Question 265 of 514

Compare and configure secrets engines →hardMultiple SelectObjective-mapped

Quick Answer

The correct answer requires setting the role's `credential_type` to `iam_user` and including the `delete` operation in `policy_arns` or a custom inline policy. This works because when Vault generates an IAM user with dynamic credentials, it must be explicitly told both to create a real IAM user (via `iam_user`) and to have permission to remove that user when the lease expires—the `delete` action in the attached policy grants Vault the necessary AWS IAM permissions for automatic cleanup. On the HashiCorp Vault Associate VA-003 exam, this question tests your understanding of the AWS secrets engine lifecycle management, specifically how lease expiration triggers resource deletion. A common trap is confusing `credential_type` settings like `sts` or `assumed_role`, which do not create deletable IAM users, or forgetting that Vault needs explicit delete permissions in the policy. Memory tip: think “IAM user + delete policy = auto-cleanup”; without both, the user lingers forever.

VA-003 Compare and configure secrets engines Practice Question

This VA-003 practice question tests your understanding of compare and configure secrets engines. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A DevOps team is configuring the AWS secrets engine to generate IAM users with dynamic credentials. They want to ensure that each Vault-generated IAM user is automatically deleted when its lease expires. Which TWO configuration steps are required to achieve this? (Choose two.)

Question 1hardmulti select

Full question →

A
Set the role's 'initial_lease_status' to 'expired' to trigger immediate deletion.
Why wrong: 'initial_lease_status' is not a valid parameter for the AWS secrets engine.
B
Set the role's 'rotate' parameter to 'true' to rotate credentials on lease renewal.
Why wrong: Rotation changes the secret, it does not delete the IAM user.
C
Set the mount's 'default_lease_ttl' to a finite duration.
Why wrong: The mount's default TTL is used if the role does not specify a TTL, but the role-level TTL is required for this scenario.
D
Set the role's 'ttl' parameter to a finite duration.
A finite TTL ensures the lease will expire, triggering cleanup.
E
Set the role's 'credential_type' to 'iam_user' and include the 'delete' operation in 'policy_arns' or use a custom inline policy allowing deletion.
The role must be configured to delete the IAM user when the lease expires; this is typically done via the 'policy_arns' or 'policy_document' with delete permissions.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Set the role's 'ttl' parameter to a finite duration.

Option D is correct because setting the role's 'ttl' parameter to a finite duration ensures that the Vault-generated IAM user credentials expire after that time, triggering the lease expiration process. Option E is correct because setting 'credential_type' to 'iam_user' tells Vault to create an IAM user, and including the 'delete' operation in 'policy_arns' (or using a custom inline policy) grants Vault the permission to delete that IAM user when the lease expires, enabling automatic cleanup.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Set the role's 'initial_lease_status' to 'expired' to trigger immediate deletion.
Why it's wrong here
'initial_lease_status' is not a valid parameter for the AWS secrets engine.
✗
Set the role's 'rotate' parameter to 'true' to rotate credentials on lease renewal.
Why it's wrong here
Rotation changes the secret, it does not delete the IAM user.
✗
Set the mount's 'default_lease_ttl' to a finite duration.
Why it's wrong here
The mount's default TTL is used if the role does not specify a TTL, but the role-level TTL is required for this scenario.
✓
Set the role's 'ttl' parameter to a finite duration.
Why this is correct
A finite TTL ensures the lease will expire, triggering cleanup.
Related concept
Read the scenario before looking for a memorised answer.
✓
Set the role's 'credential_type' to 'iam_user' and include the 'delete' operation in 'policy_arns' or use a custom inline policy allowing deletion.
Why this is correct
The role must be configured to delete the IAM user when the lease expires; this is typically done via the 'policy_arns' or 'policy_document' with delete permissions.
Related concept
Read the scenario before looking for a memorised answer.

Common exam traps

Common exam trap: answer the scenario, not the keyword

HashiCorp often tests the distinction between mount-level and role-level TTL settings, and candidates mistakenly think the mount's 'default_lease_ttl' alone controls the IAM user's deletion, ignoring that the role-level 'ttl' is what actually governs the lease for dynamic credentials.

Trap categories for this question

Scenario analysis trap
The mount's default TTL is used if the role does not specify a TTL, but the role-level TTL is required for this scenario.

Detailed technical explanation

How to think about this question

Under the hood, Vault's AWS secrets engine uses the IAM API to create a user with programmatic access keys, and the lease TTL is tied to the user's lifecycle. When the lease expires, Vault calls the IAM DeleteUser API (if the policy allows) to remove the user and its associated resources. In real-world scenarios, failing to set both the role 'ttl' and the delete permission can lead to orphaned IAM users accumulating, causing security risks and AWS resource limits.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the VA-003 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related VA-003 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Compare authentication methods practice questions

Practise VA-003 questions linked to Compare authentication methods.

Assess Vault tokens practice questions

Practise VA-003 questions linked to Assess Vault tokens.

Create Vault policies practice questions

Practise VA-003 questions linked to Create Vault policies.

Manage Vault leases practice questions

Practise VA-003 questions linked to Manage Vault leases.

Compare and configure secrets engines practice questions

Practise VA-003 questions linked to Compare and configure secrets engines.

Utilize Vault CLI and API practice questions

Practise VA-003 questions linked to Utilize Vault CLI and API.

Explain Vault architecture practice questions

Practise VA-003 questions linked to Explain Vault architecture.

Explain encryption as a service practice questions

Practise VA-003 questions linked to Explain encryption as a service.

VA-003 fundamentals practice questions

Practise VA-003 questions linked to VA-003 fundamentals.

VA-003 scenario practice questions

Practise VA-003 questions linked to VA-003 scenario.

VA-003 troubleshooting practice questions

Practise VA-003 questions linked to VA-003 troubleshooting.

Practice this exam

Start a free VA-003 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

VA-003 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this VA-003 question test?

Compare and configure secrets engines — This question tests Compare and configure secrets engines — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Set the role's 'ttl' parameter to a finite duration. — Option D is correct because setting the role's 'ttl' parameter to a finite duration ensures that the Vault-generated IAM user credentials expire after that time, triggering the lease expiration process. Option E is correct because setting 'credential_type' to 'iam_user' tells Vault to create an IAM user, and including the 'delete' operation in 'policy_arns' (or using a custom inline policy) grants Vault the permission to delete that IAM user when the lease expires, enabling automatic cleanup.

What should I do if I get this VA-003 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on VA-003

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. An organization uses the AWS secrets engine to generate IAM users dynamically. They notice that the generated IAM user is not immediately available for use in AWS. What is the most likely reason?

hard

A.The Vault write operation failed due to network latency.
B.The TTL on the role is too short.
C.Vault must wait for the AWS secret key to be rotated before returning the user.
✓ D.AWS IAM is eventually consistent and the user may take a few seconds to propagate.

Why D: Option D is correct because AWS IAM is an eventually consistent system. When Vault uses the AWS secrets engine to create an IAM user via the CreateUser API call, the user is not immediately available across all AWS services due to propagation delays. This eventual consistency means the generated IAM user may take a few seconds to be fully usable, which is a known behavior of AWS IAM.

Last reviewed: Jun 30, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.