HashiCorp Vault Associate VA-003 (VA-003) — Questions 376–450

Why this answer

How to eliminate wrong answers

Option A is wrong because renewable=false prevents any renewal, so the lease would expire after 1 hour and cannot be extended to the max TTL of 4 hours. Option B is wrong because it sets default_ttl=4h and max_ttl=1h, which is invalid—the default TTL cannot exceed the max TTL; Vault would reject this configuration or cap the default to the max. Option D is wrong because it includes an extra ttl=1h parameter, which is not a valid role parameter for dynamic secrets (the correct parameters are default_ttl and max_ttl); adding an undefined parameter may cause an error or be ignored, but the core issue is that it introduces confusion without adding value.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because LDAP is used for authenticating against an LDAP directory (e.g., Active Directory or OpenLDAP), not against GitHub accounts. Option B is wrong because Okta is a third-party identity provider that integrates via OIDC/SAML, not a direct GitHub authentication method. Option C is wrong because username & password (userpass) is a built-in Vault auth method for local users, not for federating with external GitHub accounts.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because setting only `ttl` to 720h without `max_ttl` allows the token to be renewed indefinitely, as each renewal resets the TTL, so the token could live far beyond 30 days. Option B is wrong because `explicit_max_ttl` is not a valid token role parameter in Vault; the correct parameter for enforcing an absolute lifetime is `max_ttl`. Option C is wrong because setting `period` to 720h without `max_ttl` creates a periodic token that can be renewed indefinitely as long as it is renewed before the period expires, which does not enforce a hard 30-day limit.

Why this answer

How to eliminate wrong answers

Option B is wrong because `vault lease info` is not a valid Vault CLI command; the correct subcommand is `lookup`. Option C is wrong because `vault status` displays the seal status and HA state of the Vault server, not lease information. Option D is wrong because `vault read` is used to read secrets or data from a path, not to inspect lease metadata; it would attempt to read the path as a secret, which would fail or return unrelated data.

Why this answer

How to eliminate wrong answers

Option B is wrong because the transit secrets engine is used for encryption/decryption of data in transit, not for generating dynamic credentials; encrypting static credentials still requires manual rotation and does not provide unique, time-limited pairs per instance. Option C is wrong because the PKI secrets engine issues X.509 certificates for TLS/mTLS authentication, not username/password pairs, and database authentication typically does not use certificates unless the database supports certificate-based auth (e.g., MySQL with SSL), which is not the stated requirement. Option D is wrong because storing credentials in KV v2 (Key-Value version 2) provides static secrets that must be manually rotated and shared across instances, failing to deliver unique, time-limited credentials and increasing operational overhead for credential management.

Why this answer

How to eliminate wrong answers

Option A is wrong because `vault operator raft snapshot restore` is used to restore data from a previously taken snapshot, not to recover from a quorum loss; it requires a functioning cluster or a single-node recovery first. Option B is wrong because restarting all nodes simultaneously does not resolve the underlying Raft quorum issue; the nodes will still attempt to form a cluster with the same stale peer set and will remain sealed if quorum cannot be achieved. Option C is wrong because manual unsealing only decrypts the Vault's seal, but the Raft layer still requires quorum to operate; unsealing does not repair the broken consensus.

Why this answer

How to eliminate wrong answers

Option B (Key derivation) is wrong because key derivation is a process that generates a unique encryption key per input plaintext using a key derivation function (KDF), but it does not provide a mechanism to rotate the master key without re-encrypting existing data. Option C (Key ttl) is wrong because key TTL (time-to-live) sets an expiration time for a key, but it does not enable rotation without re-encryption; once the TTL expires, the key becomes unusable, forcing re-encryption if the data must remain accessible. Option D (Convergent encryption) is wrong because convergent encryption derives the encryption key from the hash of the plaintext, making it deterministic and unsuitable for key rotation—changing the key would break the ability to decrypt existing ciphertext.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because 24h would only result if the requested TTL were subtracted from max_ttl or if a default TTL were applied, but no such subtraction or default is specified; the role's max_ttl is an upper limit, not a deduction. Option B is wrong because 72h is the max_ttl, but the user explicitly requested a shorter TTL (48h), and the PKI role honors the requested TTL as long as it does not exceed max_ttl. Option D is wrong because `allow_any_name=true` bypasses the `allowed_domains` check entirely, so no matching is required; the certificate is issued regardless of domain, and the TTL remains 48h.

