HashiCorp Vault Associate (003) Question 94
Single answer3e Explain orphaned tokensA platform team uses Vault to issue short-lived tokens to CI jobs. During troubleshooting, an engineer notices that when the token used to create a child token is revoked, some child tokens continue to work instead of being revoked with the parent. The team wants to understand why this happens and when it is expected behavior. Which statement best explains the situation?
- A
The child tokens are orphan tokens, which do not have a parent in the token hierarchy, so revoking the creator token does not automatically revoke them.
- B
The child tokens must be periodic tokens, and periodic tokens are never revoked when their parent token is revoked.
- C
The child tokens were created with a longer TTL than the parent, so they outlive the parent and remain valid until their own TTL expires.
- D
The creator token was renewed before revocation, so Vault preserves all child tokens to avoid interrupting active sessions.
Show answer and explanation
Correct answer: A
Explanation
Vault maintains a token hierarchy in which child tokens are normally revoked when their parent is revoked. Orphan tokens are an exception because they have no parent in that hierarchy. As a result, revoking the token that created or introduced them does not automatically revoke them. This is important in real-world operations because orphan tokens can be useful when you want a token to survive beyond the lifecycle of the token that issued it, but they also require careful TTL, renewal, and policy management to avoid leaving unintended access in place. This aligns with Vault token concepts and revocation behavior documented in HashiCorp Vault's token and auth method documentation.
- A. Correct.
Correct. Orphan tokens are tokens without a parent in Vault's token hierarchy. Because they are not linked to a parent token for revocation purposes, revoking the token that created them does not automatically revoke them. This is the key behavior that distinguishes orphaned tokens from normal child tokens.
- B. Incorrect.
Incorrect. Periodic tokens are renewable according to their period, but that does not mean they are inherently exempt from parent-child revocation behavior. A token being periodic and a token being orphaned are separate concepts. Someone might choose this option because periodic tokens can seem independent due to their renewal pattern, but that is not what explains survival after parent revocation.
- C. Incorrect.
Incorrect. TTL alone does not override token hierarchy revocation. In Vault, revoking a parent token normally revokes its descendants even if those descendants still have time remaining on their TTLs. This option reflects a common misconception that expiration time is the only factor controlling token validity.
- D. Incorrect.
Incorrect. Renewing a token extends its lifetime within allowed limits, but it does not change the revocation relationship of its child tokens. Parent-child revocation semantics still apply unless the child token is orphaned. This distractor is plausible because renewal and revocation are both token lifecycle operations, but they solve different problems.