VA-003 Compare and configure secrets engines Practice Question
A startup wants to use Vault to manage MySQL database credentials for their development environment. They have a single MySQL database and require that each application gets unique, short-lived credentials that are automatically rotated. The operations team enabled the database secrets engine, configured the MySQL connection, and created a role with a TTL of 1 hour. However, when an application requests credentials using the role, Vault returns an error: 'No more available leases on this role'. The team checks the role's configuration and sees that the 'max_ttl' is set to 1 hour and 'default_ttl' is also 1 hour. What is the most likely cause of this error?
⚠ Common exam trap
HashiCorp often tests the distinction between TTL-based limits and lease-count limits; the trap here is that candidates confuse 'max_ttl' (maximum duration of a lease) with 'max_leases' (maximum number of concurrent leases), leading them to incorrectly adjust TTL values instead of the lease count parameter.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The role has a 'max_leases' parameter set to a low value (e.g., 5) that has been exceeded. Increase the 'max_leases' on the role.
The error 'No more available leases on this role' indicates that the role has a finite number of leases it can issue, controlled by the 'max_leases' parameter. When this limit is reached, Vault refuses to issue new credentials until existing leases expire or are revoked. The role's TTL and max_ttl being both 1 hour does not cause this error; rather, the exhaustion of the lease count does.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database secrets engine is not enabled at the expected path; the role is pointing to a different engine.
Why it's wrong here
A misconfigured engine path yields a 404 or unsupported path error, not a lease exhaustion message. Vault located the role and attempted credential issuance, so the mount is correct. Path errors would be the cause if the role itself could not be found at all.
- ✗
The application is not using a valid token to authenticate to Vault, so the request is rejected.
Why it's wrong here
An invalid token produces a permission denied or 403 error before lease allocation, not 'No more available leases'. Vault authenticates the request successfully here, then fails while issuing credentials. Token validity would be the culprit if requests were rejected outright rather than reaching the role's lease logic.
- ✓
The role has a 'max_leases' parameter set to a low value (e.g., 5) that has been exceeded. Increase the 'max_leases' on the role.
Why this is correct
The role's `max_leases` parameter caps how many concurrent leases the database secrets engine will issue for that role. With a low value such as 5, each application's credential request consumes a lease until the cap is hit, producing "No more available leases on this role". Raising `max_leases` restores issuance; TTL settings are irrelevant here.
- ✗
The TTL values are too short; applications are requesting new credentials too frequently and exhausting a hidden limit. Increase the TTL.
Why it's wrong here
The error names leases, not TTL duration; lengthening TTLs leaves the exhausted lease count unchanged. Vault's database secrets engine caps concurrent leases through the role's configuration, so raising TTLs does not release the limit. TTL tuning suits balancing credential lifetime against rotation overhead, not resolving lease exhaustion.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.