Why this answer

How to eliminate wrong answers

Option B is wrong because the encryption algorithm for secrets is not defined in the `storage` stanza; it is determined by the seal mechanism (e.g., using AES-256-GCM by default) and is not configurable in the storage stanza. Option C is wrong because the seal mechanism is defined in the `seal` stanza (e.g., `seal "awskms"` or `seal "shamir"`), not in the `storage` stanza. Option D is wrong because the listener address is defined in the `listener` stanza (e.g., `listener "tcp" { address = "127.0.0.1:8200" }`), which configures the network interface and port for API requests, not the storage backend.

Why this answer

How to eliminate wrong answers

Option A is wrong because Vault does not provide a grace period for token renewal after expiration; once the TTL is exceeded, the token is immediately revoked and cannot be renewed. Option C is wrong because Vault never automatically renews tokens; renewal must be explicitly requested by the client or a renewal process (e.g., via the API or a sidecar). Option D is wrong because an expired token is revoked entirely, not placed into a read-only state; Vault has no 'read-only' token mode after expiration.

Why this answer

How to eliminate wrong answers

Option A is wrong because `userpass/` is not the default token authentication method; it is a separate username/password auth method that may or may not be enabled, and disabling it does not affect the default token method. Option C is wrong because `ldap/` is an LDAP-based auth method, not the default token method, and disabling it would not remove the token auth endpoint. Option D is wrong because `approle/` is an AppRole auth method used for machine-to-machine authentication, not the default token method, and disabling it leaves the default token method intact.

Why this answer

How to eliminate wrong answers

Option A is wrong because a standby node rejoining does not trigger a leadership election; elections only occur when the active node fails or becomes unreachable. Option B is wrong because seal wrapping keys are used for encrypting the unseal key or root token, not for re-encrypting all data; re-encryption of all data is not a standard behavior upon node reconnection. Option D is wrong because Raft does not force a full data sync from the active node; it uses log replication and snapshot installation to bring the node up to date, which is more efficient than a full sync.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it includes a trailing slash in the URL (`/v1/sys/auth/aws/`), which is not the standard path for enabling auth methods; Vault API expects the path without a trailing slash for this operation. Option B is wrong because it uses the PUT method instead of POST; while Vault's API sometimes accepts PUT for updates, enabling a new auth method requires POST as per the official documentation. Option C is wrong because the payload uses `{"method":"aws"}` instead of `{"type":"aws"}`; the correct field name is `type`, not `method`, and using `method` would cause Vault to ignore the field or return an error.

Why this answer

How to eliminate wrong answers

Option A is wrong because a periodic token with a period of 24h can be renewed indefinitely as long as the renewal occurs within the period, allowing the token to exist beyond 24 hours. Option B is wrong because an orphan token with a TTL of 24h can still be renewed before expiration, extending its lifetime beyond the initial 24-hour window. Option C is wrong because a batch token is designed for high-throughput, short-lived operations and does not inherently enforce a hard maximum lifetime; it can be renewed or have its TTL extended unless explicitly constrained.

Why this answer

How to eliminate wrong answers

Option A is wrong because Vault uses Raft consensus, which prevents split-brain by requiring a majority (quorum) for leader election; two nodes cannot both become leader as they will coordinate via Raft. Option B is wrong because Node1 will not automatically join the cluster once unsealed; it will join as a standby node only after being unsealed, but it does not automatically unseal itself. Option D is wrong because the cluster remains available as long as a quorum of nodes (2 out of 3) is unsealed; Node1 being sealed does not make the cluster unavailable.

