HashiCorp Vault Associate (003) Question 97
Single answer3f Describe how to create tokens based on needA platform team uses HashiCorp Vault to support both human operators and automated workloads. They want to create tokens that match each use case with the least operational overhead and risk. Which approach best aligns with Vault best practices for creating tokens based on need?
- A
Create a long-lived service token for every use case, including CI pipelines and human administrators, so workflows are not interrupted by token expiration.
- B
Use batch tokens for high-scale, short-lived automated requests where child token creation and renewal are not needed, and use service tokens when features such as renewal, accessors, or child tokens are required.
- C
Use root tokens for automation because they avoid policy misconfiguration and can be revoked later if needed.
- D
Use periodic tokens for all users and applications because they never expire as long as Vault is running.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to select token types based on the operational and security requirements of the workload. In Vault, service tokens are the full-featured default token type and support capabilities such as renewal, accessors, cubbyhole, and child token creation. Batch tokens are optimized for scalable, ephemeral workloads and trade away those features for lower overhead. This makes batch tokens a strong fit for short-lived automated requests, such as certain high-volume API interactions, while service tokens are better when lifecycle management features are needed. Vault guidance also emphasizes least privilege, avoiding root token use for normal operations, and preferring short-lived credentials where possible. These distinctions are covered in Vault token documentation, including token types, token lifecycles, and recommendations around root token handling.
- A. Incorrect.
This is incorrect because using long-lived service tokens everywhere increases risk and ignores the differences between human and machine use cases. Vault best practices favor issuing tokens with the minimum lifetime and capability necessary. Human users typically authenticate through an auth method and receive scoped, renewable tokens as needed, while many automated workloads benefit from short-lived tokens rather than persistent ones.
- B. Correct.
This is correct. Batch tokens are intended for lightweight, high-throughput, short-lived use cases and have fewer features than service tokens. They are suitable when you do not need renewal, cubbyhole, child token creation, or token accessors. Service tokens are the general-purpose token type and should be used when those richer lifecycle and management features are required. Choosing between batch and service tokens based on operational need is the key applied concept.
- C. Incorrect.
This is incorrect because root tokens are highly privileged and should be tightly controlled, used sparingly, and generally avoided for routine automation. Using root tokens for convenience violates least-privilege principles and creates significant security exposure. Revocation does not make this a good design choice.
- D. Incorrect.
This is incorrect because periodic tokens are not appropriate for every use case, and the statement about never expiring is misleading. Periodic tokens require renewal before each period ends; if renewal stops, they expire. They can be useful for certain services that must maintain access without a fixed max TTL, but they are not a universal default for humans and applications.