VA-003 Manage Vault leases Practice Test 2 — 15 Questions

Question 1

A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The OTP key is only valid for one-time use and cannot be renewed.. Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.

Answer

The renewable flag is set to false on the role.

Answer

The user's token does not have permission to renew leases.

Answer

The max_ttl of 30m is reached, but the OTP has already been used.

Question 2

An admin wants to view all active leases for a specific secrets engine path. Which two approaches are valid? (Choose two.)

Accepted Answer

vault list sys/leases/lookup/. `vault list sys/leases/lookup/` lists all active lease IDs for a given secrets engine mount path by querying the lease lookup endpoint. Option C is correct because `vault list sys/leases/prefix/` lists leases that share a common prefix, which effectively returns all active leases under that mount path when the mount path is used as the prefix. Both commands use the `list` operation against the sys/leases API to retrieve active lease IDs.

Answer

vault write sys/leases/list lease_id=<mount_path>

Answer

vault lease list -prefix <mount_path>

Answer

vault read sys/leases/list/<mount_path>

Question 3

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The actual TTL of a lease issued by a secrets engine is determined by the minimum of three values: the role's `default_ttl`, the role's `max_ttl`, and the system's `max_lease_ttl` configuration. The system's `max_lease_ttl` acts as a hard upper bound that cannot be exceeded by any lease, regardless of role settings. This ensures that even if a role has a longer `default_ttl`, the system-wide limit will cap the lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 4

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . `vault write sys/leases/revoke-prefix ` revokes all leases sharing a given prefix, which is the standard method for bulk revocation based on a policy violation path. Option E is correct because `vault lease revoke -prefix ` achieves the same result by revoking all leases under a specified mount path, effectively targeting the same scope. Both commands allow an admin to revoke multiple leases associated with a particular policy violation without needing individual lease IDs.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 5

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The lease duration for a Vault lease is specified in seconds, and the exhibit shows a lease duration of 3600 seconds. Converting 3600 seconds to hours gives exactly 1 hour (3600 / 3600 = 1). This represents the maximum total lifespan of the lease before it expires or must be renewed.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes

Question 6

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. In Vault, when a developer requests a credential from a role that is configured with the default lease TTL of 1 hour and the role has `explicit_max_ttl` set to 0 (or not set), the resulting lease will have a TTL of 1 hour. Additionally, if the role is configured with `renewable=false`, the lease cannot be renewed. Option C correctly reflects both the 1-hour TTL and non-renewable behavior.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 7

A large enterprise runs Vault in a production environment with multiple secrets engines, including databases, AWS, and PKI. Recently, the operations team noticed that the number of active leases has grown significantly, causing performance degradation in Vault. The team suspects that many leases are orphaned or expired but not cleaned up. They run the vault lease tidy command regularly, but the issue persists. The vault audit logs show no errors during revocation. However, the team observes that the database credentials are being revoked correctly, but the PKI certificates are not being revoked when their leases expire. Additionally, some AWS IAM user leases seem to persist beyond their max TTL. What is the most likely cause of this issue?

Accepted Answer

The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.. In Vault, lease expiration triggers revocation only for secrets engines that support automatic revocation at the Vault level. The PKI secrets engine does not automatically revoke issued certificates when a lease expires; it only removes the lease metadata. Similarly, AWS IAM user credentials are not automatically revoked upon lease expiration because the underlying secret (the IAM user or access key) must be explicitly revoked via the AWS API. The `vault lease tidy` command cleans up stale lease entries in Vault's storage but does not trigger revocation of the underlying secrets for these engines.

Answer

The max_ttl setting for the PKI and AWS roles is set incorrectly.

Answer

The vault lease tidy command is not effective for PKI and AWS secrets engines.

Answer

The Vault server's clock is out of sync, causing lease expiration calculations to be inaccurate.

Question 8

A development team is using Vault to dynamically generate PostgreSQL credentials for their application. They configured a database role with a max_lease_ttl of 24 hours. However, credentials are becoming invalid after only 1 hour, causing application errors. The team has verified that the credentials are not being explicitly revoked. Which action should the Vault administrator take to resolve this issue?

Accepted Answer

Update the database role's default_lease_ttl to 24 hours.. The issue is that the credentials are expiring after 1 hour, which is the default value for `default_lease_ttl` in Vault database roles. Even though the `max_lease_ttl` is set to 24 hours, the actual lease duration for each credential is determined by the `default_lease_ttl` unless it is explicitly configured. By setting `default_lease_ttl` to 24 hours, the administrator ensures that each generated credential has a lease duration matching the maximum allowed, preventing premature expiration.

Answer

Extend the TTL of the token used to generate credentials.

Answer

Increase the database engine's max_lease_ttl to 48 hours.

Answer

Instruct the team to renew the lease every 30 minutes.

Question 9

An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?

Accepted Answer

The token used to renew the lease has expired.. The error 'lease is not renewable or does not exist' typically occurs when the token used to authenticate the renewal request has expired. In Vault, KV v2 secrets engine reads do not produce renewable leases; the lease_id returned is actually from the token. If the application's token expires, it cannot renew any leases, even if the secret data is still accessible via a new read with a valid token. Options B and C would cause the secret path itself to change, but the secret data is still present, so they are unlikely. Option D is incorrect because KV v2 leases are not renewable, so they cannot expire in the scenario described.

Answer

The secret was deleted and recreated under the same path.

Answer

The KV v2 engine was disabled and re-enabled.

Answer

The lease expired during the maintenance window because the application did not renew it on time.

