VAULT-ASSOCIATE-002 · Question #95
Which of these options does not allow the creation of a root token?
The correct answer is A. By using batch tokens. Root tokens cannot be created using batch tokens, as batch tokens are designed for specific, limited use cases and lack the necessary administrative privileges for such a critical operation.
Question
Options
- ABy using batch tokens
- BBy using another root token
- CThe initial root token generated at the time
- DBy using vault operator generate-root with the permission of a quorum of unseal key
How the community answered
(17 responses)- A94% (16)
- B6% (1)
Why each option
Root tokens cannot be created using batch tokens, as batch tokens are designed for specific, limited use cases and lack the necessary administrative privileges for such a critical operation.
Batch tokens are short-lived, high-throughput tokens designed for specific, limited use cases and do not possess the `sudo` capability on the `auth/token/create` path that would be required to create other root tokens. Root token creation is highly restricted to specific, powerful methods.
An existing root token has `sudo` capability on all paths and can therefore create other root tokens.
The initial root token generated during Vault's initialization process is the first and most privileged root token, serving as the starting point for Vault administration.
The `vault operator generate-root` command is specifically designed for secure root token generation, requiring a quorum of unseal keys to reconstruct a new root token.
Concept tested: Vault root token creation methods
Source: https://developer.hashicorp.com/vault/docs/concepts/tokens#root-tokens
Topics
Community Discussion
No community discussion yet for this question.