VA-003 Manage Vault leases Practice Question
Exhibit
Refer to the exhibit. ``` $ vault read database/creds/my-role Key Value --- ----- lease_id database/creds/my-role/abc123... lease_duration 1h lease_renewable true password ... username v-token-my-role-... $ vault lease renew database/creds/my-role/abc123... Key Value --- ----- lease_id database/creds/my-role/abc123... lease_duration 1h lease_renewable true ```
A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?
⚠ Common exam trap
HashiCorp often tests the distinction between role-level and mount-level TTL limits, trapping candidates who assume the mount's max_lease_ttl is the sole constraint when a lower role max_ttl is configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role's max_ttl is set to 1h.
The role's max_ttl overrides the lease duration when it is shorter than the requested TTL. Even if the lease is renewed, the effective TTL cannot exceed the role's max_ttl, which is set to 1 hour. This is a common Vault behavior where the role's maximum TTL acts as a hard cap on lease lifetimes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The lease is not renewable.
Why it's wrong here
The output shows lease_renewable: true.
- ✗
The mount's max_lease_ttl is set to 1h.
Why it's wrong here
This could also limit renewal, but the role's max_ttl is more likely.
- ✗
The developer does not have permission to renew the lease.
Why it's wrong here
The renewal command succeeded, so permission is not an issue.
- ✓
The role's max_ttl is set to 1h.
Why this is correct
The role max_ttl caps the lease duration.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.