VA-003 Compare and configure secrets engines Practice Question
A company uses Vault to manage database credentials for a production PostgreSQL cluster. The application team reports that dynamic credentials generated from the database secrets engine are being revoked before the application has finished using them. The Vault lease TTL is set to 1 hour, but the application workload sometimes runs for up to 2 hours. What is the MOST efficient way to ensure credentials remain valid for the full workload duration?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the default_lease_ttl on the database secrets engine mount to 2 hours.
Increasing the default_lease_ttl on the database secrets engine mount ensures that all credentials generated by that engine have a TTL of 2 hours, matching the maximum workload duration without requiring application changes. Option A is wrong because setting max_ttl on the role alone does not change the default TTL; the application would still need to request a longer TTL when generating credentials. Option B is wrong because changing the server's default_lease_ttl affects all secrets in Vault, not just database credentials, which could reduce security unnecessarily. Option D is wrong because manually renewing leases adds complexity and overhead; it's more efficient to adjust the lease TTL at the engine level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set max_ttl to 2 hours on the database role.
Why it's wrong here
max_ttl only sets an upper bound; the default TTL remains 1 hour unless the application explicitly requests a longer TTL.
- ✗
Set the Vault server's default_lease_ttl to 2 hours in the server configuration.
Why it's wrong here
This changes the global default for all secrets, which could weaken security for other secrets and is not targeted.
- ✓
Increase the default_lease_ttl on the database secrets engine mount to 2 hours.
Why this is correct
This raises the default TTL for all credentials created by this engine, matching the workload's maximum duration without code changes.
- ✗
Have the application manually renew the lease every 30 minutes.
Why it's wrong here
Manual renewal is operationally complex and risks interruption if renewal fails; it is less efficient than adjusting the TTL.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.