VA-003 Manage Vault leases Practice Test 2 — 15 Questions

Question 1

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Accepted Answer

Vault is sealed. When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Answer

Upstream error

Answer

Permission denied

Answer

Lease not found

Question 2

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Accepted Answer

Use Vault agent with a template and renew capability.. Vault Agent's template and renew capability is the recommended approach because it automatically manages the lifecycle of dynamic secrets, including renewing leases before they expire. Vault Agent runs as a sidecar or daemon and uses its built-in renewer to periodically extend the lease TTL, ensuring the application always has a valid secret without manual intervention or external scheduling.

Answer

Set the lease TTL to infinite.

Answer

Use a cron job to call vault lease renew periodically.

Answer

Use periodic tokens with auto-renewal.

Question 3

Which of the following best describes a Vault lease?

Accepted Answer

A time-limited agreement that governs the lifecycle of a secret.. A Vault lease is a time-bound agreement that governs the lifecycle of a secret, including its validity period, renewal, and revocation. When a secret is read from Vault, it is returned with a lease ID and a lease duration (TTL), after which the secret is automatically revoked unless renewed. This ensures that secrets are not valid indefinitely, reducing the risk of exposure.

Answer

A permission to access a path.

Answer

A contract to use a secret for a certain duration.

Answer

The actual secret value.

Question 4

An operator runs vault lease list and sees many expired leases. Why are expired leases still listed?

Accepted Answer

Vault keeps expired leases for auditing until cleaned up by garbage collection.. Vault does not immediately remove expired leases; they are cleaned up by a periodic garbage collection process. Until then, they may appear in listing.

Answer

The leases are not actually expired.

Answer

The operator has a permission to see expired leases.

Answer

Expired leases are never removed.

Question 5

What happens when a lease reaches its TTL?

Accepted Answer

The lease is marked as expired and can no longer be renewed.. When a lease reaches its Time-To-Live (TTL), it becomes expired and cannot be renewed. Vault does not automatically delete the lease from storage at the moment of TTL expiry; rather, the lease is marked as expired and is eventually garbage-collected. This cleanup is separate from revocation of the underlying secret, which must be performed explicitly or via a different mechanism.

Answer

The lease is automatically renewed.

Answer

The secret is automatically revoked.

Answer

The lease is deleted from storage.

Question 6

A security policy requires that all leases must be revoked within 1 hour of creation. Which setting should be configured on the secret engine mount?

Accepted Answer

default_lease_ttl = 1h and max_lease_ttl = 1h. The security policy requires that all leases must be revoked within 1 hour of creation, meaning no lease can exceed 1 hour. The `default_lease_ttl` sets the initial TTL for leases when no specific TTL is provided, and the `max_lease_ttl` enforces an absolute upper limit that no lease can exceed. Configuring both to 1h ensures that every lease starts with a 1-hour TTL and cannot be renewed or extended beyond that hard cap, guaranteeing revocation within 1 hour.

Answer

default_lease_ttl = 1h

Answer

token_ttl = 1h

Answer

max_lease_ttl = 1h

Question 7

After a Vault migration, some leases are no longer valid and cause errors. What is the best way to force a cleanup of all leases under a specific mount without affecting other mounts?

Accepted Answer

Use vault lease revoke -prefix . The `vault lease revoke -prefix ` command is specifically designed to revoke all leases associated with a given mount path without affecting other mounts. This command iterates through all leases under that prefix and forces their revocation, cleaning up invalid leases efficiently. It is the targeted, non-disruptive approach for lease cleanup in Vault.

Answer

Restart Vault servers

Answer

Disable and re-enable the secret engine

Answer

Reduce the mount's max_lease_ttl to 0

Question 8

Which two commands can be used to manually revoke leases? (Choose two.)

Accepted Answer

vault lease revoke . The `vault lease revoke ` command is specifically designed to manually revoke a single lease by its unique identifier. This directly terminates the associated secret's validity and any derived tokens, aligning with the requirement to manually revoke leases in Vault.

Answer

vault secrets disable <path>

Answer

vault token revoke <token>

Answer

vault lease renew <lease_id>

Question 9

Which three statements about lease renewal are correct? (Choose three.)

