VA-003 Manage Vault leases Practice Question
A large enterprise runs Vault in a production environment with multiple secrets engines, including databases, AWS, and PKI. Recently, the operations team noticed that the number of active leases has grown significantly, causing performance degradation in Vault. The team suspects that many leases are orphaned or expired but not cleaned up. They run the vault lease tidy command regularly, but the issue persists. The vault audit logs show no errors during revocation. However, the team observes that the database credentials are being revoked correctly, but the PKI certificates are not being revoked when their leases expire. Additionally, some AWS IAM user leases seem to persist beyond their max TTL. What is the most likely cause of this issue?
⚠ Common exam trap
HashiCorp Vault often tests the misconception that lease expiration always triggers revocation of the underlying secret, but in reality, some secrets engines (like PKI and AWS) require explicit revocation actions separate from lease lifecycle management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.
In Vault, lease expiration triggers revocation only for secrets engines that support automatic revocation at the Vault level. The PKI secrets engine does not automatically revoke issued certificates when a lease expires; it only removes the lease metadata. Similarly, AWS IAM user credentials are not automatically revoked upon lease expiration because the underlying secret (the IAM user or access key) must be explicitly revoked via the AWS API. The `vault lease tidy` command cleans up stale lease entries in Vault's storage but does not trigger revocation of the underlying secrets for these engines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The max_ttl setting for the PKI and AWS roles is set incorrectly.
Why it's wrong here
Incorrect max_ttl could cause leases to last longer, but the issue is that leases persist beyond max_ttl, suggesting configuration is ignored or revocation fails.
- ✗
The vault lease tidy command is not effective for PKI and AWS secrets engines.
Why it's wrong here
Tidy is effective for all backends but only cleans up lease metadata, not the underlying secrets.
- ✓
The PKI and AWS secrets engines require explicit revocation of the underlying secret, which is not triggered by lease expiration alone.
Why this is correct
Lease expiration does not automatically revoke certificates or IAM users; explicit revocation is needed.
- ✗
The Vault server's clock is out of sync, causing lease expiration calculations to be inaccurate.
Why it's wrong here
Clock skew would affect all engines equally, but database leases are revoked correctly.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.