Manage Vault leases →hardMultiple ChoiceObjective-mapped

VA-003 Manage Vault leases Practice Question

Exhibit

Refer to the exhibit.

```
$ vault lease lookup database/creds/my-role/abc123
Key                  Value
---                  -----
id                   database/creds/my-role/abc123
issue_time           2024-03-15T10:00:00Z
renewable            true
ttl                  1h

expire_time          2024-03-15T11:00:00Z
```

A Vault operator runs the command shown in the exhibit and wants to renew the lease before it expires. The operator has a valid token. What must be true for the renewal to succeed?

⚠ Common exam trap

A common trap is thinking that modifying the role's `max_ttl` or the token's `explicit_max_ttl` is necessary to renew a lease. In reality, renewal simply fails if those limits are exceeded; the correct action is to use the `vault lease renew` command with the lease ID.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The operator can renew the lease by running 'vault lease renew database/creds/my-role/abc123'.

The `vault lease renew` command with the specific lease ID (`database/creds/my-role/abc123`) is the standard way to extend a lease's TTL, provided the token has sufficient privileges and the lease is renewable. The operator has a valid token, so no prior revocation or role modification is required; the renewal will succeed as long as the token's policies allow it and the lease's remaining TTL is within the token's `explicit_max_ttl`.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The operator must first revoke the lease and re-issue it to obtain a longer TTL.
Why it's wrong here
Revoking and re-issuing is unnecessary; renewal can extend the lease up to the role's max TTL.
✗
The token's 'explicit_max_ttl' must be at least as long as the lease's remaining TTL.
Why it's wrong here
The token's explicit_max_ttl does not directly limit lease renewal; the token must be valid and not expired.
✗
The 'max_ttl' parameter in the database role must be increased to allow renewal.
Why it's wrong here
While the max_ttl on the role limits the total lifetime, the renewal may still succeed as long as the current TTL extended does not exceed max_ttl. The exhibit does not indicate max_ttl, so it's not necessarily required to increase it.
✓
The operator can renew the lease by running 'vault lease renew database/creds/my-role/abc123'.
Why this is correct
Since the lease is renewable and the token is valid, a simple renew command will succeed and extend the lease.

Go deeper

VA-003 Manage Vault leases Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question