VA-003 Manage Vault leases Practice Question
A Vault operator accidentally revoked a token that was used to lease many database credentials. What happens to the leases associated with that token?
⚠ Common exam trap
HashiCorp often tests the misconception that leases have independent lifetimes or that Vault might orphan or auto-renew leases, when in fact the token's revocation is the authoritative trigger for immediate lease cleanup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
All leases are immediately revoked.
In Vault, tokens are the root of identity and authorization for all associated leases. When a token is revoked, Vault immediately revokes all leases created using that token, including database credential leases, because the token's lifecycle governs the leases it has created. This ensures that no credentials remain valid after the token is revoked, maintaining security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
All leases are immediately revoked.
Why this is correct
Vault ties every lease to its parent token, so revoking that token cascades to its entire lease tree. All database credential leases issued under it are immediately revoked, forcing clients to re-authenticate and obtain fresh credentials.
- ✗
The leases become orphaned and will never be revoked.
Why it's wrong here
Revoked tokens do not leave leases orphaned; Vault revokes the leases as part of token revocation. It is tempting because orphan tokens exist as a separate Vault concept, but that concerns tokens without parents, not leases, so the correct behaviour is that the leases are revoked, not left permanently unrevoked.
- ✗
Vault automatically renews the leases with a new token.
Why it's wrong here
Revoking a token immediately invalidates its leases; Vault does not mint a replacement token or renew them. It is tempting because Vault can renew leases, but renewal requires the originating token to remain valid and unrevoked, so the correct behaviour is that the leases are revoked alongside the token.
- ✗
The leases continue until their natural expiration.
Why it's wrong here
Revoking a parent token triggers revocation of its child leases rather than letting them run to expiry. It is tempting because leases normally expire naturally when left alone, but explicit token revocation overrides that lifecycle, so the correct behaviour is immediate lease revocation, not continued validity until the natural expiry time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.