VA-003 AppRole secret_id_num_uses Practice Question
An organization uses AppRole with secret_id generation via the Vault API. Security policy requires that each secret_id can be used only once and must expire after 1 hour. The configuration must use Vault's standard duration format with hour suffix (e.g., 1h). Which configuration option should be set on the AppRole role to enforce this?
⚠ Common exam trap
A common trap is to choose option D (60m) because 60 minutes equals 1 hour. However, the requirement explicitly mandates the standard hour format, so D is not acceptable.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
secret_id_num_uses=1, secret_id_ttl=1h
The security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Option D is incorrect because it specifies the TTL in minutes (60m) instead of the required hours format. Therefore, only B satisfies the exact requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
secret_id_num_uses=1
Why it's wrong here
Only sets single-use but no expiration; missing secret_id_ttl.
- ✓
secret_id_num_uses=1, secret_id_ttl=1h
Why this is correct
Correctly sets both single-use and 1-hour expiration in the required hours format.
- ✗
secret_id_ttl=1h
Why it's wrong here
Only sets expiration; missing secret_id_num_uses.
- ✗
secret_id_num_uses=1, secret_id_ttl=60m
Why it's wrong here
Sets single-use but uses minutes (60m) for TTL instead of the required hours format.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.