VA-003 Manage Vault leases Practice Question
An organization uses Vault with a database secrets engine. They have a role that issues credentials with a lease TTL of 30 minutes. After some time, they notice that the database is full of stale users. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to confuse Vault's lease revocation with database user cleanup, assuming that revoking a lease automatically deletes the corresponding database user, when in fact Vault requires an explicit tidy operation to remove stale accounts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vault's tidy operation is not configured to clean up stale leases.
Vault's database secrets engine does not automatically clean up stale user accounts in the target database. The `tidy` operation must be explicitly configured and run to remove users whose leases have expired or been revoked. Without it, even if Vault correctly revokes the lease, the database user may remain, leading to an accumulation of stale accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The lease revocation process is failing due to network issues.
Why it's wrong here
Network issues could cause revocation failures, but tidy is designed to handle such cases.
- ✗
The database rotation statement is incorrect, causing Vault to not properly revoke credentials.
Why it's wrong here
Rotation statement is for periodic password changes, not revocation.
- ✗
The role's max_ttl is set too high, allowing leases to live longer.
Why it's wrong here
High max_ttl does not prevent revocation on expiry; it only extends potential lifespan.
- ✓
Vault's tidy operation is not configured to clean up stale leases.
Why this is correct
Without tidy, expired leases may not have their underlying secrets revoked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.