Skip to content
Cheat sheets

003 · Domain 3: Vault tokens · 15% of the exam

Task 3.5: Explain orphaned tokens

The token tree and cascading revocation, orphan tokens that survive their creator, the ways to create them, and revoke-orphan.

Study it

  • Token hierarchies and orphan tokens

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A deployment service's token creates tokens for 300 workers with vault token create. Rotating the deployment service's own token revoked every worker token and caused an outage. Worker tokens must survive that rotation. The deployment service's policy grants update on auth/token/create and auth/token/create/* only, and must not be given sudo. Which approach works?

  1. ACreate the worker tokens with vault token create -orphan using the current policy
  2. BCreate the worker tokens against a token role that has orphan set to true
  3. CCreate them as batch tokens, since batch tokens never have a parent
  4. DCreate the worker tokens with -period=24h, since periodic tokens outlive their parent
Show the answer and why

  • ACreate the worker tokens with vault token create -orphan using the current policy

    Incorrect

    Creating an orphan on auth/token/create needs sudo or root, which the service must not have.

  • BCreate the worker tokens against a token role that has orphan set to true

    Correct

    A token role can make its tokens orphans, so they are not revoked with their creator, and using it needs no sudo.

  • CCreate them as batch tokens, since batch tokens never have a parent

    Incorrect

    Batch tokens can have parents too; the token type does not decide whether a token is an orphan.

  • DCreate the worker tokens with -period=24h, since periodic tokens outlive their parent

    Incorrect

    Being periodic changes renewal, not the token tree; the tokens would still be revoked with the parent.

Revoking a parent revokes its children. Orphan tokens start their own tree; a token role with orphan enabled issues them without granting sudo.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 2 · choose 1

A team must revoke a compromised parent token, but the 50 child tokens it created for running jobs must keep working. Which command does that?

  1. Avault token revoke <token>
  2. Bvault token revoke -mode=path <token>
  3. Cvault token revoke -mode=children <token>
  4. Dvault token revoke -mode=orphan <token>
Show the answer and why

  • Avault token revoke <token>

    Incorrect

    The default mode revokes the token and all of its children.

  • Bvault token revoke -mode=path <token>

    Incorrect

    Path mode revokes tokens created under an auth path prefix, children included.

  • Cvault token revoke -mode=children <token>

    Incorrect

    There is no children mode; without -mode the token and all its children are revoked.

  • Dvault token revoke -mode=orphan <token>

    Correct

    Orphan mode revokes only the token and leaves its children as orphans.

revoke-orphan is powerful and should be used with caution, since the orphaned children stay valid on their own.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 3 · choose 1

A user logs in through the LDAP auth method. Which token is the parent of the token the user receives?

  1. AThe token of the operator who configured the LDAP mount
  2. BNone; such login tokens are orphans
  3. CThe initial root token
  4. DThe LDAP mount's service token, created when it was enabled
Show the answer and why

  • AThe token of the operator who configured the LDAP mount

    Incorrect

    Configuring a mount does not make its tokens children of anyone.

  • BNone; such login tokens are orphans

    Correct

    Logging in with any non-token auth method is one of the documented ways orphan tokens are created.

  • CThe initial root token

    Incorrect

    Root tokens are not automatic parents of login tokens.

  • DThe LDAP mount's service token, created when it was enabled

    Incorrect

    Mounts do not have service tokens that act as parents.

Login tokens start their own trees; tokens the user later creates become their children.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 4 · choose 1

A service without sudo must create orphan tokens through the HTTP API, and its policy may name any token store path. Which endpoint lets it do so?

  1. Aauth/token/create-orphan
  2. Bauth/token/create with no_parent=true
  3. Cauth/token/revoke-orphan
  4. Dauth/token/create with type=batch
Show the answer and why

  • Aauth/token/create-orphan

    Correct

    Write access to create-orphan is enough; no root or sudo is needed there.

  • Bauth/token/create with no_parent=true

    Incorrect

    no_parent only takes effect for a root or sudo caller.

  • Cauth/token/revoke-orphan

    Incorrect

    That endpoint revokes a token and orphans its children.

  • Dauth/token/create with type=batch

    Incorrect

    A batch token is still a child of its creator unless created as an orphan.

Orphans come from create-orphan with write access, or from create with no_parent when the caller has root or sudo.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 5 · choose 1

An operator wants to confirm whether a given token has a parent. Which command shows it?

  1. Avault token capabilities <token>, which reports its parent
  2. Bvault auth list, which lists each token's parent
  3. Cvault token lookup <token>, which shows the orphan field
  4. Dvault lease lookup <token>, which shows its parent token
Show the answer and why

  • Avault token capabilities <token>, which reports its parent

    Incorrect

    It does not report token relationships such as a parent.

  • Bvault auth list, which lists each token's parent

    Incorrect

    auth list shows the enabled auth methods, not token relationships.

  • Cvault token lookup <token>, which shows the orphan field

    Correct

    The lookup response includes the orphan field.

  • Dvault lease lookup <token>, which shows its parent token

    Incorrect

    lease lookup inspects leases by lease ID.

Token lookup shows the token's type, policies, TTLs, use limit and whether it is an orphan.

HashiCorp documentation

Task 3.5Report a problem with this question

Practice domain 3 →Practice all domains →