VA-003 Manage Vault leases Practice Question
A security team wants to ensure that database credentials generated by Vault are never renewed and have a fixed lifespan of 30 minutes. They configure the role with default_ttl=30m and max_ttl=30m, and set renewable=false. However, they find that some users are able to renew the leases anyway. What could be the reason?
⚠ Common exam trap
The trap in Vault is that the `renewable` flag on a role only affects new leases issued after the role update, not existing leases. Candidates often incorrectly assume that changing the role setting immediately prevents renewals, but Vault applies the flag at lease creation time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The renewable flag requires the role to be updated after existing leases are issued.
The `renewable=false` setting on a Vault role only affects newly issued leases; it does not retroactively apply to leases that were already issued before the role was updated. Since the security team configured the role after some users had already obtained credentials, those existing leases retain their original `renewable=true` property, allowing users to renew them despite the new role setting. Vault enforces the `renewable` flag at lease creation time, not dynamically during renewal requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The renewable flag requires the role to be updated after existing leases are issued.
Why this is correct
The renewable flag is evaluated when a lease is issued, so leases created before the role update retain their original renewability. Existing leases must be revoked or allowed to expire for the non-renewable setting to take effect.
- ✗
The renewable flag is not respected when max_ttl equals default_ttl.
Why it's wrong here
Vault honours renewable=false regardless of whether default_ttl equals max_ttl; equal values simply cap the total lifetime. The claim is tempting because equal TTLs look like they should force non-renewal, but renewal is governed by the renewable flag, not TTL equality.
- ✗
The renewable flag is only applicable to token auth methods, not secrets engines.
Why it's wrong here
The renewable flag applies to leases issued by secrets engines, including database credential leases, not only to auth method tokens. It is tempting because tokens and leases share renewal semantics, yet database roles explicitly expose a renewable setting that governs their generated credentials.
- ✗
The lease's renewable property is controlled by the client token's renewable status.
Why it's wrong here
A lease's renewable property is set by the secrets engine role that issued it, not inherited from the client token's renewable status. It is tempting because token renewal and lease renewal use similar APIs, but the database role's renewable=false should already prevent lease renewal.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.