VA-003 Manage Vault leases — 25 Questions

Question 1

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Accepted Answer

The role's max_ttl is set to 1h.. The role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.

Answer

The lease is not renewable.

Answer

The mount's max_lease_ttl is set to 1h.

Answer

The developer does not have permission to renew the lease.

Question 2

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour.
B. Increase the token TTL for the Kubernetes auth role to 1 hour.
C. Implement a renewal loop in each service to renew tokens every 10 minutes.
D. Use periodic tokens with a period of 1 hour for all services.

Accepted Answer

Increase the token TTL for the Kubernetes auth role to 1 hour.. Increasing the token TTL for the Kubernetes auth role to 1 hour directly addresses the root cause: the current 15-minute TTL is too short for long-running tasks, causing tokens to expire before services can complete their work. By raising the TTL to 1 hour, services have sufficient time to complete tasks and renew tokens, while still maintaining security through short-lived credentials. This approach does not require code changes and leverages Vault's built-in token lifecycle management.

Answer

Increase the default lease TTL for the KV v2 mount to 1 hour.

Answer

Implement a renewal loop in each service to renew tokens every 10 minutes.

Answer

Use periodic tokens with a period of 1 hour for all services.

Question 3

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 4

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Accepted Answer

Call the sys/leases/renew endpoint to renew a lease.. Option A is correct because Vault exposes the sys/leases/renew endpoint, which renews a lease for a dynamic secret by extending its validity using the lease_id and an optional increment, provided the lease is renewable. Option C is correct because the sys/leases/revoke endpoint revokes a lease immediately by lease_id, invalidating the dynamic secret and removing it from the lease store. The other options are not valid: sys/leases/list is not a real endpoint for disabling leases (listing is done via sys/leases/lookup or the leases list API), sys/leases/extend does not exist (renewal is handled by sys/leases/renew), and sys/leases/rotate is not a lease-management endpoint (rotation applies to encryption keys or root credentials, not individual leases).

Answer

Call the sys/leases/list endpoint to disable a lease.

Answer

Call the sys/leases/extend endpoint to increase the lease duration.

Answer

Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.

Question 5

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Accepted Answer

Modify the application to renew the lease before it expires using the lease ID.. Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.

Answer

Revoke the lease and request a new credential with a longer TTL.

Answer

Increase the TTL of the database role to 2 hours.

Question 6

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Accepted Answer

Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.. Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.

Answer

Set the default lease TTL on the database mount to 1 hour.

Answer

Increase the system's default lease TTL to 48 hours to give applications more flexibility.

Answer

Manually revoke leases after each application finishes using them.

Question 7

A security policy requires that all leases must be revoked within 1 hour of creation. Which setting should be configured on the secret engine mount?

Accepted Answer

default_lease_ttl = 1h and max_lease_ttl = 1h. The security policy requires that all leases must be revoked within 1 hour of creation, meaning no lease can exceed 1 hour. The `default_lease_ttl` sets the initial TTL for leases when no specific TTL is provided, and the `max_lease_ttl` enforces an absolute upper limit that no lease can exceed. Configuring both to 1h ensures that every lease starts with a 1-hour TTL and cannot be renewed or extended beyond that hard cap, guaranteeing revocation within 1 hour.

Answer

default_lease_ttl = 1h

Answer

token_ttl = 1h

Answer

max_lease_ttl = 1h

Question 8

Refer to the exhibit. An operator wants the credential to be valid for exactly 2 hours. What should they do?

Accepted Answer

Increase the role's max_ttl to 2h.. In HashiCorp Vault, the maximum TTL for a credential issued by a role is capped by the role's max_ttl parameter. To allow credentials to be valid for exactly 2 hours, the role's max_ttl must be set to at least 2h. The mount's max_lease_ttl sets the absolute upper limit for all leases from that mount, but the role's max_ttl is the specific setting that controls the maximum TTL for credentials generated by that role.

Answer

Increase the mount's max_lease_ttl to 2h.

Answer

Renew the lease with a TTL of 2h.

Answer

Request a new credential with a TTL of 2h.

Question 9

Refer to the exhibit. A user with this policy can successfully read credentials but cannot renew the lease. What is the missing capability?

Accepted Answer

'update' on sys/leases/renew.. The user can read credentials but cannot renew the lease because the policy grants 'read' and 'list' capabilities on the secret path, but renewing a lease requires the 'update' capability on the 'sys/leases/renew' endpoint. This endpoint is used to extend the lifetime of a lease, and without 'update' access, the renewal request is denied.

Answer

'list' on sys/leases/.

Answer

'renew' on the secret path.

Answer

'sudo' on sys/leases/.

Question 10

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lease ID is incorrect.. The error message indicates that the lease ID provided for the renewal or revocation operation is invalid. In Vault, lease IDs are unique identifiers tied to a specific secret or token lease. If the lease ID is incorrect—due to a typo, truncation, or mismatch—Vault cannot locate the lease, resulting in this error. Option C correctly identifies this as the most likely cause.

