VA-003 Manage Vault leases Practice Test 4 — 15 Questions

Question 1

Which three statements about lease renewal are correct? (Choose three.)

Accepted Answer

Renewing a lease increments the lease number.. In Vault, each lease renewal increments the lease number (a monotonically increasing counter) to track the renewal history. This allows clients and Vault to detect replay attacks or stale renewals, as the lease ID remains the same but the lease number changes with each successful renew operation.

Answer

A lease can be renewed indefinitely.

Answer

Lease renewal requires 'sudo' capability.

Question 2

Which two of the following are valid lease operations? (Choose two.)

Accepted Answer

vault lease renew. `vault lease renew` is a valid Vault CLI command used to extend the lifetime of a lease before it expires. In HashiCorp Vault, leases are associated with dynamic secrets (e.g., database credentials, AWS IAM keys) and must be periodically renewed to maintain access. The `renew` operation is a core lease lifecycle operation supported by the Vault API and CLI.

Answer

vault lease create

Answer

vault lease delete

Answer

vault lease generate

Question 3

A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?

Accepted Answer

The renewable flag requires the role to be updated after existing leases are issued.. The `renewable=false` setting on a Vault role only affects newly issued leases; it does not retroactively apply to leases that were already issued before the role was updated. Since the security team configured the role after some users had already obtained credentials, those existing leases retain their original `renewable=true` property, allowing users to renew them despite the new role setting. Vault enforces the `renewable` flag at lease creation time, not dynamically during renewal requests.

Answer

The renewable flag is not respected when max_ttl equals default_ttl.

Answer

The renewable flag is only applicable to token auth methods, not secrets engines.

Answer

The lease's renewable property is controlled by the client token's renewable status.

Question 4

A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?

Accepted Answer

default_ttl=1h, max_ttl=4h, renewable=true. It sets the default TTL to 1 hour, the maximum TTL to 4 hours, and enables renewal (renewable=true). In Vault, dynamic secret leases can be renewed up to the max_ttl, so with this configuration the initial lease is 1 hour, and each renewal extends the lease until the total lifetime reaches 4 hours, after which no further renewals are allowed.

Answer

default_ttl=1h, max_ttl=4h, renewable=false

Answer

default_ttl=4h, max_ttl=1h, renewable=true

Answer

default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h

Question 5

A Vault operator accidentally revoked a token that was used to lease many database credentials. What happens to the leases associated with that token?

Accepted Answer

All leases are immediately revoked.. In Vault, tokens are the root of identity and authorization for all associated leases. When a token is revoked, Vault immediately revokes all leases created using that token, including database credential leases, because the token's lifecycle governs the leases it has created. This ensures that no credentials remain valid after the token is revoked, maintaining security.

Answer

The leases become orphaned and will never be revoked.

Answer

Vault automatically renews the leases with a new token.

Answer

The leases continue until their natural expiration.

Question 6

A Vault operator wants to manage lease durations for secrets issued by a PKI secrets engine. Which two actions can they take to affect the lease duration of certificates?

Accepted Answer

Configure the 'ttl' parameter in the PKI role definition.. Option C is correct because the PKI role definition accepts a 'ttl' parameter that sets the default lease duration for certificates issued under that role, overriding the mount's default when specified. Option E is correct because setting 'default_lease_ttl' on the PKI secrets engine mount establishes the baseline lease duration for certificates issued by that mount when the role does not specify its own TTL. Options A and B are incorrect because 'default_lease_ttl' and 'max_lease_ttl' on an auth method govern the lifetime of the auth method's own tokens, not the leases of certificates issued by a PKI secrets engine. Option D is incorrect because 'lease_duration' is not a valid parameter in a PKI role definition; the correct parameter is 'ttl' (along with 'max_ttl').

Answer

Set the 'default_lease_ttl' on the auth method used to log in.

Answer

Set the 'max_lease_ttl' on the auth method used to log in.

