VA-003 Manage Vault leases Practice Test 3 — 15 Questions

Question 1

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. Setting default_ttl=1h, max_ttl=4h, and renewable=true allows the lease to be renewed up to a total lifespan of 4 hours, with initial TTL of 1 hour. Option B is correct. Option A has renewable=false, preventing renewal. Option C has max_ttl less than default, which is invalid. Option D adds an unnecessary ttl parameter.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 2

An admin needs to check the remaining lifespan of a lease. Which command should they use?

Accepted Answer

vault lease lookup <lease_id>. The `vault lease lookup` command displays lease details including remaining TTL. Option D is correct. Option A reads from sys/leases/lookup but that path is for listing leases, not a single lease. Option B lists leases, not checks a specific lease. Option C with -increment=0 would attempt a renewal, not a lookup.

Answer

vault read sys/leases/lookup/<lease_id>

Answer

vault lease list <lease_id>

Answer

vault lease renew -increment=0 <lease_id>

Question 3

An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?

Accepted Answer

Vault's tidy operation is not configured to clean up stale leases.. Vault does not automatically revoke the actual database user when a lease expires; it relies on the tidy operation to clean up stale leases and revoke the underlying credentials. If tidy is not run or configured, expired leases can leave behind database users. Option B is correct. Option A: high max_ttl would lengthen lifespan but still eventually expire. Option C: rotation statement affects password changes, not revocation. Option D: network issues could cause revocation failures, but tidy would still help clean up.

Answer

The lease revocation process is failing due to network issues.

Answer

The database rotation statement is incorrect, causing Vault to not properly revoke credentials.

Answer

The role's max_ttl is set too high, allowing leases to live longer.

Question 4

A Vault operator accidentally revoked a token that was used to lease many database credentials. What happens to the leases associated with that token?

Accepted Answer

All leases are immediately revoked.. In Vault, tokens are the root of identity and authorization for all associated leases. When a token is revoked, Vault immediately revokes all leases created using that token, including database credential leases, because the token's lifecycle governs the leases it has created. This ensures that no credentials remain valid after the token is revoked, maintaining security.

Answer

The leases become orphaned and will never be revoked.

Answer

Vault automatically renews the leases with a new token.

Answer

The leases continue until their natural expiration.

Question 5

Which of the following commands would force a lease to expire immediately?

Accepted Answer

vault write sys/leases/revoke-lease lease_id=<lease_id>. Option D is correct because the endpoint `sys/leases/revoke-lease` immediately revokes the lease, forcing it to expire right away. This is the proper API path to force an immediate lease expiration, as opposed to a gradual or deferred revocation.

Answer

vault lease renew -increment=0 <lease_id>

Answer

vault lease revoke <lease_id>

Answer

vault lease expire <lease_id>

Question 6

A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?

Accepted Answer

The OTP key is only valid for one-time use and cannot be renewed.. Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.

Answer

The renewable flag is set to false on the role.

Answer

The user's token does not have permission to renew leases.

Answer

The max_ttl of 30m is reached, but the OTP has already been used.

Question 7

An admin wants to view all active leases for a specific secrets engine path. Which two approaches are valid? (Choose two.)

Accepted Answer

vault list sys/leases/lookup/. Both `vault list sys/leases/lookup/` and `vault list sys/leases/prefix/` are valid paths to list leases under a mount or prefix. Option C is not a real command. Option D uses an incorrect path. Option E is incorrect because you cannot write to list.

Answer

vault write sys/leases/list lease_id=<mount_path>

Answer

vault lease list -prefix <mount_path>

Answer

vault read sys/leases/list/<mount_path>

Question 8

Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)

Accepted Answer

The system's max_lease_ttl configuration. The lease's actual TTL is influenced by the role's default_ttl (initial TTL), the role's max_ttl (maximum allowed total TTL), and the system's max_lease_ttl configuration (global cap). The requesting token's TTL does not directly impact lease TTL. The rotation period is for password rotation, not lease duration.

Answer

The requesting token's TTL

Answer

The backend's rotation period

Question 9

An admin needs to revoke all leases associated with a particular policy violation. Which two methods can be used? (Choose two.)

Accepted Answer

vault write sys/leases/revoke-prefix . Both `vault lease revoke -prefix ` and `vault write sys/leases/revoke-prefix ` will revoke all leases with the given prefix, which can target the mount or role involved in the policy violation. Option A revokes a specific lease only. Option B revokes a token and its leases, but not specifically by policy prefix. Option E has an incorrect path.

Answer

vault sys/leases/revoke-force <prefix>

Answer

vault token revoke -mode=orphan <token>

Answer

vault lease revoke <lease_id>

Question 10

Based on the exhibit, what is the maximum total lifespan of this lease?