Why this answer

How to eliminate wrong answers

Option A is wrong because KV v3 does not exist in Vault; the KV secrets engine has only two versions (v1 and v2). Option B is wrong because KV v1 stores secrets without versioning, so it cannot support rollback to previous values. Option D is wrong because the Transit secrets engine is used for encryption as a service, not for storing secrets with versioning capabilities.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because it includes 'delete' capability on 'secret/data/ci-cd', which violates least privilege as the pipeline only needs to write artifacts, not delete them. Option C is wrong because it uses a wildcard path 'secret/data/ci-cd/*', which would grant capabilities to all sub-paths under 'ci-cd', potentially exposing other secrets and violating least privilege. Option D is wrong because 'write' is not a valid capability in Vault policies; the correct capabilities for writing are 'create' and 'update'.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the transit engine does not use `read` and `write` capabilities for encryption/decryption; those are used for reading and writing data at rest, not for transit operations. Option C is wrong because the policy includes both `create` (encrypt) and `update` (decrypt) capabilities, so it allows decryption as well, not just encryption. Option D is wrong because `create` and `update` are the correct capabilities for transit operations; `read` and `write` are not used for encrypt/decrypt actions in the transit engine.

Why this answer

How to eliminate wrong answers

Option A is wrong because `secret/team` is the KV v1 path, but the exhibit shows a KV v2 engine (indicated by the `data` key in the JSON output), and using the v1 path would return a different structure or an error. Option B is wrong because `-field=api_key` without the `data.` prefix attempts to access `api_key` at the top level of the JSON, but in KV v2 the actual key is nested under `data`, so this would return nothing or an error. Option D is wrong because it omits the `-field` flag entirely, so it would print the full JSON output including metadata, not just the plain-text value of `api_key`.

Why these pairings

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the max TTL of 24h is not being enforced prematurely; the default TTL of 1h is the actual lease duration, and the max TTL only caps the total possible renewal period. Option B is wrong because Vault uses its own internal clock for lease expiry, and while clock skew can cause issues, it is not the most likely cause given the scenario describes credentials expiring at the expected TTL boundary. Option C is wrong because renewing a lease resets the TTL from the renewal time, extending the lease; frequent renewal would actually prevent early expiry, not cause it.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because `-response-wrap` is not a valid flag; the correct flag is `-wrap-ttl` to set the TTL for the wrapping token. Option B is wrong because `vault unwrap` is the command used on the remote service to retrieve the original token, but it is not the CLI flag or command used to create the wrapped token. Option D is wrong because `vault wrap` is not a valid command; the correct approach is to use `vault write` with the `-wrap-ttl` flag to generate a wrapped response.

Why this answer

How to eliminate wrong answers

Option A is wrong because the KV secrets engine stores secrets as key-value pairs and is not designed for encryption/decryption operations; it stores data at rest but does not provide cryptographic operations. Option B is wrong because the PKI secrets engine generates and manages X.509 certificates for TLS/SSL, not for generic encryption/decryption of data. Option C is wrong because the Database secrets engine generates dynamic database credentials (e.g., usernames/passwords) and does not perform encryption/decryption of arbitrary data.

Why this answer

How to eliminate wrong answers

Option A is wrong because enabling token renewal keeps the token alive indefinitely by renewing its lease, which is the opposite of what is needed to automatically expire the token. Option B is wrong because a periodic token has no fixed TTL and requires manual revocation, which does not provide automatic expiration when the application stops running. Option D is wrong because batch tokens are designed for high-throughput, non-renewable workloads but still require an explicit TTL or explicit revocation; they do not inherently limit lifetime based on application lifecycle.

Why this answer

How to eliminate wrong answers

Option A is wrong because it uses 'vault kv put' with the full path 'secret/data/team', which would result in a double 'data/' prefix (i.e., 'secret/data/data/team'), causing a 404 error. Option C is wrong because 'vault write' with path 'secret/data/team' is the correct raw API path for KV v2, but the question asks for the CLI command that 'achieves' this, and 'vault kv put' is the preferred and simpler CLI method; however, this option is technically correct for writing but not the best practice CLI command, and the exam expects the 'vault kv put' syntax. Option D is wrong because 'vault write secret/team' would target the KV v1 engine (or the metadata path in v2), not the data path, and would fail to write the secret correctly under KV v2.

Why this answer

How to eliminate wrong answers

Option A is wrong because a replication token expiration would cause replication to stop entirely with an authentication error, not a merkle sync in progress. Option B is wrong because seal types (e.g., Shamir, Auto Unseal) do not affect replication mechanics; replication operates independently of the seal configuration. Option D is wrong because Performance Replication is near real-time, streaming WAL entries continuously; there is no default one-hour interval.

Why this answer

How to eliminate wrong answers

Option A is wrong because the database secrets engine does support revocation; it can execute custom SQL statements to disable or drop users when leases expire or are revoked. Option B is wrong because the `default_ttl` controls how long a lease is valid before it must be renewed, not whether the user is removed after revocation; a high TTL would delay expiration but not prevent revocation. Option C is wrong because the lease duration (TTL) determines the lifetime of the credential, not the revocation behavior; a long lease would simply keep the user active longer, but revocation would still occur if properly configured.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'read' is not required for updating an existing secret; it only allows reading the data, and including it would grant unnecessary read access. Option B is wrong because 'write' in Vault's KV v2 engine is a meta-capability that encompasses both 'create' and 'update', which would allow creating new secrets, violating the requirement. Option D is wrong because 'create' would allow the service to create new secrets at the path, which is explicitly disallowed by the requirement.

Why this answer

How to eliminate wrong answers

Option B (Transit seal) is wrong because the Transit seal uses Vault's Transit secrets engine to encrypt the unseal key, but it does not derive the key from an HSM; it relies on another Vault cluster or a separate encryption service, not a hardware security module. Option C (Shamir seal) is wrong because it uses Shamir's secret sharing to split the unseal key into shards, requiring manual intervention from multiple operators to unseal, and does not involve an HSM or automatic unsealing. Option D (Cloud KMS seal) is wrong because while it provides auto-unseal using a cloud provider's key management service (e.g., AWS KMS, Azure Key Vault, GCP Cloud KMS), it does not derive the key from a hardware security module; the key is managed by the cloud provider's software-based KMS, not a dedicated HSM.

Why this answer

How to eliminate wrong answers

Option A is wrong because a socket audit device sends logs over TCP/UDP, and if the remote log aggregator is unreachable or the socket buffer is full, Vault will block requests by default unless `blocking=false` is explicitly set, which is not mentioned. Option B is wrong because `blocking=true` causes Vault to halt operations when the audit device is full, directly contradicting the requirement to not halt operations. Option D is wrong because a syslog audit device with a local syslog server can still block Vault if the syslog server is overwhelmed or the local socket is full, as the default behavior is blocking; additionally, syslog does not natively support a fallback mechanism like the file audit device's fallback path.

Why this answer

How to eliminate wrong answers

Option A is wrong because service tokens can be renewed even after expiration if within the grace period, and the error is specific to batch token behavior, not expiration. Option C is wrong because periodic tokens are a type of service token that can be renewed indefinitely as long as the token is still valid, and their period expiration does not prevent renewal. Option D is wrong because orphan tokens are a property related to parent-child relationships, not renewability; orphan tokens can be service or batch tokens, and the error is due to the batch type, not the orphan status.

Why this answer

How to eliminate wrong answers

Option A is wrong because the SSH secrets engine is designed to manage SSH credentials (client and host keys) and automate SSH access, not to issue X.509 certificates. Option B is wrong because the Cert secrets engine is a deprecated alias for the PKI secrets engine in older Vault versions; the current and correct name is PKI, and using 'Cert' implies an incorrect or outdated reference. Option C is wrong because the Transit secrets engine performs encryption/decryption operations as a service (encryption as a service) and does not generate or manage X.509 certificates.

Why this answer

How to eliminate wrong answers

Option A is wrong because LDAP authentication in Vault relies on an external LDAP directory service (like Active Directory) to validate user credentials, not on a shared Role ID and dynamic Secret ID. Option B is wrong because the username & password (userpass) method uses a static username and password stored in Vault's internal database, intended for human users, not a two-part system with a dynamic secret. Option D is wrong because Okta authentication uses OAuth/OIDC flows to delegate authentication to the Okta identity provider, and does not involve a Role ID or Secret ID mechanism.

Why this answer

How to eliminate wrong answers

Option A is wrong because reinitializing Vault with new unseal keys would destroy all existing secrets and configuration, which is unnecessary and destructive; the goal is to change the encryption key for new data, not to wipe the entire Vault. Option C is wrong because migrating secrets to a new mount and deleting the old one does not change the underlying encryption key used by the storage backend; it only moves data between mounts, and the new mount would still use the same keyring unless the key is rotated. Option D is wrong because `vault operator rekey` changes the unseal keys (shares and threshold), not the encryption key used for data at rest; rekeying with different parameters would only affect how the master key is split, not the encryption of stored data.

