VA-003 Manage Vault leases — 10 Questions

Question 1

Which of the following commands would force a lease to expire immediately?

Accepted Answer

vault lease revoke . Both options B and D force a lease to expire immediately. `vault lease revoke ` is the standard CLI command to revoke a lease, causing immediate expiration. Option D uses the API endpoint directly via `vault write sys/leases/revoke-lease lease_id=`, which also forces immediate revocation. Option A (`vault lease renew -increment=0`) does not revoke; it renews with zero increment, which may be invalid. Option C (`vault lease expire`) is not a valid command.

Answer

vault lease renew -increment=0 <lease_id>

Answer

vault lease expire <lease_id>

Question 2

A DevOps team is using Vault's database secrets engine to generate dynamic credentials for a PostgreSQL database. They notice that the lease duration is set to 24 hours, but security policy requires that credentials expire after 1 hour. What should the team do to enforce the 1-hour expiration without changing the default lease TTL for all secrets?

Accepted Answer

Configure the role with a ttl of 1h.. The database secrets engine allows role-level TTL configuration that overrides the default lease duration for credentials generated from that role. By setting the role's `ttl` to 1h, the team enforces a 1-hour expiration for credentials created under that specific role without affecting the default lease TTL for all secrets or other roles. This directly meets the security policy requirement while maintaining flexibility for other secrets.

Answer

Set the mount's max_lease_ttl to 1h.

Answer

Ask each developer to set the TTL when requesting credentials.

Answer

Use a periodic token with a period of 1h.

Question 3

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 4

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Reducing the default lease TTL (time-to-live) shortens the maximum duration for which a lease can be issued without renewal. When existing leases expire sooner, the system automatically removes them from the active lease count, thereby reducing the number of active leases. This directly affects the lease lifecycle by forcing earlier expiration.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 5

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Accepted Answer

The role's max_ttl is set to 1h.. The role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.

Answer

The lease is not renewable.

Answer

The mount's max_lease_ttl is set to 1h.

Answer

The developer does not have permission to renew the lease.

Question 6

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour.
B. Increase the token TTL for the Kubernetes auth role to 1 hour.
C. Implement a renewal loop in each service to renew tokens every 10 minutes.
D. Use periodic tokens with a period of 1 hour for all services.

Accepted Answer

Increase the token TTL for the Kubernetes auth role to 1 hour.. Increasing the token TTL for the Kubernetes auth role to 1 hour directly addresses the root cause: the current 15-minute TTL is too short for long-running tasks, causing tokens to expire before services can complete their work. By raising the TTL to 1 hour, services have sufficient time to complete tasks and renew tokens, while still maintaining security through short-lived credentials. This approach does not require code changes and leverages Vault's built-in token lifecycle management.

Answer

Increase the default lease TTL for the KV v2 mount to 1 hour.

Answer

Implement a renewal loop in each service to renew tokens every 10 minutes.

Answer

Use periodic tokens with a period of 1 hour for all services.

Question 7

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 8

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Accepted Answer

Call the sys/leases/renew endpoint to renew a lease.. The `sys/leases/renew` endpoint is the standard Vault API endpoint used to renew the lease of a dynamic secret, extending its time-to-live (TTL) within the maximum allowed limit. Option C is correct because the `sys/leases/revoke` endpoint is the designated API endpoint to immediately invalidate a lease and its associated secret, preventing further use and cleaning up the secret engine's state.

Answer

Call the sys/leases/list endpoint to disable a lease.

Answer

Call the sys/leases/extend endpoint to increase the lease duration.

Answer

Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.

Question 9

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Accepted Answer

Modify the application to renew the lease before it expires using the lease ID.. Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.

Answer

Revoke the lease and request a new credential with a longer TTL.

Answer

Increase the TTL of the database role to 2 hours.

Question 10

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Accepted Answer

Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.. Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.

Answer

Set the default lease TTL on the database mount to 1 hour.

Answer

Increase the system's default lease TTL to 48 hours to give applications more flexibility.

Answer

Manually revoke leases after each application finishes using them.