Answer

The token lacks permission.

Answer

The secret engine was disabled.

Answer

The lease has expired.

Question 11

A DevOps team uses Vault to generate temporary database credentials. They notice that some applications are failing because their database credentials expire unexpectedly before the expected TTL. The Vault admin configured the database role with a default TTL of 1h and max TTL of 24h. What is the most likely cause?

Accepted Answer

The application is not renewing the lease, and the lease TTL is counted from the issue time.. Vault database credentials are issued as leases with a TTL that starts counting from the moment they are issued. If the application does not renew the lease, the credentials expire exactly after the default TTL (1 hour) has elapsed, regardless of the max TTL setting. The failure occurs because the application expects the credentials to last longer, but the lease TTL is not extended without renewal.

Answer

The database role's max TTL is being enforced, but the default TTL is shorter.

Answer

The Vault server's clock is skewed, causing early expiry.

Answer

The application is renewing the lease too frequently, causing Vault to reset the TTL.

Question 12

An admin wants to revoke all leases associated with a specific AWS IAM user created by Vault. Which command should they use?

Accepted Answer

vault lease revoke -prefix aws/creds/myrole. The `vault lease revoke -prefix` command revokes all leases that share a given prefix. Since AWS IAM user credentials generated by Vault under `aws/creds/myrole` have lease IDs that begin with that path, using the `-prefix` flag ensures all associated leases are revoked, regardless of their full lease ID.

Answer

vault lease revoke aws/creds/myrole/ -prefix

Answer

vault lease revoke aws/creds/myrole

Answer

vault lease revoke -path aws/creds/myrole

Question 13

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command is the correct way to inspect the remaining lifespan and metadata of a specific lease in Vault. It returns details such as the lease ID, issue time, expiration time, and TTL, allowing the admin to determine how much time remains before the lease expires.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 14

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault's database secrets engine does not automatically clean up stale user accounts in the target database. The `tidy` operation must be explicitly configured and run to remove users whose leases have expired or been revoked. Without it, even if Vault correctly revokes the lease, the database user may remain, leading to an accumulation of stale accounts.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 15

Which of the following commands would force a lease to expire immediately?

Accepted Answer

vault lease revoke . Both options B and D force a lease to expire immediately. `vault lease revoke ` is the standard CLI command to revoke a lease, causing immediate expiration. Option D uses the API endpoint directly via `vault write sys/leases/revoke-lease lease_id=`, which also forces immediate revocation. Option A (`vault lease renew -increment=0`) does not revoke; it renews with zero increment, which may be invalid. Option C (`vault lease expire`) is not a valid command.

Answer

vault lease renew -increment=0 <lease_id>

Answer

vault lease expire <lease_id>

Question 16

A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?

Accepted Answer

The OTP key is only valid for one-time use and cannot be renewed.. Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.

Answer

The renewable flag is set to false on the role.

Answer

The user's token does not have permission to renew leases.

Answer

The max_ttl of 30m is reached, but the OTP has already been used.

Question 17

An admin wants to view all active leases for a specific secrets engine path. Which two approaches are valid? (Choose two.)

Accepted Answer

vault list sys/leases/lookup/. `vault list sys/leases/lookup/` lists all active lease IDs for a given secrets engine mount path by querying the lease lookup endpoint. Option C is correct because `vault list sys/leases/prefix/` lists leases that share a common prefix, which effectively returns all active leases under that mount path when the mount path is used as the prefix. Both commands use the `list` operation against the sys/leases API to retrieve active lease IDs.

Answer

vault write sys/leases/list lease_id=<mount_path>

Answer

vault lease list -prefix <mount_path>

Answer

vault read sys/leases/list/<mount_path>

Question 18

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The actual TTL of a lease issued by a secrets engine is determined by the minimum of three values: the role's `default_ttl`, the role's `max_ttl`, and the system's `max_lease_ttl` configuration. The system's `max_lease_ttl` acts as a hard upper bound that cannot be exceeded by any lease, regardless of role settings. This ensures that even if a role has a longer `default_ttl`, the system-wide limit will cap the lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 19

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . `vault write sys/leases/revoke-prefix ` revokes all leases sharing a given prefix, which is the standard method for bulk revocation based on a policy violation path. Option E is correct because `vault lease revoke -prefix ` achieves the same result by revoking all leases under a specified mount path, effectively targeting the same scope. Both commands allow an admin to revoke multiple leases associated with a particular policy violation without needing individual lease IDs.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 20

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The lease duration for a Vault lease is specified in seconds, and the exhibit shows a lease duration of 3600 seconds. Converting 3600 seconds to hours gives exactly 1 hour (3600 / 3600 = 1). This represents the maximum total lifespan of the lease before it expires or must be renewed.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes