VA-003 Manage Vault leases Practice Question
An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that lease revocation automatically guarantees the underlying resource is destroyed, but the trap is that revocation only manages the Vault-side lease metadata, not the external resource, which depends on the success of the configured revocation script.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The revocation script failed to delete the database user.
When a lease is revoked in Vault, the revocation script associated with the database secret engine is responsible for deleting or disabling the corresponding database user. If that script fails (e.g., due to insufficient permissions, network issues, or a bug in the script), the underlying credential remains active in the database, even though the lease is no longer valid in Vault. This is a common operational issue where the lease lifecycle and the actual credential lifecycle become out of sync.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The revocation script failed to delete the database user.
Why this is correct
If the revocation script fails, the credential remains despite lease revocation.
- ✗
The secret engine caches credentials.
Why it's wrong here
Vault does not cache database credentials after lease revocation.
- ✗
The lease ID was incorrect.
Why it's wrong here
An incorrect lease ID would result in no revocation, but the administrator revoked a specific lease, so the ID was likely correct.
- ✗
The lease was renewed after revocation.
Why it's wrong here
Once revoked, a lease cannot be renewed.
Visual reference
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.