VAULT-ASSOCIATE-002 Question #64: Real Exam Question with Answer & Explanation

Question

What is true of Vault tokens? Choose TWO correct answers.

Options

• AVault tokens are generated by every authentication method login
• BVault tokens are also known as unseal keys
• CVault tokens are required for every Vault call
• DVault token IDs always begin with "s." such as s.E7rOurS2n7m2Dt5409jWxR87
• EVault tokens are the core method for authentication in Vault

Explanation

Vault tokens are generated by every successful authentication method login and serve as the core method for authentication and authorization within Vault.

Common mistakes.

• B. Vault tokens are for authentication, while unseal keys are used to decrypt the master key to bring a sealed Vault server online; they are distinct concepts.
• C. While tokens are generally required for most authenticated Vault API calls, some endpoints (like sys/health or sys/seal in certain contexts) can be accessed unauthenticated, making 'every Vault call' an overstatement.
• D. Standard human-readable Vault token IDs begin with h., not s., which is typically associated with service tokens or specific internal Vault components.

Concept tested. Vault token characteristics and usage

Reference. https://developer.hashicorp.com/vault/docs/concepts/tokens

No community discussion yet for this question.