VA-003 Manage Vault leases Practice Question
A company runs a microservices architecture where each service authenticates to Vault using AppRole and is assigned a role with a periodic token. The operations team notices that some services experience authentication failures after exactly 24 hours of uptime, even though their tokens were initially issued with a TTL of 24 hours and 'renewable' set to true. The services are configured to renew their tokens automatically before expiry. Upon investigation, the Vault logs show the error: 'failed to renew token: token has exceeded its max TTL'. The Vault server is configured with a default 'max_lease_ttl' of 24 hours and a 'default_lease_ttl' of 1 hour at the system level. The AppRole role has no explicit TTL or max TTL set. What is the most likely cause of the failure?
⚠ Common exam trap
A common pitfall when working with Vault periodic tokens is confusing the token TTL, which resets on each renewal, with the max TTL, which is a cumulative lifetime limit. Candidates may mistakenly think that automatic renewal prevents any expiry, but the max TTL is a hard limit that cannot be exceeded, even with renewal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The periodic token's max TTL is set by the system's 'max_lease_ttl' of 24 hours, and once that time is reached, renewal is no longer allowed.
The periodic token's max TTL is derived from the system's 'max_lease_ttl' of 24 hours when no explicit max TTL is set on the AppRole role. Even though the token is renewable and the services attempt to renew before expiry, the token cannot be renewed once its cumulative lifetime reaches the max TTL of 24 hours, causing the 'token has exceeded its max TTL' error. The periodic token's TTL is reset on each renewal, but the max TTL is a hard limit on the total lifespan of the token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The token's lease duration is actually 1 hour (the default) and the services fail to renew before expiry.
Why it's wrong here
Periodic tokens have no lease duration; they are valid until the max TTL. The 24-hour failure aligns with max TTL, not lease expiration.
- ✗
The AppRole role has an implicit max TTL of 0, which prevents any renewal after the initial TTL.
Why it's wrong here
A max TTL of 0 means no max, which would allow indefinite renewal. The failure indicates a finite max TTL.
- ✗
The services are not renewing their tokens because the 'renewable' flag is ignored by periodic tokens.
Why it's wrong here
Periodic tokens are always renewable; the 'renewable' flag is true and they attempt renewal.
- ✓
The periodic token's max TTL is set by the system's 'max_lease_ttl' of 24 hours, and once that time is reached, renewal is no longer allowed.
Why this is correct
Periodic tokens have a max TTL equal to the system's 'max_lease_ttl' unless overridden on the role. Here, 24 hours elapsed, hitting the limit.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.