True or False? To prepare for day-to-day operations, the root token should be safely saved outside of Vault in order to administer Vault.

Comprehensive and Detailed in Depth

The statement is False. Saving the root token outside of Vault for day-to-day operations is not a

recommended practice and contradicts Vault’s security principles. The HashiCorp Vault

documentation explicitly states: "For day-to-day operations, the root token should be revoked after

configuring other auth methods, which admins and Vault clients will use." This is because the root

token has unrestricted access to all Vault operations, posing a significant security risk if stored

externally and used routinely. Instead, Vault encourages the use of less-privileged tokens or

alternative authentication methods post-initialization.

The documentation further elaborates under the "Root Tokens" section: "Root tokens are tokens with

an infinite TTL that have the 'root' policy attached to them. Because of their power, it is strongly

recommended that they be used only as necessary and then immediately revoked when no longer

needed." Storing the root token outside Vault increases the risk of compromise, and Vault’s design

assumes it is used sparingly—typically only during initial setup—and then replaced with more

secure, limited-privilege mechanisms. Thus, the correct operational approach is to revoke the root

token after setup, not save it externally, making B (False) the correct answer.

Reference:

HashiCorp Vault Documentation - Tokens: Root Tokens