VA-003 Manage Vault leases Practice Test 3 — 15 Questions

Question 1

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. The `renewable=false` setting on a Vault role only affects newly issued leases; it does not retroactively apply to leases that were already issued before the role was updated. Since the security team configured the role after some users had already obtained credentials, those existing leases retain their original `renewable=true` property, allowing users to renew them despite the new role setting. Vault enforces the `renewable` flag at lease creation time, not dynamically during renewal requests.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 2

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. It sets the default TTL to 1 hour, the maximum TTL to 4 hours, and enables renewal (renewable=true). In Vault, dynamic secret leases can be renewed up to the max_ttl, so with this configuration the initial lease is 1 hour, and each renewal extends the lease until the total lifetime reaches 4 hours, after which no further renewals are allowed.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 3

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command is the correct way to inspect the remaining lifespan and metadata of a specific lease in Vault. It returns details such as the lease ID, issue time, expiration time, and TTL, allowing the admin to determine how much time remains before the lease expires.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 4

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault's database secrets engine does not automatically clean up stale user accounts in the target database. The `tidy` operation must be explicitly configured and run to remove users whose leases have expired or been revoked. Without it, even if Vault correctly revokes the lease, the database user may remain, leading to an accumulation of stale accounts.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 5

A Vault operator accidentally revoked a token that was used to lease many database credentials. What happens to the leases associated with that token?

Accepted Answer

All leases are immediately revoked.. In Vault, tokens are the root of identity and authorization for all associated leases. When a token is revoked, Vault immediately revokes all leases created using that token, including database credential leases, because the token's lifecycle governs the leases it has created. This ensures that no credentials remain valid after the token is revoked, maintaining security.

Answer

The leases become orphaned and will never be revoked.

Answer

Vault automatically renews the leases with a new token.

Answer

The leases continue until their natural expiration.

Question 6

A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?

Accepted Answer

The OTP key is only valid for one-time use and cannot be renewed.. Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.

Answer

The renewable flag is set to false on the role.

Answer

The user's token does not have permission to renew leases.

Answer

The max_ttl of 30m is reached, but the OTP has already been used.

Question 7

An admin wants to view all active leases for a specific secrets engine path. Which two approaches are valid? (Choose two.)

Accepted Answer

vault list sys/leases/lookup/. `vault list sys/leases/lookup/` lists all active lease IDs for a given secrets engine mount path by querying the lease lookup endpoint. Option C is correct because `vault list sys/leases/prefix/` lists leases that share a common prefix, which effectively returns all active leases under that mount path when the mount path is used as the prefix. Both commands use the `list` operation against the sys/leases API to retrieve active lease IDs.

Answer

vault write sys/leases/list lease_id=<mount_path>

Answer

vault lease list -prefix <mount_path>

Answer

vault read sys/leases/list/<mount_path>

Question 8

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The actual TTL of a lease issued by a secrets engine is determined by the minimum of three values: the role's `default_ttl`, the role's `max_ttl`, and the system's `max_lease_ttl` configuration. The system's `max_lease_ttl` acts as a hard upper bound that cannot be exceeded by any lease, regardless of role settings. This ensures that even if a role has a longer `default_ttl`, the system-wide limit will cap the lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 9

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . `vault write sys/leases/revoke-prefix ` revokes all leases sharing a given prefix, which is the standard method for bulk revocation based on a policy violation path. Option E is correct because `vault lease revoke -prefix ` achieves the same result by revoking all leases under a specified mount path, effectively targeting the same scope. Both commands allow an admin to revoke multiple leases associated with a particular policy violation without needing individual lease IDs.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 10

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The lease duration for a Vault lease is specified in seconds, and the exhibit shows a lease duration of 3600 seconds. Converting 3600 seconds to hours gives exactly 1 hour (3600 / 3600 = 1). This represents the maximum total lifespan of the lease before it expires or must be renewed.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes

