VA-003 Lease Practice Question
An application uses Vault's KV v2 secrets engine to read a static secret (e.g., API key) at path 'secret/data/myapp/config'. The application initially reads the secret and uses the returned lease_id to successfully renew the lease every hour. After a maintenance window, the application starts failing to renew the lease, receiving an error that the lease is not renewable or does not exist. The secret data is still present and accessible via a new read. What is the most likely cause of this failure?
⚠ Common exam trap
Candidates often mistake KV v2 secrets as having renewable leases similar to dynamic secrets, but KV v2 reads do not generate renewable leases. The lease_id in the response is actually the token lease, which can expire.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The token used to renew the lease has expired.
The error 'lease is not renewable or does not exist' typically occurs when the token used to authenticate the renewal request has expired. In Vault, KV v2 secrets engine reads do not produce renewable leases; the lease_id returned is actually from the token. If the application's token expires, it cannot renew any leases, even if the secret data is still accessible via a new read with a valid token. Options B and C would cause the secret path itself to change, but the secret data is still present, so they are unlikely. Option D is incorrect because KV v2 leases are not renewable, so they cannot expire in the scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The token used to renew the lease has expired.
Why this is correct
Correct. The token used to renew the lease has expired, causing the renewal to fail because authentication fails.
- ✗
The secret was deleted and recreated under the same path.
Why it's wrong here
Incorrect. Deleting and recreating the secret would not cause a lease renewal failure unless the new secret has a different lease, but the old lease would still exist until it expires.
- ✗
The KV v2 engine was disabled and re-enabled.
Why it's wrong here
Incorrect. Disabling and re-enabling the engine would invalidate all leases, but the secret data would not be accessible at the same path until the engine is re-enabled and the secret recreated.
- ✗
The lease expired during the maintenance window because the application did not renew it on time.
Why it's wrong here
Incorrect. KVV2 static secret reads do not produce renewable leases, so the lease cannot expire due to non-renewal.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.