VA-003 Practice Test 5 — 10 Questions

Question 1

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. When a role's configuration is changed, existing leases are not updated. Users who obtained leases before the renewable flag was set to false would still have leases with renewable=true. Option C correctly identifies that the role was likely updated after some leases were issued. Option A is incorrect because the renewable flag is respected. Option B is incorrect; the lease's renewable property is independent of the token's. Option D is false; renewable applies to secret engine leases as well.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 2

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . Using 'vault lease revoke -prefix ' revokes all leases under that prefix, effectively cleaning them up without disabling the engine.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0

Question 3

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. Setting default_ttl=1h, max_ttl=4h, and renewable=true allows the lease to be renewed up to a total lifespan of 4 hours, with initial TTL of 1 hour. Option B is correct. Option A has renewable=false, preventing renewal. Option C has max_ttl less than default, which is invalid. Option D adds an unnecessary ttl parameter.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 4

Which two commands can be used to manually revoke leases? (Choose two.)

Accepted Answer

vault lease revoke . Both 'vault lease revoke ' and 'vault lease revoke -prefix ' are valid commands for manually revoking leases. Other options either renew, disable the entire mount, or revoke tokens.

Answer

vault secrets disable <path>

Answer

vault token revoke <token>

Answer

vault lease renew <lease_id>

Question 5

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command displays lease details including remaining TTL. Option D is correct. Option A reads from sys/leases/lookup but that path is for listing leases, not a single lease. Option B lists leases, not checks a specific lease. Option C with -increment=0 would attempt a renewal, not a lookup.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 6

An admin wants to revoke all leases associated with a specific AWS IAM user created by Vault. Which command should they use?

Accepted Answer

vault lease revoke -prefix aws/creds/myrole. The `vault lease revoke -prefix` command revokes all leases with a given prefix. The prefix for AWS IAM users created by a role is typically 'aws/creds/role-name'. Option C correctly uses the -prefix flag. Option A revokes only that exact path if it were a lease ID. Option B has no -prefix. Option D has an incorrect syntax.

Answer

vault lease revoke aws/creds/myrole/ -prefix

Answer

vault lease revoke aws/creds/myrole

Answer

vault lease revoke -path aws/creds/myrole

Question 7

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . Both `vault lease revoke -prefix ` and `vault write sys/leases/revoke-prefix ` will revoke all leases with the given prefix, which can target the mount or role involved in the policy violation. Option A revokes a specific lease only. Option B revokes a token and its leases, but not specifically by policy prefix. Option E has an incorrect path.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 8

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault does not automatically revoke the actual database user when a lease expires; it relies on the tidy operation to clean up stale leases and revoke the underlying credentials. If tidy is not run or configured, expired leases can leave behind database users. Option B is correct. Option A: high max_ttl would lengthen lifespan but still eventually expire. Option C: rotation statement affects password changes, not revocation. Option D: network issues could cause revocation failures, but tidy would still help clean up.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 9

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The lease's actual TTL is influenced by the role's default_ttl (initial TTL), the role's max_ttl (maximum allowed total TTL), and the system's max_lease_ttl configuration (global cap). The requesting token's TTL does not directly impact lease TTL. The rotation period is for password rotation, not lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 10

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The max_ttl field shows 1h, which is the maximum total time the lease can exist from its issue time, including all renewals. The current ttl of 30m is the remaining time if not renewed, but the lease can be renewed up to the max_ttl of 1 hour. Option B is correct.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes