Manage Vault leases practice questions

A DevOps team is using Vault's database secrets engine to generate dynamic credentials for a PostgreSQL database. They notice that the lease duration is set to 24 hours, but security policy requires that credentials expire after 1 hour. What should the team do to enforce the 1-hour expiration without changing the default lease TTL for all secrets?

Trap 1: Set the mount's max_lease_ttl to 1h.

This would affect all secrets from this mount, not just database credentials.

Trap 2: Ask each developer to set the TTL when requesting credentials.

Users can request a TTL, but it is capped by the role's max_ttl.

Trap 3: Use a periodic token with a period of 1h.

Periodic tokens are not appropriate for database credentials.

A
Set the mount's max_lease_ttl to 1h.
Why wrong: This would affect all secrets from this mount, not just database credentials.
B
Ask each developer to set the TTL when requesting credentials.
Why wrong: Users can request a TTL, but it is capped by the role's max_ttl.
C
Configure the role with a ttl of 1h.
The role-level ttl overrides the default lease TTL.
D
Use a periodic token with a period of 1h.
Why wrong: Periodic tokens are not appropriate for database credentials.

Question 2hardmultiple choice

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Trap 1: The request will be rejected because the requested TTL exceeds the…

The request is accepted, but the TTL is capped.

Trap 2: 48h

The user's requested TTL is capped by the role's ttl.

Trap 3: 72h

The mount default is overridden by the role's ttl.

A
The request will be rejected because the requested TTL exceeds the role's ttl.
Why wrong: The request is accepted, but the TTL is capped.
B
48h
Why wrong: The user's requested TTL is capped by the role's ttl.
C
24h
The role's ttl is the effective TTL when it is lower than the mount default.
D
72h
Why wrong: The mount default is overridden by the role's ttl.

Question 3easymulti select

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Trap 1: Creating a new lease

This increases the lease count.

Trap 2: Increasing the max lease TTL

This could allow longer leases, increasing count.

Trap 3: Renewing a lease

Renewal extends the lease, does not reduce count.

A
Reducing the default lease TTL
Shorter TTLs cause leases to expire faster, reducing count.
B
Revoking a lease
Revocation removes the lease immediately.
C
Creating a new lease
Why wrong: This increases the lease count.
D
Increasing the max lease TTL
Why wrong: This could allow longer leases, increasing count.
E
Renewing a lease
Why wrong: Renewal extends the lease, does not reduce count.

Question 4hardmultiple choice

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Exhibit

Refer to the exhibit.

```
$ vault read database/creds/my-role
Key                Value
---                -----
lease_id           database/creds/my-role/abc123...
lease_duration     1h
lease_renewable    true
password           ...
username           v-token-my-role-...

$ vault lease renew database/creds/my-role/abc123...
Key                Value
---                -----
lease_id           database/creds/my-role/abc123...
lease_duration     1h
lease_renewable    true
```

Trap 1: The lease is not renewable.

The output shows lease_renewable: true.

Trap 2: The mount's max_lease_ttl is set to 1h.

This could also limit renewal, but the role's max_ttl is more likely.

Trap 3: The developer does not have permission to renew the lease.

The renewal command succeeded, so permission is not an issue.

A
The lease is not renewable.
Why wrong: The output shows lease_renewable: true.
B
The mount's max_lease_ttl is set to 1h.
Why wrong: This could also limit renewal, but the role's max_ttl is more likely.
C
The developer does not have permission to renew the lease.
Why wrong: The renewal command succeeded, so permission is not an issue.
D
The role's max_ttl is set to 1h.
The role max_ttl caps the lease duration.

Question 5mediummultiple choice

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour. B. Increase the token TTL for the Kubernetes auth role to 1 hour. C. Implement a renewal loop in each service to renew tokens every 10 minutes. D. Use periodic tokens with a period of 1 hour for all services.

Trap 1: Increase the default lease TTL for the KV v2 mount to 1 hour.

This affects secret leases, not token leases.

Trap 2: Implement a renewal loop in each service to renew tokens every 10…

This adds complexity and may not fix the root cause if tasks exceed 15 minutes.

Trap 3: Use periodic tokens with a period of 1 hour for all services.

Periodic tokens can cause orphaned tokens and increase lease count.

A
Increase the default lease TTL for the KV v2 mount to 1 hour.
Why wrong: This affects secret leases, not token leases.
B
Increase the token TTL for the Kubernetes auth role to 1 hour.
Token TTL directly addresses the token expiration issue.
C
Implement a renewal loop in each service to renew tokens every 10 minutes.
Why wrong: This adds complexity and may not fix the root cause if tasks exceed 15 minutes.
D
Use periodic tokens with a period of 1 hour for all services.
Why wrong: Periodic tokens can cause orphaned tokens and increase lease count.

Question 6hardmultiple choice

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Trap 1: Remove the TTL entirely so that credentials never expire.

This violates security best practices.

Trap 2: Decrease the default lease TTL from 1 hour to 30 minutes.

This would increase renewal frequency, not decrease it.

Trap 3: Increase the maximum TTL for the role to 24 hours.

This increases the maximum possible lifetime but does not address renewal frequency; applications would still renew every hour.

A
Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.
A longer lease reduces renewal frequency, and periodic tokens ensure the overall lifetime is bounded.
B
Remove the TTL entirely so that credentials never expire.
Why wrong: This violates security best practices.
C
Decrease the default lease TTL from 1 hour to 30 minutes.
Why wrong: This would increase renewal frequency, not decrease it.
D
Increase the maximum TTL for the role to 24 hours.
Why wrong: This increases the maximum possible lifetime but does not address renewal frequency; applications would still renew every hour.

Question 7mediummulti select

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Trap 1: Call the sys/leases/list endpoint to disable a lease.

This endpoint lists leases but does not disable them.

Trap 2: Call the sys/leases/extend endpoint to increase the lease duration.

There is no such endpoint; renewal is done via sys/leases/renew.

Trap 3: Call the sys/leases/rotate endpoint to rotate the secret associated…

No such endpoint exists.

A
Call the sys/leases/renew endpoint to renew a lease.
Correct operation to renew a lease.
B
Call the sys/leases/list endpoint to disable a lease.
Why wrong: This endpoint lists leases but does not disable them.
C
Call the sys/leases/revoke endpoint to revoke a lease.
Correct operation to revoke a lease.
D
Call the sys/leases/extend endpoint to increase the lease duration.
Why wrong: There is no such endpoint; renewal is done via sys/leases/renew.
E
Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.
Why wrong: No such endpoint exists.

Question 8easymultiple choice

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Trap 1: Revoke the lease and request a new credential with a longer TTL.

Revoking the lease would immediately invalidate the credential.

Trap 2: Use the lease ID from the response to call sys/leases/renew…

This is correct but the developer needs to implement it; the option says 'use the lease ID' but does not specify renewal. The correct action is to renew.

Trap 3: Increase the TTL of the database role to 2 hours.

This only delays expiration; the application still needs to renew to keep the credential beyond the initial TTL.

A
Revoke the lease and request a new credential with a longer TTL.
Why wrong: Revoking the lease would immediately invalidate the credential.
B
Modify the application to renew the lease before it expires using the lease ID.
Renewing the lease extends its duration and prevents premature revocation.
C
Use the lease ID from the response to call sys/leases/renew periodically.
Why wrong: This is correct but the developer needs to implement it; the option says 'use the lease ID' but does not specify renewal. The correct action is to renew.
D
Increase the TTL of the database role to 2 hours.
Why wrong: This only delays expiration; the application still needs to renew to keep the credential beyond the initial TTL.

Question 9mediummultiple choice

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Trap 1: Set the default lease TTL on the database mount to 1 hour.

The default lease TTL applies to all secrets without a specific role TTL; but the role TTL overrides the default. Also, the default lease TTL is already 24h, but changing it to 1h would affect other roles that might need longer leases.

Trap 2: Increase the system's default lease TTL to 48 hours to give…

This would lengthen the lease duration, increasing the exposure window, which is the opposite of the goal.

Trap 3: Manually revoke leases after each application finishes using them.

Manual revocation is not scalable and prone to human error; automated TTL-based expiry is preferred.

A
Set the default lease TTL on the database mount to 1 hour.
Why wrong: The default lease TTL applies to all secrets without a specific role TTL; but the role TTL overrides the default. Also, the default lease TTL is already 24h, but changing it to 1h would affect other roles that might need longer leases.
B
Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.
This ensures each lease expires after 1 hour, and the explicit max TTL prevents any renewal beyond 2 hours, minimizing exposure.
C
Increase the system's default lease TTL to 48 hours to give applications more flexibility.
Why wrong: This would lengthen the lease duration, increasing the exposure window, which is the opposite of the goal.
D
Manually revoke leases after each application finishes using them.
Why wrong: Manual revocation is not scalable and prone to human error; automated TTL-based expiry is preferred.

Question 10hardmulti select

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Trap 1: The lease can be renewed indefinitely up to the system max TTL.

The explicit max TTL of 1 hour is a hard limit; renewal beyond that is not allowed.

Trap 2: The initial lease duration will be 15 minutes (the default lease…

The role TTL (30m) overrides the default lease TTL.

Trap 3: The lease duration is the minimum of default lease and role TTL.

The role TTL takes precedence over the default lease; it is not the minimum.

A
The initial lease duration will be 30 minutes (the role TTL).
The role TTL is used as the lease duration at creation time.
B
The lease can be renewed up to a total lifetime of 1 hour (explicit max TTL).
The explicit max TTL sets the maximum lifetime of the lease, including renewals.
C
The lease can be renewed indefinitely up to the system max TTL.
Why wrong: The explicit max TTL of 1 hour is a hard limit; renewal beyond that is not allowed.
D
The initial lease duration will be 15 minutes (the default lease TTL).
Why wrong: The role TTL (30m) overrides the default lease TTL.
E
The lease duration is the minimum of default lease and role TTL.
Why wrong: The role TTL takes precedence over the default lease; it is not the minimum.

Question 11mediumdrag order

Drag and drop the steps to configure Vault's audit logging to a file into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 12mediummatching

Match each Vault term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Encrypted state requiring unseal

Decrypt master key to access data

Encryption layer protecting storage

Key splitting for unseal

Superuser token with full access

Question 13hardmultiple choice

An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?

Trap 1: The secret engine caches credentials.

Vault does not cache database credentials after lease revocation.

Trap 2: The lease ID was incorrect.

An incorrect lease ID would result in no revocation, but the administrator revoked a specific lease, so the ID was likely correct.

Trap 3: The lease was renewed after revocation.

Once revoked, a lease cannot be renewed.

A
The revocation script failed to delete the database user.
If the revocation script fails, the credential remains despite lease revocation.
B
The secret engine caches credentials.
Why wrong: Vault does not cache database credentials after lease revocation.
C
The lease ID was incorrect.
Why wrong: An incorrect lease ID would result in no revocation, but the administrator revoked a specific lease, so the ID was likely correct.
D
The lease was renewed after revocation.
Why wrong: Once revoked, a lease cannot be renewed.

Question 14easymultiple choice

What command is used to view the remaining time on a lease?

Trap 1: vault lease info <lease_id>

No such command exists.

Trap 2: vault status <lease_id>

The 'vault status' command checks server health, not lease info.

Trap 3: vault read <lease_id>

The 'vault read' command is for reading secrets, not lease details.

A
vault lease lookup <lease_id>
This command shows lease information including TTL.
B
vault lease info <lease_id>
Why wrong: No such command exists.
C
vault status <lease_id>
Why wrong: The 'vault status' command checks server health, not lease info.
D
vault read <lease_id>
Why wrong: The 'vault read' command is for reading secrets, not lease details.

Question 15hardmultiple choice

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Trap 1: Upstream error

Upstream errors are related to backend issues, not sealing.

Trap 2: Permission denied

Permission errors occur when the token lacks capabilities, not due to sealing.

Trap 3: Lease not found

Lease not found occurs if the lease ID is invalid or expired, not due to sealing.

A
Vault is sealed
Vault returns an error indicating it is sealed when trying to perform operations.
B
Upstream error
Why wrong: Upstream errors are related to backend issues, not sealing.
C
Permission denied
Why wrong: Permission errors occur when the token lacks capabilities, not due to sealing.
D
Lease not found
Why wrong: Lease not found occurs if the lease ID is invalid or expired, not due to sealing.

Question 16mediummultiple choice

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Trap 1: Set the lease TTL to infinite.

Lease TTL cannot be infinite; there is always a maximum.

Trap 2: Use a cron job to call vault lease renew periodically.

While possible, it is not recommended due to complexity and reliability issues.

Trap 3: Use periodic tokens with auto-renewal.

Periodic tokens are for token renewal, not secret lease renewal.

A
Set the lease TTL to infinite.
Why wrong: Lease TTL cannot be infinite; there is always a maximum.
B
Use a cron job to call vault lease renew periodically.
Why wrong: While possible, it is not recommended due to complexity and reliability issues.
C
Use Vault agent with a template and renew capability.
Vault Agent is designed for automatic lifecycle management of leases.
D
Use periodic tokens with auto-renewal.
Why wrong: Periodic tokens are for token renewal, not secret lease renewal.

Question 17easymultiple choice

Which of the following best describes a Vault lease?

Trap 1: A permission to access a path.

Permissions are defined by policies, not leases.

Trap 2: A contract to use a secret for a certain duration.

This is a partial description but not the most accurate; leases also include renewal and revocation.

Trap 3: The actual secret value.

The secret value is separate from the lease.

A
A permission to access a path.
Why wrong: Permissions are defined by policies, not leases.
B
A time-limited agreement that governs the lifecycle of a secret.
This accurately describes a lease as a time-bound contract for secret usage.
C
A contract to use a secret for a certain duration.
Why wrong: This is a partial description but not the most accurate; leases also include renewal and revocation.
D
The actual secret value.
Why wrong: The secret value is separate from the lease.

Question 18mediummultiple choice

An operator runs vault lease list and sees many expired leases. Why are expired leases still listed?

Trap 1: The leases are not actually expired.

The operator observed expired leases, so they are expired.

Trap 2: The operator has a permission to see expired leases.

All listed leases are visible regardless of expiration status.

Trap 3: Expired leases are never removed.

Vault removes expired leases eventually via garbage collection.

A
The leases are not actually expired.
Why wrong: The operator observed expired leases, so they are expired.
B
The operator has a permission to see expired leases.
Why wrong: All listed leases are visible regardless of expiration status.
C
Vault keeps expired leases for auditing until cleaned up by garbage collection.
Expired leases remain in storage until garbage collection runs.
D
Expired leases are never removed.
Why wrong: Vault removes expired leases eventually via garbage collection.

Question 19easymultiple choice

What happens when a lease reaches its TTL?

Trap 1: The lease is marked as expired and can no longer be renewed.

Correct but not the only effect; the lease is also removed from active leases.

Trap 2: The lease is automatically renewed.

Leases are not renewed automatically; renewal must be requested.

Trap 3: The secret is automatically revoked.

Lease expiration does not automatically revoke the underlying secret.

A
The lease is marked as expired and can no longer be renewed.
Why wrong: Correct but not the only effect; the lease is also removed from active leases.
B
The lease is automatically renewed.
Why wrong: Leases are not renewed automatically; renewal must be requested.
C
The secret is automatically revoked.
Why wrong: Lease expiration does not automatically revoke the underlying secret.
D
The lease is deleted from storage.
Upon expiration, the lease is eventually garbage-collected, but immediate effect is expiration.

Question 20mediummultiple choice

A security policy requires that all leases must be revoked within 1 hour of creation. Which setting should be configured on the secret engine mount?

Trap 1: default_lease_ttl = 1h

Without max, renewals could extend the lease beyond 1h.

Trap 2: token_ttl = 1h

Token TTL affects token lifecycle, not secret lease TTL.

Trap 3: max_lease_ttl = 1h

Without default_lease_ttl, the initial TTL may be longer than 1h.

A
default_lease_ttl = 1h
Why wrong: Without max, renewals could extend the lease beyond 1h.
B
token_ttl = 1h
Why wrong: Token TTL affects token lifecycle, not secret lease TTL.
C
max_lease_ttl = 1h
Why wrong: Without default_lease_ttl, the initial TTL may be longer than 1h.
D
default_lease_ttl = 1h and max_lease_ttl = 1h
This combination caps the lease at 1h and ensures initial TTL is 1h.