-running processes need token continuity independent of the creator token.
- B. Incorrect.
Incorrect. Revoking a parent token does not promote child tokens to root tokens. Root tokens are a special token type with unrestricted capabilities, and they are not created implicitly by revocation events. This option reflects a dangerous misconception because token privilege does not increase automatically in Vault.
- C. Incorrect.
Incorrect. Vault does not convert service tokens into batch tokens when a parent is revoked. Service tokens and batch tokens are distinct token types with different behaviors and use cases. Parent revocation behavior is related to token lineage, not automatic token-type conversion.
- D. Incorrect.
Incorrect. Revoking a token in Vault does more than remove that token's policies. In the normal token hierarchy, revoking a token also revokes its child tokens unless those children are orphaned. This option confuses policy attachment with token revocation and token lineage.