VA-003 Manage Vault leases Practice Question
A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?
⚠ Common exam trap
The trap in Vault is that the `renewable` flag on a role only affects new leases issued after the role update, not existing leases. Candidates often incorrectly assume that changing the role setting immediately prevents renewals, but Vault applies the flag at lease creation time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The renewable flag requires the role to be updated after existing leases are issued.
The `renewable=false` setting on a Vault role only affects newly issued leases; it does not retroactively apply to leases that were already issued before the role was updated. Since the security team configured the role after some users had already obtained credentials, those existing leases retain their original `renewable=true` property, allowing users to renew them despite the new role setting. Vault enforces the `renewable` flag at lease creation time, not dynamically during renewal requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The renewable flag requires the role to be updated after existing leases are issued.
Why this is correct
Existing leases retain their original renewable setting; only new leases reflect the updated role.
- ✗
The renewable flag is not respected when max_ttl equals default_ttl.
Why it's wrong here
The renewable flag is independent of TTL values.
- ✗
The renewable flag is only applicable to token auth methods, not secrets engines.
Why it's wrong here
The renewable flag applies to all lease-generating backends.
- ✗
The lease's renewable property is controlled by the client token's renewable status.
Why it's wrong here
The lease's renewable flag is set by the role, not the token.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.