VA-003 Manage Vault leases Practice Question
A development team is using Vault to dynamically generate PostgreSQL credentials for their application. They configured a database role with a max_lease_ttl of 24 hours. However, credentials are becoming invalid after only 1 hour, causing application errors. The team has verified that the credentials are not being explicitly revoked. Which action should the Vault administrator take to resolve this issue?
⚠ Common exam trap
A common mix-up: candidates assume setting `max_lease_ttl` alone controls the credential lifetime, but the actual lease duration is governed by `default_lease_ttl` unless explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the database role's default_lease_ttl to 24 hours.
The issue is that the credentials are expiring after 1 hour, which is the default value for `default_lease_ttl` in Vault database roles. Even though the `max_lease_ttl` is set to 24 hours, the actual lease duration for each credential is determined by the `default_lease_ttl` unless it is explicitly configured. By setting `default_lease_ttl` to 24 hours, the administrator ensures that each generated credential has a lease duration matching the maximum allowed, preventing premature expiration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Extend the TTL of the token used to generate credentials.
Why it's wrong here
The token TTL is independent of the credential lease TTL; it does not affect how long the credential is valid.
- ✓
Update the database role's default_lease_ttl to 24 hours.
Why this is correct
The default_lease_ttl controls the initial lease duration; increasing it to match the max prevents early expiration.
- ✗
Increase the database engine's max_lease_ttl to 48 hours.
Why it's wrong here
The max_lease_ttl is already 24 hours; increasing it does not address why credentials expire in 1 hour.
- ✗
Instruct the team to renew the lease every 30 minutes.
Why it's wrong here
Renewing does not fix the root cause; the default TTL still limits the initial lease and renewals may not be allowed if the token lacks capability.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.