Why this answer

How to eliminate wrong answers

Option A is wrong because logging the token value directly would expose the secret credential, violating the security audit's requirement to avoid exposing the token value. Option B is wrong because the Creation TTL (time-to-live) is a configuration parameter that indicates the token's initial lifetime, not a unique identifier for tracking individual token usage. Option D is wrong because the policy list defines the token's associated access policies but does not provide a unique, non-sensitive identifier for tracking token usage across operations.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS IAM authentication is specific to AWS environments and cannot authenticate workloads running on Kubernetes or on-premises without additional bridging, and it relies on AWS IAM roles and signed requests, not a unified token standard. Option C is wrong because Kubernetes authentication is limited to Kubernetes clusters and requires a Kubernetes service account token or a kubeconfig, making it unsuitable for EC2 or on-premises workloads. Option D is wrong because AppRole authentication requires a pre-shared secret (RoleID and SecretID) to be distributed to each workload, which contradicts the requirement for short-lived credentials without a shared secret and adds operational overhead for secret distribution.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the CLI command syntax is correct; `vault write ssh/otp/otp_role ip=10.0.0.1 username=admin` is the proper format for generating an OTP for an SSH target. Option B is wrong because performance secondary clusters can write data to local mounts (like the SSH secret engine) and to certain replicated paths that allow writes (e.g., token creation), though they cannot write to replicated mounts from the primary. Option D is wrong because the SSH secret engine is a local mount by default and does not need to be replicated; in fact, replicating it would defeat the purpose of local SSH OTP generation.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because `vault operator unseal -auto` is not a valid command; Vault does not support an `-auto` flag for unsealing, and unsealing requires explicit key shares. Option B is wrong because `vault operator unseal <key>` assumes unseal keys already exist, but the server has not been initialized yet, so no keys are available to provide. Option C is wrong because `vault operator generate-root` is used to generate a new root token after initialization, not to unseal the server; it requires an already unsealed Vault to function.

Why this answer

How to eliminate wrong answers

Option A is wrong because a periodic token with a TTL of 72 hours does not support automatic renewal; it has a fixed lifetime and will expire after 72 hours regardless of continued use. Option B is wrong because an orphan token with a TTL of 1 hour is designed for short-lived, non-renewable use cases and cannot be automatically renewed, nor does it have a max TTL to extend its lifetime. Option C is wrong because a batch token with a TTL of 72 hours is intended for non-interactive, one-time use and does not support automatic renewal based on continued usage.

Why this order

Why this answer

How to eliminate wrong answers

Option A is wrong because not all nodes handle write requests; only the active node can process writes, while standby nodes are read-only and forward writes to the active node. Option C is wrong because standby nodes do not handle write requests; they only serve read requests and forward writes to the active node. Option D is wrong because the node that receives the request may be a standby node, which cannot process writes locally and must forward the request to the active node.

Why this answer

How to eliminate wrong answers

Option B is wrong because it grants read access to all keys under `secret/data/app`, not just `db_password`, violating the requirement. Option C is wrong because it attempts to target a specific key as a subpath, but Vault's KV v2 engine does not expose individual keys as separate paths; the path must be the secret's full path, and key-level restrictions require `allowed_parameters`. Option D is wrong because `required_parameters` mandates that the request must include `db_password`, but does not restrict which keys can be read; it would still allow reading other keys if they are present, and it would block requests that omit `db_password` even if the user only wants that key.

Why this answer

How to eliminate wrong answers

Option A is wrong because the Transit engine handles encryption as a service (encrypt/decrypt data without storing it), while cubbyhole stores raw secrets per token. Option C is wrong because cubbyhole is explicitly not replicated across clusters; it is local to the token and does not participate in Performance or DR replication. Option D is wrong because cubbyhole provides no high availability guarantees; it is a single-token, non-durable store that vanishes with the token.

Why this answer

How to eliminate wrong answers

Option B is wrong because POST /v1/auth/token/create-orphan creates an orphan token (not parented by the requesting token), but the question does not specify orphan behavior; the standard create endpoint suffices and the -orphan variant is not required. Option C is wrong because the correct path is /v1/auth/token/create, not /v1/token/create; the 'auth' segment is mandatory for the token auth method, and the JSON key must be 'policies' (array), not 'policy' (string). Option D is wrong because /v1/sys/token is not a valid endpoint; token creation is under /v1/auth/token/, and the JSON body must use 'policies' as an array, not 'policy' as a string.