Accepted Answer

1 hour. The max_ttl field shows 1h, which is the maximum total time the lease can exist from its issue time, including all renewals. The current ttl of 30m is the remaining time if not renewed, but the lease can be renewed up to the max_ttl of 1 hour. Option B is correct.

Answer

2 hours

Answer

90 minutes

Answer

30 minutes

Question 11

A developer requests a credential from this role. Which statement about the resulting lease is true?

Accepted Answer

The lease will have a TTL of 1 hour and cannot be renewed.. The role has default_ttl=1h and renewable=false, so the lease will have an initial TTL of 1 hour and cannot be renewed. The max_ttl of 24h is irrelevant because renewal is disabled. Option C is correct.

Answer

The lease will have a TTL of 24 hours and can be renewed.

Answer

The lease will have a TTL of 1 hour and can be renewed.

Answer

The lease will have a TTL of 24 hours and cannot be renewed.

Question 12

A large enterprise runs Vault in a production environment with multiple secrets engines, including databases, AWS, and PKI. Recently, the operations team noticed that the number of active leases has grown significantly, causing performance degradation in Vault. The team suspects that many leases are orphaned or expired but not cleaned up. They run the vault lease tidy command regularly, but the issue persists. The vault audit logs show no errors during revocation. However, the team observes that the database credentials are being revoked correctly, but the PKI certificates are not being revoked when their leases expire. Additionally, some AWS IAM user leases seem to persist beyond their max TTL. What is the most likely cause of this issue?

Accepted Answer

The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.. For some secrets engines like PKI and AWS, lease expiration does not automatically revoke the underlying secret (certificate or IAM user). The revocation must be explicitly triggered by a revoke operation or by the backend's cleanup routines. The tidy operation only cleans up lease metadata, not the actual secrets. Therefore, even if leases expire, the certificates and IAM users remain. Option B correctly identifies this. Option A is false because tidy is effective for metadata but does not trigger revocation for all backends. Option C is possible but not the root cause if max_ttl is correctly set. Option D is unlikely given that database revocations work correctly.

Answer

The max_ttl setting for the PKI and AWS roles is set incorrectly.

Answer

The vault lease tidy command is not effective for PKI and AWS secrets engines.

Answer

The Vault server's clock is out of sync, causing lease expiration calculations to be inaccurate.

Question 13

A development team is using Vault to dynamically generate PostgreSQL credentials for their application. They configured a database role with a max_lease_ttl of 24 hours. However, credentials are becoming invalid after only 1 hour, causing application errors. The team has verified that the credentials are not being explicitly revoked. Which action should the Vault administrator take to resolve this issue?

Accepted Answer

Update the database role's default_lease_ttl to 24 hours.. The issue is that the default_lease_ttl on the database role is set to 1 hour, which causes credentials to expire before the max_lease_ttl. Adjusting the default_lease_ttl to match the desired lease duration allows credentials to last longer, up to the max_lease_ttl. Option A is correct because it directly addresses the discrepancy between the default and maximum TTLs. Option B is wrong because the max_lease_ttl is already 24 hours and not the cause. Option C is wrong because renewing does not change the underlying TTL configuration. Option D is wrong because the token TTL does not affect the credential lease TTL.

Answer

Extend the TTL of the token used to generate credentials.

Answer

Increase the database engine's max_lease_ttl to 48 hours.

Answer

Instruct the team to renew the lease every 30 minutes.

Question 14

An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?

Accepted Answer

The lease expired during the maintenance window because the application did not renew it on time.. KV v2 secrets engine supports lease renewal for static secrets, but if the lease expires (the renewal interval was missed), the lease becomes invalid and cannot be renewed. The application must perform a fresh read to obtain a new lease. Option C correctly identifies that the lease has already expired. Option A is plausible but lease expiration is more common than token expiry in this context. Option B would cause read failures, not just renewal failures. Option D would affect reads altogether, which is not happening.

Answer

The token used to renew the lease has expired.

Answer

The secret was deleted and recreated under the same path.

Answer

The KV v2 engine was disabled and re-enabled.

Question 15

A Vault operator wants to manage lease durations for secrets issued by a PKI secrets engine. Which two actions can they take to affect the lease duration of certificates?

Accepted Answer

Configure the 'ttl' parameter in the PKI role definition.. Options B and D are correct. Setting the default lease TTL on the mount and configuring the 'ttl' parameter in the role both directly impact certificate lease durations. Option A is incorrect because the 'max_lease_ttl' on the auth method does not affect secrets engine leases. Option C is incorrect because 'default_lease_ttl' on the auth method also does not affect secrets engine leases. Option E is incorrect because the 'lease_duration' parameter is not a valid parameter for PKI roles.

Answer

Set the 'default_lease_ttl' on the auth method used to log in.

Answer

Set the 'max_lease_ttl' on the auth method used to log in.

Answer

Set the 'lease_duration' parameter in the PKI role definition.