VA-003 Manage Vault leases Practice Question
A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?
⚠ Common exam trap
Candidates often confuse the mount-level default lease TTL with the role-level TTL, assuming that changing the mount default is sufficient, when in fact the role-level TTL and explicit max TTL are required to enforce a strict upper bound on credential lifetime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.
Configuring the database role with a TTL of 1 hour and an explicit max TTL of 2 hours allows the application to request a 1-hour lease while ensuring that the lease cannot exceed 2 hours, even if the application fails to renew or release it. This minimizes the exposure window by capping the lease duration, and the Vault administrator can rely on automatic lease revocation at TTL expiry rather than manual intervention. The database engine's default lease TTL of 24 hours is overridden by the role-level TTL, which is the proper way to enforce shorter-lived credentials for specific applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the default lease TTL on the database mount to 1 hour.
Why it's wrong here
The default lease TTL applies to all secrets without a specific role TTL; but the role TTL overrides the default. Also, the default lease TTL is already 24h, but changing it to 1h would affect other roles that might need longer leases.
- ✓
Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.
Why this is correct
This ensures each lease expires after 1 hour, and the explicit max TTL prevents any renewal beyond 2 hours, minimizing exposure.
- ✗
Increase the system's default lease TTL to 48 hours to give applications more flexibility.
Why it's wrong here
This would lengthen the lease duration, increasing the exposure window, which is the opposite of the goal.
- ✗
Manually revoke leases after each application finishes using them.
Why it's wrong here
Manual revocation is not scalable and prone to human error; automated TTL-based expiry is preferred.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.