VA-003 Manage Vault leases Practice Question
A Vault administrator wants to configure a role for dynamic secrets with a default TTL of 1 hour and a max TTL of 4 hours. They also want to allow renewal but only up to the max TTL. Which configuration achieves this?
⚠ Common exam trap
A common trap is confusing the order of default_ttl and max_ttl. Remember that default_ttl sets the initial lease duration, while max_ttl limits the total lifetime including renewals. Also, renewable=true must be set to allow renewal up to the max_ttl.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
default_ttl=1h, max_ttl=4h, renewable=true
It sets the default TTL to 1 hour, the maximum TTL to 4 hours, and enables renewal (renewable=true). In Vault, dynamic secret leases can be renewed up to the max_ttl, so with this configuration the initial lease is 1 hour, and each renewal extends the lease until the total lifetime reaches 4 hours, after which no further renewals are allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
default_ttl=1h, max_ttl=4h, renewable=false
Why it's wrong here
This prevents renewal, so the lease cannot be extended up to max_ttl.
- ✗
default_ttl=4h, max_ttl=1h, renewable=true
Why it's wrong here
max_ttl cannot be less than default_ttl; this configuration would be rejected.
- ✓
default_ttl=1h, max_ttl=4h, renewable=true
Why this is correct
This allows renewal up to the max_ttl of 4 hours.
- ✗
default_ttl=1h, max_ttl=4h, renewable=true, ttl=1h
Why it's wrong here
The ttl parameter is not needed; default_ttl already sets the initial TTL.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.