Accepted Answer

Renewing a lease increments the lease number.. In Vault, each lease renewal increments the lease number (a monotonically increasing counter) to track the renewal history. This allows clients and Vault to detect replay attacks or stale renewals, as the lease ID remains the same but the lease number changes with each successful renew operation.

Answer

A lease can be renewed indefinitely.

Answer

Lease renewal requires 'sudo' capability.

Question 10

Which two of the following are valid lease operations? (Choose two.)

Accepted Answer

vault lease renew. `vault lease renew` is a valid Vault CLI command used to extend the lifetime of a lease before it expires. In HashiCorp Vault, leases are associated with dynamic secrets (e.g., database credentials, AWS IAM keys) and must be periodically renewed to maintain access. The `renew` operation is a core lease lifecycle operation supported by the Vault API and CLI.

Answer

vault lease create

Answer

vault lease delete

Answer

vault lease generate

Question 11

Refer to the exhibit. An operator wants the credential to be valid for exactly 2 hours. What should they do?

Accepted Answer

Increase the role's max_ttl to 2h.. To allow a 2-hour total lifetime, the role's max_ttl must be at least 2h. The current lease TTL is 30m but can be renewed up to the role's max_ttl. Simply renewing with 2h TTL will fail if max_ttl is lower. Increasing mount's max_lease_ttl does not change the role's maximum. Requesting a new credential does not have a direct TTL parameter.

Answer

Increase the mount's max_lease_ttl to 2h.

Answer

Renew the lease with a TTL of 2h.

Answer

Request a new credential with a TTL of 2h.

Question 12

Refer to the exhibit. A user with this policy can successfully read credentials but cannot renew the lease. What is the missing capability?

Accepted Answer

'update' on sys/leases/renew.. The user can read credentials but cannot renew the lease because the policy grants 'read' and 'list' capabilities on the secret path, but renewing a lease requires the 'update' capability on the 'sys/leases/renew' endpoint. This endpoint is used to extend the lifetime of a lease, and without 'update' access, the renewal request is denied.

Answer

'list' on sys/leases/.

Answer

'renew' on the secret path.

Answer

'sudo' on sys/leases/.

Question 13

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lease ID is incorrect.. The error message indicates that the lease ID provided for the renewal or revocation operation is invalid. In Vault, lease IDs are unique identifiers tied to a specific secret or token lease. If the lease ID is incorrect—due to a typo, truncation, or mismatch—Vault cannot locate the lease, resulting in this error. Option C correctly identifies this as the most likely cause.

Answer

The token lacks permission.

Answer

The secret engine was disabled.

Answer

The lease has expired.

Question 14

A DevOps team uses Vault to generate temporary database credentials. They notice that some applications are failing because their database credentials expire unexpectedly before the expected TTL. The Vault admin configured the database role with a default TTL of 1h and max TTL of 24h. What is the most likely cause?

Accepted Answer

The application is not renewing the lease, and the lease TTL is counted from the issue time.. Vault database credentials are issued as leases with a TTL that starts counting from the moment they are issued. If the application does not renew the lease, the credentials expire exactly after the default TTL (1 hour) has elapsed, regardless of the max TTL setting. The failure occurs because the application expects the credentials to last longer, but the lease TTL is not extended without renewal.

Answer

The database role's max TTL is being enforced, but the default TTL is shorter.

Answer

The Vault server's clock is skewed, causing early expiry.

Answer

The application is renewing the lease too frequently, causing Vault to reset the TTL.

Question 15

An admin wants to revoke all leases associated with a specific AWS IAM user created by Vault. Which command should they use?

Accepted Answer

vault lease revoke -prefix aws/creds/myrole. The `vault lease revoke -prefix` command revokes all leases that share a given prefix. Since AWS IAM user credentials generated by Vault under `aws/creds/myrole` have lease IDs that begin with that path, using the `-prefix` flag ensures all associated leases are revoked, regardless of their full lease ID.

Answer

vault lease revoke aws/creds/myrole/ -prefix

Answer

vault lease revoke aws/creds/myrole

Answer

vault lease revoke -path aws/creds/myrole