VA-003 Manage Vault leases Practice Question
A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?
⚠ Common exam trap
The trap is that candidates might think only one explicit renewal method is correct, but both modifying the application to use the lease ID and calling sys/leases/renew periodically are valid, as long as the renewal happens before the lease expires.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the application to renew the lease before it expires using the lease ID.
Both options B and C describe valid approaches to renewing the Vault lease. Option B correctly states that the application must modify its code to renew the lease before it expires using the lease ID. Option C is also correct because calling `sys/leases/renew` periodically with the lease ID achieves the same goal; the phrase 'periodically' is acceptable as long as the renewal happens before the lease expires. Options A and D are incorrect because increasing the TTL does not address the application's failure to renew the lease, and simply revoking and requesting a new credential without renewal will lead to the same issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Revoke the lease and request a new credential with a longer TTL.
Why it's wrong here
Incorrect. Revoking the lease and requesting a new credential with a longer TTL does not solve the root cause; the application must renew the lease to maintain the credential for its full duration.
- ✓
Modify the application to renew the lease before it expires using the lease ID.
Why this is correct
Correct. The application must actively renew the lease using its lease ID before the lease expires to avoid authentication errors.
- ✓
Use the lease ID from the response to call sys/leases/renew periodically.
Why this is correct
Correct. Calling `sys/leases/renew` periodically with the lease ID is a valid method to renew the lease, provided the renewal occurs before the TTL expires.
- ✗
Increase the TTL of the database role to 2 hours.
Why it's wrong here
Incorrect. Increasing the role's TTL only extends the maximum lease duration; it does not eliminate the need for the client to renew the lease.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.