Question 10

A Vault operator runs the command shown in the exhibit and wants to renew the lease before it expires. The operator has a valid token. What must be true for the renewal to succeed?

Accepted Answer

The operator can renew the lease by running 'vault lease renew database/creds/my-role/abc123'.. The `vault lease renew` command with the specific lease ID (`database/creds/my-role/abc123`) is the standard way to extend a lease's TTL, provided the token has sufficient privileges and the lease is renewable. The operator has a valid token, so no prior revocation or role modification is required; the renewal will succeed as long as the token's policies allow it and the lease's remaining TTL is within the token's `explicit_max_ttl`.

Answer

The operator must first revoke the lease and re-issue it to obtain a longer TTL.

Answer

The token's 'explicit_max_ttl' must be at least as long as the lease's remaining TTL.

Answer

The 'max_ttl' parameter in the database role must be increased to allow renewal.

Question 11

A company runs a microservices architecture where each service authenticates to Vault using AppRole and is assigned a role with a periodic token. The operations team notices that some services experience authentication failures after exactly 24 hours of uptime, even though their tokens were initially issued with a TTL of 24 hours and 'renewable' set to true. The services are configured to renew their tokens automatically before expiry. Upon investigation, the Vault logs show the error: 'failed to renew token: token has exceeded its max TTL'. The Vault server is configured with a default 'max_lease_ttl' of 24 hours and a 'default_lease_ttl' of 1 hour at the system level. The AppRole role has no explicit TTL or max TTL set. What is the most likely cause of the failure?

Accepted Answer

The periodic token's max TTL is set by the system's 'max_lease_ttl' of 24 hours, and once that time is reached, renewal is no longer allowed.. The periodic token's max TTL is derived from the system's 'max_lease_ttl' of 24 hours when no explicit max TTL is set on the AppRole role. Even though the token is renewable and the services attempt to renew before expiry, the token cannot be renewed once its cumulative lifetime reaches the max TTL of 24 hours, causing the 'token has exceeded its max TTL' error. The periodic token's TTL is reset on each renewal, but the max TTL is a hard limit on the total lifespan of the token.

Answer

The token's lease duration is actually 1 hour (the default) and the services fail to renew before expiry.

Answer

The AppRole role has an implicit max TTL of 0, which prevents any renewal after the initial TTL.

Answer

The services are not renewing their tokens because the 'renewable' flag is ignored by periodic tokens.

Question 12

An operator has a Vault token with a TTL of 1h and a max_ttl of 4h. After 3 hours of continuous use, the operator runs `vault token renew` with no additional parameters. What happens to the token?

Accepted Answer

The token's TTL is reset to 1h, but the token will expire at the 4-hour mark regardless of further renewals.. A token renewal resets the TTL to the default_ttl, but the token cannot exceed its max_ttl. Since the token has already lived 3 of its 4 allowed hours, the renewal grants only 1 more hour, and the token expires at the 4-hour mark no matter how often it is renewed. This reflects Vault's absolute lifetime ceiling for tokens.

Answer

The token's TTL is reset to 4h because renewals always use the max_ttl value.

Answer

The renewal request fails immediately because the token has passed its halfway point.

Answer

The token's TTL is reset to 1h, and it can be renewed indefinitely as long as it is renewed before expiry.

Question 13

A security team needs to ensure that dynamic database credentials issued by Vault are automatically revoked when the associated application stops renewing them. Which two actions must the team take? (Choose two.)

Accepted Answer

Set a reasonable default_ttl on the database role so leases expire if not renewed.. Vault automatically revokes leases when they expire. To ensure credentials are revoked when an application stops renewing, the team must configure both a default_ttl (so leases expire if not renewed) and a max_ttl (so credentials cannot be renewed indefinitely). These TTL settings enforce automatic revocation without manual intervention or external tooling.

Answer

Enable the database secrets engine's automatic lease revocation feature.

Answer

Ensure the application renews the lease before its TTL expires to maintain access.

Answer

Manually revoke leases using a cron job that runs every hour.

Question 14

An operations engineer needs to inspect every lease currently issued by the database secrets engine mounted at database/ so they can audit which applications still hold credentials. Which Vault CLI command lists the active leases for that mount?

Accepted Answer

vault list sys/leases/lookup/database/creds. Lease enumeration in Vault is performed through the sys/leases/lookup endpoint, and the CLI exposes it via vault list. Because database credentials are issued under the database/creds prefix, listing sys/leases/lookup/database/creds returns the lease IDs for outstanding credentials. This is the supported way to audit active leases for a specific secrets engine mount.

Answer

vault list database/leases

Answer

vault lease list database/

Answer

vault read database/creds/readonly

Question 15

A security team wants to reduce the exposure window of dynamic cloud credentials issued by Vault. They are reviewing how lease TTLs and renewal interact for a role that issues AWS credentials. Which two statements correctly describe Vault lease behavior in this scenario? (Choose two.)

Accepted Answer

A lease issued with a TTL greater than the mount's max_lease_ttl is silently capped at the mount maximum.. Vault enforces the mount's max_lease_ttl as a hard ceiling both at issuance and at renewal. A requested TTL above the maximum is capped, and renewal preserves the lease ID while recalculating expiration against the cumulative limit. Understanding these two behaviors is essential for designing clients that respect returned lease durations and re-request credentials once renewal is no longer possible.

Answer

A client can request an unlimited lease TTL by passing an explicit ttl value larger than the mount maximum in the API request.

Answer

Leases from the AWS secrets engine never expire on their own and must always be revoked manually by an operator.

Answer

Revoking a lease immediately invalidates all other leases issued by the same role, regardless of their individual lease IDs.