By default, what happens to child tokens when a parent token is revoked?

Comprehensive and Detailed in Depth

By default, when a parent token is revoked, all child tokens are also revoked. The HashiCorp Vault

documentation (via support article) states: "When a parent token is revoked, all of its child tokens—

and all of their leases—are revoked as well. This ensures that a user cannot escape revocation by

simply generating a never-ending tree of child tokens." This hierarchical revocation ensures security

by terminating all derived access when the parent is invalidated.

The documentation on tokens adds: "Tokens in Vault are part of a hierarchy. Child tokens inherit

properties from their parents, and revoking a parent token cascades to its children." Options like

renewal, conversion to parent tokens, or creating new child tokens do not occur by default. Thus, A is

correct.

Reference:

HashiCorp Support - Parent-Child Token Hierarchy

HashiCorp Vault Documentation - Tokens