VA-003 Manage Vault leases Practice Question

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Vault is sealed

When Vault is sealed, it cannot process any operations, including lease renewal. The error would indicate the sealed state.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Vault is sealed
Why this is correct
A sealed Vault node cannot service any API requests, including lease renewal, because the barrier is active and the storage backend is inaccessible. The operator receives a "Vault is sealed" error, directly reflecting the stem's constraint that the cluster is sealed. Unsealing restores lease operations.
✗
Upstream error
Why it's wrong here
Upstream error describes a backend or storage-layer fault surfacing through Vault, typically on an unsealed cluster. Sealing blocks request processing at the barrier before any backend call, so no upstream dependency is reached to produce this error.
✗
Permission denied
Why it's wrong here
Permission denied reflects an ACL or policy check failing against a token, which requires Vault to be unsealed and evaluating requests. A sealed node rejects operations before authorisation, so this error cannot be the cause here.
✗
Lease not found
Why it's wrong here
A sealed Vault node cannot service storage requests, so it returns a sealed or service-unavailable style error rather than a lookup failure. Lease-not-found arises when an unsealed cluster holds no matching lease ID, which is a different condition entirely.

Go deeper