VA-003 Manage Vault leases — 20 Questions

Question 1

Which of the following commands would force a lease to expire immediately?

Accepted Answer

vault lease revoke . Both options B and D force a lease to expire immediately. `vault lease revoke ` is the standard CLI command to revoke a lease, causing immediate expiration. Option D uses the API endpoint directly via `vault write sys/leases/revoke-lease lease_id=`, which also forces immediate revocation. Option A (`vault lease renew -increment=0`) does not revoke; it renews with zero increment, which may be invalid. Option C (`vault lease expire`) is not a valid command.

Answer

vault lease renew -increment=0 <lease_id>

Answer

vault lease expire <lease_id>

Question 2

A DevOps team is using Vault's database secrets engine to generate dynamic credentials for a PostgreSQL database. They notice that the lease duration is set to 24 hours, but security policy requires that credentials expire after 1 hour. What should the team do to enforce the 1-hour expiration without changing the default lease TTL for all secrets?

Accepted Answer

Configure the role with a ttl of 1h.. The database secrets engine allows role-level TTL configuration that overrides the default lease duration for credentials generated from that role. By setting the role's `ttl` to 1h, the team enforces a 1-hour expiration for credentials created under that specific role without affecting the default lease TTL for all secrets or other roles. This directly meets the security policy requirement while maintaining flexibility for other secrets.

Answer

Set the mount's max_lease_ttl to 1h.

Answer

Ask each developer to set the TTL when requesting credentials.

Answer

Use a periodic token with a period of 1h.

Question 3

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Accepted Answer

24h. (24h) because when a certificate request is made, Vault applies the most restrictive TTL among the role's configured `ttl`, the mount's default lease TTL, and the requested TTL. Here, the role's `ttl` of 24h is the shortest, so it overrides both the requested 48h and the mount default of 72h, resulting in a certificate with a 24-hour validity.

Answer

The request will be rejected because the requested TTL exceeds the role's ttl.

Answer

48h

Answer

72h

Question 4

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Accepted Answer

Reducing the default lease TTL. Reducing the default lease TTL (time-to-live) shortens the maximum duration for which a lease can be issued without renewal. When existing leases expire sooner, the system automatically removes them from the active lease count, thereby reducing the number of active leases. This directly affects the lease lifecycle by forcing earlier expiration.

Answer

Creating a new lease

Answer

Increasing the max lease TTL

Answer

Renewing a lease

Question 5

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Accepted Answer

The role's max_ttl is set to 1h.. The role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.

Answer

The lease is not renewable.

Answer

The mount's max_lease_ttl is set to 1h.

Answer

The developer does not have permission to renew the lease.

Question 6

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour.
B. Increase the token TTL for the Kubernetes auth role to 1 hour.
C. Implement a renewal loop in each service to renew tokens every 10 minutes.
D. Use periodic tokens with a period of 1 hour for all services.

Accepted Answer

Increase the token TTL for the Kubernetes auth role to 1 hour.. Increasing the token TTL for the Kubernetes auth role to 1 hour directly addresses the root cause: the current 15-minute TTL is too short for long-running tasks, causing tokens to expire before services can complete their work. By raising the TTL to 1 hour, services have sufficient time to complete tasks and renew tokens, while still maintaining security through short-lived credentials. This approach does not require code changes and leverages Vault's built-in token lifecycle management.

Answer

Increase the default lease TTL for the KV v2 mount to 1 hour.

Answer

Implement a renewal loop in each service to renew tokens every 10 minutes.

Answer

Use periodic tokens with a period of 1 hour for all services.

Question 7

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 8

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Accepted Answer

Call the sys/leases/renew endpoint to renew a lease.. The `sys/leases/renew` endpoint is the standard Vault API endpoint used to renew the lease of a dynamic secret, extending its time-to-live (TTL) within the maximum allowed limit. Option C is correct because the `sys/leases/revoke` endpoint is the designated API endpoint to immediately invalidate a lease and its associated secret, preventing further use and cleaning up the secret engine's state.

Answer

Call the sys/leases/list endpoint to disable a lease.

Answer

Call the sys/leases/extend endpoint to increase the lease duration.

Answer

Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.

Question 9

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Accepted Answer

Modify the application to renew the lease before it expires using the lease ID.. Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.

Answer

Revoke the lease and request a new credential with a longer TTL.

Answer

Increase the TTL of the database role to 2 hours.

Question 10

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Accepted Answer

Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.. Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.

Answer

Set the default lease TTL on the database mount to 1 hour.

Answer

Increase the system's default lease TTL to 48 hours to give applications more flexibility.

Answer

Manually revoke leases after each application finishes using them.

