VAULT-ASSOCIATE-002 · Question #47
To create a non-root token with time-to-live (TTL) set to 30 minutes but with no max TTL which flag would you use?
The correct answer is A. -ttl=30n. To set a token's time-to-live (TTL) to 30 minutes, you would use the -ttl=30m flag, with the 'no max TTL' property typically managed by other configuration or policy settings allowing indefinite renewal.
Question
Options
- A-ttl=30n
- B-explicit-max-ttl=0
- C-orphan
- DNone of the above
How the community answered
(37 responses)- A84% (31)
- B5% (2)
- C3% (1)
- D8% (3)
Why each option
To set a token's time-to-live (TTL) to 30 minutes, you would use the `-ttl=30m` flag, with the 'no max TTL' property typically managed by other configuration or policy settings allowing indefinite renewal.
The `-ttl=30m` flag correctly sets the token's initial time-to-live to 30 minutes as specified. The property of 'no max TTL' means the token can be renewed indefinitely up to its parent's limits, which is often configured via a policy or by using the `-explicit-max-ttl=0` flag, but `-ttl=30m` specifically addresses the initial TTL requirement.
The `-explicit-max-ttl=0` flag sets the token's explicit maximum TTL to zero, meaning it can be renewed indefinitely up to its parent's limits, but it does not specify the initial TTL of 30 minutes, which is a separate requirement.
The `-orphan` flag creates a token without a parent, which is a different concern than setting its TTL or max TTL.
Option A is the correct flag for setting the initial TTL.
Concept tested: Vault token creation with TTL
Source: https://developer.hashicorp.com/vault/docs/commands/token/create#options
Topics
Community Discussion
No community discussion yet for this question.