VA-003 Manage Vault leases Practice Question
A platform team runs a Vault cluster where many applications obtain dynamic AWS credentials from the aws secrets engine. During an incident, an operator needs to stop all credential usage tied to a compromised IAM role without disrupting other roles. The operator has a root token and wants to revoke every lease associated with that specific role. Which approach accomplishes this?
⚠ Common exam trap
The trap here is reaching for mount disablement or AWS-side deletion when a scoped lease revocation by path prefix is the precise and least disruptive action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run vault lease revoke -prefix aws/creds/<role-name> to revoke all leases under that role's path.
The vault lease revoke command with the -prefix flag revokes all leases whose IDs share a given path prefix. Because AWS dynamic credentials are issued under aws/creds/<role-name>, using that prefix scopes the revocation to the compromised role only, achieving rapid containment without tearing down the secrets engine or affecting other roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the AWS IAM role directly in AWS and wait for Vault leases to expire naturally.
Why it's wrong here
Deleting the IAM role in AWS does not revoke Vault leases or remove the credentials already issued. Existing credentials may continue to be valid until their lease TTL expires, and Vault's lease records would remain. This approach also bypasses Vault's revocation workflow, leaving stale leases and failing to meet the immediate containment requirement.
- ✗
Disable the aws secrets engine mount, which immediately revokes all leases issued by that mount.
Why it's wrong here
Disabling a secrets engine mount does revoke its leases, but it also removes the mount configuration, roles, and root credentials. This is far broader than needed and would disrupt every application using any role on that mount, not just the compromised role. The task requires revoking leases for one role while preserving the mount and other roles.
- ✓
Run vault lease revoke -prefix aws/creds/<role-name> to revoke all leases under that role's path.
Why this is correct
The vault lease revoke command supports the -prefix flag, which revokes every lease whose ID begins with the given path. Using aws/creds/<role-name> targets only leases issued for that role, leaving other roles' credentials intact. This is the precise, scoped way to revoke a set of leases during an incident.
- ✗
Run vault token revoke -self to revoke the token that requested the credentials.
Why it's wrong here
Revoking the requesting token revokes the token and its child tokens, but it does not necessarily revoke leases created by that token unless the token is revoked with the appropriate cascade behavior. In many cases leases persist independently. This does not reliably revoke all credentials for the compromised role and may affect unrelated tokens.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.