Question 11

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Accepted Answer

The initial lease duration will be 30 minutes (the role TTL).. When a role has an explicit role TTL (30 minutes), Vault uses that value as the initial lease duration for credentials generated under that role, overriding the default mount TTL. The default lease TTL of 15 minutes on the AWS mount only applies when no role TTL is specified.

Answer

The lease can be renewed indefinitely up to the system max TTL.

Answer

The initial lease duration will be 15 minutes (the default lease TTL).

Answer

The lease duration is the minimum of default lease and role TTL.

Question 12

Drag and drop the steps to configure Vault's audit logging to a file into the correct order.

Accepted Answer

Enable audit device, then perform operations to generate log entries, then verify the audit log.. The correct sequence for configuring Vault's audit logging to a file is: first enable the audit device (e.g., 'vault audit enable file file_path=...'), then perform operations (e.g., read/write secrets) to generate audit log entries, and finally verify the log file to confirm entries are being recorded. Common mistakes include enabling after generating logs, verifying too early, or skipping the generation step.

Answer

Perform operations to generate log entries, then enable audit device, then verify the audit log.

Answer

Verify audit log, then enable audit device, then perform operations to generate log entries.

Answer

Enable audit device, then verify the audit log, then perform operations to generate log entries.

Question 13

Match each Vault term to its definition.

Accepted Answer

Secret: A piece of sensitive data stored in Vault. Correct matches: Secret is sensitive data; Token is an authentication credential. Common confusions: Policy vs. Auth Method — policies control access, auth methods authenticate users.

Answer

Policy: A method used to authenticate a user or machine to Vault

Answer

Auth Method: A set of rules defining access permissions in Vault

Question 14

An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?

Accepted Answer

The revocation script failed to delete the database user.. When a lease is revoked in Vault, the revocation script associated with the database secret engine is responsible for deleting or disabling the corresponding database user. If that script fails (e.g., due to insufficient permissions, network issues, or a bug in the script), the underlying credential remains active in the database, even though the lease is no longer valid in Vault. This is a common operational issue where the lease lifecycle and the actual credential lifecycle become out of sync.

Answer

The secret engine caches credentials.

Answer

The lease ID was incorrect.

Answer

The lease was renewed after revocation.

Question 15

What command is used to view the remaining time on a lease?

Accepted Answer

vault lease lookup . The correct command to view the remaining time on a lease is `vault lease lookup `. This command retrieves the lease metadata, including the issue time, duration (TTL), and remaining time, directly from the Vault server. It is the standard method for inspecting lease details without extending or modifying the lease.

Answer

vault lease info <lease_id>

Answer

vault status <lease_id>

Answer

vault read <lease_id>

Question 16

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Accepted Answer

Vault is sealed. When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Answer

Upstream error

Answer

Permission denied

Answer

Lease not found

Question 17

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Accepted Answer

Use Vault agent with a template and renew capability.. Vault Agent's template and renew capability is the recommended approach because it automatically manages the lifecycle of dynamic secrets, including renewing leases before they expire. Vault Agent runs as a sidecar or daemon and uses its built-in renewer to periodically extend the lease TTL, ensuring the application always has a valid secret without manual intervention or external scheduling.

Answer

Set the lease TTL to infinite.

Answer

Use a cron job to call vault lease renew periodically.

Answer

Use periodic tokens with auto-renewal.

Question 18

Which of the following best describes a Vault lease?

Accepted Answer

A time-limited agreement that governs the lifecycle of a secret.. A Vault lease is a time-bound agreement that governs the lifecycle of a secret, including its validity period, renewal, and revocation. When a secret is read from Vault, it is returned with a lease ID and a lease duration (TTL), after which the secret is automatically revoked unless renewed. This ensures that secrets are not valid indefinitely, reducing the risk of exposure.

Answer

A permission to access a path.

Answer

A contract to use a secret for a certain duration.

Answer

The actual secret value.

Question 19

An operator runs vault lease list and sees many expired leases. Why are expired leases still listed?

Accepted Answer

Vault keeps expired leases for auditing until cleaned up by garbage collection.. Vault does not immediately remove expired leases; they are cleaned up by a periodic garbage collection process. Until then, they may appear in listing.

Answer

The leases are not actually expired.

Answer

The operator has a permission to see expired leases.

Answer

Expired leases are never removed.

Question 20

What happens when a lease reaches its TTL?

Accepted Answer

The lease is marked as expired and can no longer be renewed.. When a lease reaches its Time-To-Live (TTL), it becomes expired and cannot be renewed. Vault does not automatically delete the lease from storage at the moment of TTL expiry; rather, the lease is marked as expired and is eventually garbage-collected. This cleanup is separate from revocation of the underlying secret, which must be performed explicitly or via a different mechanism.

Answer

The lease is automatically renewed.

Answer

The secret is automatically revoked.

Answer

The lease is deleted from storage.