VA-003 Manage Vault leases — Timed 10 Questions

Question 1

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Accepted Answer

The role's max_ttl is set to 1h.. The role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.

Answer

The lease is not renewable.

Answer

The mount's max_lease_ttl is set to 1h.

Answer

The developer does not have permission to renew the lease.

Question 2

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour.
B. Increase the token TTL for the Kubernetes auth role to 1 hour.
C. Implement a renewal loop in each service to renew tokens every 10 minutes.
D. Use periodic tokens with a period of 1 hour for all services.

Accepted Answer

Increase the token TTL for the Kubernetes auth role to 1 hour.. Increasing the token TTL for the Kubernetes auth role to 1 hour directly addresses the root cause: the current 15-minute TTL is too short for long-running tasks, causing tokens to expire before services can complete their work. By raising the TTL to 1 hour, services have sufficient time to complete tasks and renew tokens, while still maintaining security through short-lived credentials. This approach does not require code changes and leverages Vault's built-in token lifecycle management.

Answer

Increase the default lease TTL for the KV v2 mount to 1 hour.

Answer

Implement a renewal loop in each service to renew tokens every 10 minutes.

Answer

Use periodic tokens with a period of 1 hour for all services.

Question 3

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Accepted Answer

Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.. Increasing the default lease TTL to 8 hours reduces the frequency of lease renewals, directly addressing the performance issue. Configuring periodic tokens with a short TTL ensures that the token itself still rotates frequently, maintaining security by limiting the window of exposure if a token is compromised. This balances reduced renewal overhead with strong security posture.

Answer

Remove the TTL entirely so that credentials never expire.

Answer

Decrease the default lease TTL from 1 hour to 30 minutes.

Answer

Increase the maximum TTL for the role to 24 hours.

Question 4

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Accepted Answer

Call the sys/leases/renew endpoint to renew a lease.. Option A is correct because Vault exposes the sys/leases/renew endpoint, which renews a lease for a dynamic secret by extending its validity using the lease_id and an optional increment, provided the lease is renewable. Option C is correct because the sys/leases/revoke endpoint revokes a lease immediately by lease_id, invalidating the dynamic secret and removing it from the lease store. The other options are not valid: sys/leases/list is not a real endpoint for disabling leases (listing is done via sys/leases/lookup or the leases list API), sys/leases/extend does not exist (renewal is handled by sys/leases/renew), and sys/leases/rotate is not a lease-management endpoint (rotation applies to encryption keys or root credentials, not individual leases).

Answer

Call the sys/leases/list endpoint to disable a lease.

Answer

Call the sys/leases/extend endpoint to increase the lease duration.

Answer

Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.

Question 5

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Accepted Answer

Modify the application to renew the lease before it expires using the lease ID.. Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.

Answer

Revoke the lease and request a new credential with a longer TTL.

Answer

Increase the TTL of the database role to 2 hours.

Question 6

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Accepted Answer

Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.. Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.

Answer

Set the default lease TTL on the database mount to 1 hour.

Answer

Increase the system's default lease TTL to 48 hours to give applications more flexibility.

Answer

Manually revoke leases after each application finishes using them.

Question 7

A security policy requires that all leases must be revoked within 1 hour of creation. Which setting should be configured on the secret engine mount?

Accepted Answer

default_lease_ttl = 1h and max_lease_ttl = 1h. The security policy requires that all leases must be revoked within 1 hour of creation, meaning no lease can exceed 1 hour. The `default_lease_ttl` sets the initial TTL for leases when no specific TTL is provided, and the `max_lease_ttl` enforces an absolute upper limit that no lease can exceed. Configuring both to 1h ensures that every lease starts with a 1-hour TTL and cannot be renewed or extended beyond that hard cap, guaranteeing revocation within 1 hour.

Answer

default_lease_ttl = 1h

Answer

token_ttl = 1h

Answer

max_lease_ttl = 1h

Question 8

Refer to the exhibit. An operator wants the credential to be valid for exactly 2 hours. What should they do?

Accepted Answer

Increase the role's max_ttl to 2h.. In HashiCorp Vault, the maximum TTL for a credential issued by a role is capped by the role's max_ttl parameter. To allow credentials to be valid for exactly 2 hours, the role's max_ttl must be set to at least 2h. The mount's max_lease_ttl sets the absolute upper limit for all leases from that mount, but the role's max_ttl is the specific setting that controls the maximum TTL for credentials generated by that role.

Answer

Increase the mount's max_lease_ttl to 2h.

Answer

Renew the lease with a TTL of 2h.

Answer

Request a new credential with a TTL of 2h.

Question 9

Refer to the exhibit. A user with this policy can successfully read credentials but cannot renew the lease. What is the missing capability?

Accepted Answer

'update' on sys/leases/renew.. The user can read credentials but cannot renew the lease because the policy grants 'read' and 'list' capabilities on the secret path, but renewing a lease requires the 'update' capability on the 'sys/leases/renew' endpoint. This endpoint is used to extend the lifetime of a lease, and without 'update' access, the renewal request is denied.

Answer

'list' on sys/leases/.

Answer

'renew' on the secret path.

Answer

'sudo' on sys/leases/.

Question 10

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lease ID is incorrect.. The error message indicates that the lease ID provided for the renewal or revocation operation is invalid. In Vault, lease IDs are unique identifiers tied to a specific secret or token lease. If the lease ID is incorrect—due to a typo, truncation, or mismatch—Vault cannot locate the lease, resulting in this error. Option C correctly identifies this as the most likely cause.

Answer

The token lacks permission.

Answer

The secret engine was disabled.

Answer

The lease has expired.