VA-003 Manage Vault leases Practice Question
A DevOps team uses Vault to generate temporary database credentials. They notice that some applications are failing because their database credentials expire unexpectedly before the expected TTL. The Vault admin configured the database role with a default TTL of 1h and max TTL of 24h. What is the most likely cause?
⚠ Common exam trap
A common trap in the HashiCorp Vault exam is confusing default TTL with max TTL. Candidates may think max TTL is the credential lifetime, but the default TTL is the initial lease duration, and renewal is required to extend it up to the max TTL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is not renewing the lease, and the lease TTL is counted from the issue time.
Vault database credentials are issued as leases with a TTL that starts counting from the moment they are issued. If the application does not renew the lease, the credentials expire exactly after the default TTL (1 hour) has elapsed, regardless of the max TTL setting. The failure occurs because the application expects the credentials to last longer, but the lease TTL is not extended without renewal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database role's max TTL is being enforced, but the default TTL is shorter.
Why it's wrong here
Max TTL is 24h, so it does not cause earlier expiry than the default 1h.
- ✗
The Vault server's clock is skewed, causing early expiry.
Why it's wrong here
Clock skew could cause issues but is not the most likely cause without other symptoms.
- ✗
The application is renewing the lease too frequently, causing Vault to reset the TTL.
Why it's wrong here
Frequent renewal actually extends the lease, not shortens it.
- ✓
The application is not renewing the lease, and the lease TTL is counted from the issue time.
Why this is correct
Leases expire based on their original TTL if not renewed before expiry.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.