Manage Vault leases →easyMultiple Choice

VA-003 Manage Vault leases Practice Question

A security engineer is onboarding a new application team to Vault. The team needs to understand how Vault manages the lifecycle of secrets issued by the database secrets engine. The engineer explains that Vault attaches a lease to dynamic secrets and that the lease defines the secret's validity period. Which statement accurately describes the relationship between a lease and a dynamic secret?

⚠ Common exam trap

The trap here is assuming a lease is a static mount configuration or a client-side artifact, rather than a per-secret server-side metadata record created at issuance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A lease is metadata that records the secret's validity period, renewal eligibility, and revocation behavior, and it is created alongside the dynamic secret.

Vault issues dynamic secrets together with a lease that records the secret's time-to-live, whether it can be renewed, and how it should be revoked. This server-side metadata is what allows Vault to automatically revoke credentials when they are no longer valid, which is a core security benefit of using dynamic secrets over static credentials.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
A lease is a static configuration setting on the secrets engine that applies the same TTL to every secret issued from that mount.
Why it's wrong here
Leases are not static mount-wide configuration values. While a secrets engine mount can define default and maximum TTLs that influence lease creation, each issued secret receives its own lease object with an individual expiration time. Configuration settings such as default_ttl and max_ttl are inputs to lease creation, not the lease itself.
✓
A lease is metadata that records the secret's validity period, renewal eligibility, and revocation behavior, and it is created alongside the dynamic secret.
Why this is correct
Every dynamic secret issued by Vault is accompanied by a lease that stores its TTL, renewability, and revocation instructions. This metadata lets Vault track the secret and automatically revoke it when the lease expires, ensuring credentials do not persist beyond their intended lifetime. The lease is the authoritative record of the secret's lifecycle.
✗
A lease is a client-side token stored by the application that must be presented to Vault before the secret can be used.
Why it's wrong here
Vault does not require applications to store or present a lease to use a dynamic secret. The lease is tracked server-side by Vault, and the secret (for example, a database username and password) is used directly against the target system. The lease governs revocation and renewal, not authentication to use the credential.
✗
A lease is created only when an administrator manually enables lease tracking on a secrets engine mount.
Why it's wrong here
Lease tracking is automatic for secrets that support it, such as dynamic database credentials, PKI certificates, and cloud IAM credentials. Administrators do not toggling lease tracking on or off per mount. The lease is generated as part of the secret issuance process whenever the secrets engine returns a dynamic secret.

Visual reference

Go deeper

VA-003 Manage Vault leases Practice Question

Why each option matters

Option-by-option breakdown

Related to this question