VA-003 Manage Vault leases Practice Question
A company uses Vault to manage SSH OTP credentials. They set the role with default_ttl=5m and max_ttl=30m. Users report that they receive an error when trying to renew the OTP after 10 minutes. What is the most likely reason?
⚠ Common exam trap
HashiCorp often tests the misconception that lease renewal is always possible as long as the TTL has not expired, but for one-time credentials like SSH OTP, the lease becomes non-renewable immediately after the credential is used.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The OTP key is only valid for one-time use and cannot be renewed.
Vault SSH OTP credentials are designed for one-time use: the OTP is generated, used to authenticate an SSH session, and then immediately invalidated. Once the OTP has been used, it cannot be renewed because the lease is tied to a credential that has already been consumed. The error after 10 minutes occurs because the OTP was used within that window, making renewal impossible regardless of TTL settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The OTP key is only valid for one-time use and cannot be renewed.
Why this is correct
SSH OTPs are consumed on use and cannot be renewed.
- ✗
The renewable flag is set to false on the role.
Why it's wrong here
Even if renewable were false, the error would occur from the start, not after 10 minutes.
- ✗
The user's token does not have permission to renew leases.
Why it's wrong here
Permission issues would affect all renewal attempts, not just OTP.
- ✗
The max_ttl of 30m is reached, but the OTP has already been used.
Why it's wrong here
10 minutes is less than 30m, and OTPs are invalidated after use regardless of TTL.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.