Why this order

Why this answer

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because if the secrets engine were not enabled at the expected path, the error would be something like 'path not found' or 'no handler for route', not a lease exhaustion error. Option B is wrong because an invalid token would result in a 'permission denied' or 'token not found' error, not a lease-specific error. Option D is wrong because increasing TTL would actually reduce the frequency of lease creation, not solve the exhaustion of a fixed lease count; the error is about a limit on the number of concurrent leases, not their duration.

Why this answer

How to eliminate wrong answers

Option B is wrong because a Vault token TTL expiry would cause authentication failures for subsequent requests using that token, not for the initial AWS auth method login itself, and the audit log would show a different error (e.g., 'token expired'). Option C is wrong because the client token used for AWS auth is the temporary token returned by the AWS auth method after successful login; if it were revoked, the error would occur after authentication, not during the AWS auth method call. Option D is wrong because if the AWS secret engine were disabled, the audit log would show an 'engine disabled' or 'path not found' error, not a 'permission denied' error specific to the AWS auth method.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the user received a 'permission denied' error, not an 'authentication required' error; the token is present and valid, but lacks the necessary capabilities. Option C is wrong because if the secret engine were not mounted, the error would be 'no secret engine mounted at secret/' or 'path not found', not 'permission denied'. Option D is wrong because an expired token would return an 'invalid token' or 'token expired' error, not a 'permission denied' error.

Why this answer

How to eliminate wrong answers

Option A is wrong because it only sets secret_id_num_uses=1, which enforces single-use but does not enforce the 1-hour expiration, leaving the secret_id potentially valid indefinitely until used. Option C is wrong because it only sets secret_id_ttl=1h, which enforces expiration but does not limit the number of uses, allowing the secret_id to be reused multiple times within the hour. Option D is wrong because while it sets both parameters, it uses '60m' instead of '1h'; although functionally equivalent, the question specifies '1 hour' and the correct Vault syntax for the TTL is '1h' (or '60m' is acceptable but less canonical), and more importantly, the option is listed as 'secret_id_ttl=60m' which is technically correct but the exam expects the exact format '1h' as shown in the correct answer.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because root tokens are not subject to most TTL restrictions, but the token in question was created using a token role, not by a root token directly, and the issue is about explicit_max_ttl enforcement, not root token behavior. Option C is wrong because batch tokens cannot be renewed at all, but the audit logs show the token was successfully renewed several times before failing, indicating it was a service token, not a batch token. Option D is wrong because orphan tokens have no parent and can be renewed indefinitely up to their TTL limits; there is no restriction on the number of renewals for orphan tokens.

Why this answer

How to eliminate wrong answers

Option A is wrong because `database/roles/` is a valid path for listing roles when the database secrets engine is enabled; Vault uses a standard endpoint for listing. Option B is wrong because the application can read credentials from `database/creds/my-role`, which proves the database secrets engine is enabled and mounted. Option D is wrong because the 'sudo' capability is not required for listing roles; 'sudo' is used for privileged operations like modifying policies or enabling engines, not for standard listing.

Why this answer

How to eliminate wrong answers

Option A is wrong because revoking and re-issuing the lease is unnecessary and would break the existing credential; renewal extends the current lease without recreating it. Option B is wrong because the token's `explicit_max_ttl` limits the total lifetime of the token, not the lease; the lease's renewal is constrained by its own `max_ttl` and the role's settings, not the token's explicit max TTL. Option C is wrong because the `max_ttl` in the database role sets an upper bound on the lease duration, but it does not need to be increased for a single renewal to succeed unless the current lease has already reached that maximum; the renewal will simply fail if the lease's TTL would exceed the role's `max_ttl`.

Why this answer

How to eliminate wrong answers

Option A is wrong because Performance Replication is designed for low-latency read scaling across geographically distributed clusters, but the secondary cluster remains read-only and cannot be promoted to writable in a disaster. Option B is wrong because Consul as a storage backend is a storage configuration, not a replication feature; it does not provide built-in continuous replication or failover to a writable secondary. Option C is wrong because Performance Standby nodes are read-only and intended to offload read requests from the active leader, not to serve as a writable disaster recovery target.