Answer

Set the 'lease_duration' parameter in the PKI role definition.

Question 7

A platform team runs a Vault cluster with a transit secrets engine mount at transit/. An application holds a token with a policy granting only "update" on transit/encrypt/orders and "read" on transit/keys/orders. The application's token has a TTL of 1h with a max_ttl of 4h, and it renews itself every 30 minutes using the token renewal endpoint. After roughly four hours of continuous operation, the application's API calls begin failing with a permission denied error even though the token was renewed successfully each time. Which Vault behavior explains this failure?

Accepted Answer

The token reached its max_ttl, so renewal requests stopped extending its lifetime and the token expired, invalidating all requests made with it.. Service tokens are bounded by both a renewable TTL and an absolute max_ttl. Each renewal extends the token's lifetime only until the max_ttl ceiling is reached; beyond that point Vault refuses to extend it, and the token expires. Expiration invalidates the token immediately, so subsequent API calls authenticated with it fail with permission denied, exactly as the application observes after about four hours.

Answer

The transit secrets engine automatically revoked the token when the application exceeded its allowed number of encrypt operations per hour.

Answer

The policy attached to the token expired at the same time as the token's initial TTL and had to be reattached before further API calls could succeed.

Answer

Renewing a token more than once silently converts it into a periodic token whose capabilities are stripped until it is re-authenticated.

Question 8

A platform engineer has issued dynamic AWS credentials through Vault's AWS secrets engine and wants to extend the usable lifetime of that credential before it expires. Which Vault CLI command allows the engineer to request additional time on the lease?

Accepted Answer

vault lease renew <lease_id>. Leases on dynamic secrets can be extended with vault lease renew, which asks the secrets engine to grant more time within the role's max_ttl boundary. Revoking destroys the credential, renewing a token affects authentication rather than the secret, and re-writing the creds path issues a separate credential instead of extending the current one.

Answer

vault token renew <token>

Answer

vault write aws/creds/my-role ttl=1h

Answer

vault lease revoke <lease_id>

Question 9

A security engineer is onboarding a new application team to Vault. The team needs to understand how Vault manages the lifecycle of secrets issued by the database secrets engine. The engineer explains that Vault attaches a lease to dynamic secrets and that the lease defines the secret's validity period. Which statement accurately describes the relationship between a lease and a dynamic secret?

Accepted Answer

A lease is metadata that records the secret's validity period, renewal eligibility, and revocation behavior, and it is created alongside the dynamic secret.. Vault issues dynamic secrets together with a lease that records the secret's time-to-live, whether it can be renewed, and how it should be revoked. This server-side metadata is what allows Vault to automatically revoke credentials when they are no longer valid, which is a core security benefit of using dynamic secrets over static credentials.

Answer

A lease is a static configuration setting on the secrets engine that applies the same TTL to every secret issued from that mount.

Answer

A lease is a client-side token stored by the application that must be presented to Vault before the secret can be used.

Answer

A lease is created only when an administrator manually enables lease tracking on a secrets engine mount.

Question 10

A security team must immediately invalidate every dynamic database credential issued under a specific role named app-readonly, across all database mounts, without knowing individual lease IDs. Which Vault command accomplishes this?

Accepted Answer

vault lease revoke -prefix database/creds/app-readonly. Revoking by prefix targets all leases under the role's creds path in one operation and triggers the secrets engine to remove the corresponding database accounts. Forcing deletion skips backend cleanup, token revocation is scoped to tokens rather than roles, and disabling the mount destroys configuration the team still needs.

Answer

vault secrets disable database

Answer

vault lease revoke -force database/creds/app-readonly

Answer

vault token revoke -accessor app-readonly

Question 11

A Vault admin needs to revoke all leases under the `database/creds/readonly` path without revoking leases from other paths. Which command should the admin use?