Question 11

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. In Vault, when a developer requests a credential from a role that is configured with the default lease TTL of 1 hour and the role has `explicit_max_ttl` set to 0 (or not set), the resulting lease will have a TTL of 1 hour. Additionally, if the role is configured with `renewable=false`, the lease cannot be renewed. Option C correctly reflects both the 1-hour TTL and non-renewable behavior.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 12

A large enterprise runs Vault in a production environment with multiple secrets engines, including databases, AWS, and PKI. Recently, the operations team noticed that the number of active leases has grown significantly, causing performance degradation in Vault. The team suspects that many leases are orphaned or expired but not cleaned up. They run the vault lease tidy command regularly, but the issue persists. The vault audit logs show no errors during revocation. However, the team observes that the database credentials are being revoked correctly, but the PKI certificates are not being revoked when their leases expire. Additionally, some AWS IAM user leases seem to persist beyond their max TTL. What is the most likely cause of this issue?

Accepted Answer

The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.. In Vault, lease expiration triggers revocation only for secrets engines that support automatic revocation at the Vault level. The PKI secrets engine does not automatically revoke issued certificates when a lease expires; it only removes the lease metadata. Similarly, AWS IAM user credentials are not automatically revoked upon lease expiration because the underlying secret (the IAM user or access key) must be explicitly revoked via the AWS API. The `vault lease tidy` command cleans up stale lease entries in Vault's storage but does not trigger revocation of the underlying secrets for these engines.

Answer

The max_ttl setting for the PKI and AWS roles is set incorrectly.

Answer

The vault lease tidy command is not effective for PKI and AWS secrets engines.

Answer

The Vault server's clock is out of sync, causing lease expiration calculations to be inaccurate.

Question 13

A development team is using Vault to dynamically generate PostgreSQL credentials for their application. They configured a database role with a max_lease_ttl of 24 hours. However, credentials are becoming invalid after only 1 hour, causing application errors. The team has verified that the credentials are not being explicitly revoked. Which action should the Vault administrator take to resolve this issue?

Accepted Answer

Update the database role's default_lease_ttl to 24 hours.. The issue is that the credentials are expiring after 1 hour, which is the default value for `default_lease_ttl` in Vault database roles. Even though the `max_lease_ttl` is set to 24 hours, the actual lease duration for each credential is determined by the `default_lease_ttl` unless it is explicitly configured. By setting `default_lease_ttl` to 24 hours, the administrator ensures that each generated credential has a lease duration matching the maximum allowed, preventing premature expiration.

Answer

Extend the TTL of the token used to generate credentials.

Answer

Increase the database engine's max_lease_ttl to 48 hours.

Answer

Instruct the team to renew the lease every 30 minutes.

Question 14

An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?

Accepted Answer

The token used to renew the lease has expired.. The error 'lease is not renewable or does not exist' typically occurs when the token used to authenticate the renewal request has expired. In Vault, KV v2 secrets engine reads do not produce renewable leases; the lease_id returned is actually from the token. If the application's token expires, it cannot renew any leases, even if the secret data is still accessible via a new read with a valid token. Options B and C would cause the secret path itself to change, but the secret data is still present, so they are unlikely. Option D is incorrect because KV v2 leases are not renewable, so they cannot expire in the scenario described.

Answer

The secret was deleted and recreated under the same path.

Answer

The KV v2 engine was disabled and re-enabled.

Answer

The lease expired during the maintenance window because the application did not renew it on time.

Question 15

A Vault operator wants to manage lease durations for secrets issued by a PKI secrets engine. Which two actions can they take to affect the lease duration of certificates?

Accepted Answer

Configure the 'ttl' parameter in the PKI role definition.. The 'ttl' parameter in a PKI role definition directly controls the lease duration (time-to-live) for certificates issued by that role. This is the primary mechanism for setting how long a certificate is valid, overriding the mount-level default if specified.

Answer

Set the 'default_lease_ttl' on the auth method used to log in.

Answer

Set the 'max_lease_ttl' on the auth method used to log in.

Answer

Set the 'lease_duration' parameter in the PKI role definition.