Accepted Answer

vault lease revoke -prefix database/creds/readonly. To revoke all leases under a specific secrets engine path, the admin must use `vault lease revoke -prefix <path>`. The `-prefix` flag tells Vault to revoke every lease whose ID begins with the given string, which effectively targets all leases generated by that path. Other flags either expect a full lease ID or revoke everything cluster-wide.

Answer

vault lease revoke -force database/creds/readonly

Answer

vault lease revoke database/creds/readonly

Answer

vault lease revoke -all database/creds/readonly

Question 12

A platform team runs a Vault cluster where many applications obtain dynamic AWS credentials from the aws secrets engine. During an incident, an operator needs to stop all credential usage tied to a compromised IAM role without disrupting other roles. The operator has a root token and wants to revoke every lease associated with that specific role. Which approach accomplishes this?

Accepted Answer

Run vault lease revoke -prefix aws/creds/ to revoke all leases under that role's path.. The vault lease revoke command with the -prefix flag revokes all leases whose IDs share a given path prefix. Because AWS dynamic credentials are issued under aws/creds/, using that prefix scopes the revocation to the compromised role only, achieving rapid containment without tearing down the secrets engine or affecting other roles.

Answer

Delete the AWS IAM role directly in AWS and wait for Vault leases to expire naturally.

Answer

Disable the aws secrets engine mount, which immediately revokes all leases issued by that mount.

Answer

Run vault token revoke -self to revoke the token that requested the credentials.

Question 13

An operator inspects a Vault policy and finds a rule granting read on database/creds/reporting. Applications using tokens bound to this policy can fetch credentials but receive permission denied when they attempt to extend them. Which capability must be added to the policy to allow lease renewal?

Accepted Answer

update on sys/leases/renew. Renewing a lease is an update to the sys/leases/renew endpoint, so the policy must grant update there. Reading lease metadata, using sudo on the generation path, or granting create instead of update all leave the renewal call unauthorized, which is exactly the failure the applications are hitting.

Answer

create on sys/leases/renew

Answer

sudo on database/creds/reporting

Answer

read on sys/leases/lookup

Question 14

A platform team runs Vault with a transit secrets engine mount at transit/. An application requests a new data encryption key with a 30-minute TTL, and the returned lease_id is recorded by the app. Twenty minutes later, the app calls the renew endpoint for that lease. The mount was configured with max_lease_ttl of 1h. What is the maximum TTL the lease can be extended to by this renewal?

Accepted Answer

The lease can be renewed up to 1 hour total from its original creation time, because the mount's max_lease_ttl caps the cumulative lease lifetime.. A renewable lease is bounded by the mount's max_lease_ttl, which acts as a cumulative ceiling measured from lease creation. Renewal can extend the lease's expiration toward that ceiling but never beyond it. With a 1-hour max and 20 minutes already elapsed, the lease can be renewed only to the 1-hour mark, after which it must be reissued.

Answer

The lease can be renewed indefinitely as long as the client keeps renewing before expiration, because transit keys have no maximum lifetime.

Answer

The lease can be renewed only up to the original 30-minute TTL, because transit leases cannot be extended beyond creation TTL.

Answer

The lease can be renewed to 30 minutes from the moment of the renewal call, giving it a total lifetime of 50 minutes.

Question 15

An operations team manages Vault leases for dynamic database credentials. They need to extend the life of an active lease without issuing a new credential, and they also want to confirm the lease's remaining time before doing so. Which two commands or operations should they use? (Choose two.)

Accepted Answer

vault lease lookup database/creds/app-role/abc123. To extend an active lease without issuing new credentials, use vault lease renew with the lease ID. To check how much time remains before renewal, use vault lease lookup, which reports the lease's expiration and TTL. Together these operations let the team confirm the remaining lifespan and then extend the existing lease in place.

Answer

vault lease revoke database/creds/app-role/abc123

Answer

vault write database/creds/app-role

Answer

vault token renew -accessor <accessor-id>