Manage Vault leases practice questions

Which of the following commands would force a lease to expire immediately?

Trap 1: vault lease renew -increment=0 <lease_id>

Incorrect. `vault lease renew -increment=0` attempts to renew with zero increment, which is not a valid way to force expiration; it may result in an error.

Trap 2: vault lease expire <lease_id>

Incorrect. `vault lease expire` is not a valid Vault command.

A
vault lease renew -increment=0 <lease_id>
Why wrong: Incorrect. `vault lease renew -increment=0` attempts to renew with zero increment, which is not a valid way to force expiration; it may result in an error.
B
vault lease revoke <lease_id>
Correct. `vault lease revoke <lease_id>` immediately revokes the lease, forcing it to expire.
C
vault lease expire <lease_id>
Why wrong: Incorrect. `vault lease expire` is not a valid Vault command.
D
vault write sys/leases/revoke-lease lease_id=<lease_id>
Correct. The `sys/leases/revoke-lease` endpoint immediately revokes the lease, forcing it to expire.

Question 2mediummultiple choice

A DevOps team is using Vault's database secrets engine to generate dynamic credentials for a PostgreSQL database. They notice that the lease duration is set to 24 hours, but security policy requires that credentials expire after 1 hour. What should the team do to enforce the 1-hour expiration without changing the default lease TTL for all secrets?

Trap 1: Set the mount's max_lease_ttl to 1h.

This would affect all secrets from this mount, not just database credentials.

Trap 2: Ask each developer to set the TTL when requesting credentials.

Users can request a TTL, but it is capped by the role's max_ttl.

Trap 3: Use a periodic token with a period of 1h.

Periodic tokens are not appropriate for database credentials.

A
Set the mount's max_lease_ttl to 1h.
Why wrong: This would affect all secrets from this mount, not just database credentials.
B
Ask each developer to set the TTL when requesting credentials.
Why wrong: Users can request a TTL, but it is capped by the role's max_ttl.
C
Configure the role with a ttl of 1h.
The role-level ttl overrides the default lease TTL.
D
Use a periodic token with a period of 1h.
Why wrong: Periodic tokens are not appropriate for database credentials.

Question 3hardmultiple choice

An organization uses Vault to issue certificates via the PKI secrets engine. They have set the default lease TTL on the PKI mount to 72h, and the role's ttl to 24h. A user requests a certificate with a requested TTL of 48h. What will be the actual TTL of the issued certificate?

Trap 1: The request will be rejected because the requested TTL exceeds the…

The request is accepted, but the TTL is capped.

Trap 2: 48h

The user's requested TTL is capped by the role's ttl.

Trap 3: 72h

The mount default is overridden by the role's ttl.

A
The request will be rejected because the requested TTL exceeds the role's ttl.
Why wrong: The request is accepted, but the TTL is capped.
B
48h
Why wrong: The user's requested TTL is capped by the role's ttl.
C
24h
The role's ttl is the effective TTL when it is lower than the mount default.
D
72h
Why wrong: The mount default is overridden by the role's ttl.

Question 4easymulti select

Which TWO of the following actions can reduce the number of active leases in Vault? (Select two.)

Trap 1: Creating a new lease

This increases the lease count.

Trap 2: Increasing the max lease TTL

This could allow longer leases, increasing count.

Trap 3: Renewing a lease

Renewal extends the lease, does not reduce count.

A
Reducing the default lease TTL
Shorter TTLs cause leases to expire faster, reducing count.
B
Revoking a lease
Revocation removes the lease immediately.
C
Creating a new lease
Why wrong: This increases the lease count.
D
Increasing the max lease TTL
Why wrong: This could allow longer leases, increasing count.
E
Renewing a lease
Why wrong: Renewal extends the lease, does not reduce count.

Question 5hardmultiple choice

A developer runs the commands shown in the exhibit. After renewing the lease, the lease_duration remains 1 hour. What is the most likely reason?

Exhibit

Refer to the exhibit.

```
$ vault read database/creds/my-role
Key                Value
---                -----
lease_id           database/creds/my-role/abc123...
lease_duration     1h
lease_renewable    true
password           ...
username           v-token-my-role-...

$ vault lease renew database/creds/my-role/abc123...
Key                Value
---                -----
lease_id           database/creds/my-role/abc123...
lease_duration     1h
lease_renewable    true
```

Trap 1: The lease is not renewable.

The output shows lease_renewable: true.

Trap 2: The mount's max_lease_ttl is set to 1h.

This could also limit renewal, but the role's max_ttl is more likely.

Trap 3: The developer does not have permission to renew the lease.

The renewal command succeeded, so permission is not an issue.

A
The lease is not renewable.
Why wrong: The output shows lease_renewable: true.
B
The mount's max_lease_ttl is set to 1h.
Why wrong: This could also limit renewal, but the role's max_ttl is more likely.
C
The developer does not have permission to renew the lease.
Why wrong: The renewal command succeeded, so permission is not an issue.
D
The role's max_ttl is set to 1h.
The role max_ttl caps the lease duration.

Question 6mediummultiple choice

A company runs a microservices application on Kubernetes. Each service authenticates to Vault using the Kubernetes auth method and obtains a short-lived token with a TTL of 15 minutes. The services use these tokens to read secrets from the KV v2 secrets engine. Recently, the operations team noticed that Vault's lease count has been steadily increasing, and some services are experiencing 'lease not found' errors when trying to renew their tokens. Investigation reveals that the services are not renewing tokens before they expire because the token TTL is too short to complete some long-running tasks. The team wants to fix the issue without compromising security. They are considering the following actions:

A. Increase the default lease TTL for the KV v2 mount to 1 hour. B. Increase the token TTL for the Kubernetes auth role to 1 hour. C. Implement a renewal loop in each service to renew tokens every 10 minutes. D. Use periodic tokens with a period of 1 hour for all services.

Trap 1: Increase the default lease TTL for the KV v2 mount to 1 hour.

This affects secret leases, not token leases.

Trap 2: Implement a renewal loop in each service to renew tokens every 10…

This adds complexity and may not fix the root cause if tasks exceed 15 minutes.

Trap 3: Use periodic tokens with a period of 1 hour for all services.

Periodic tokens can cause orphaned tokens and increase lease count.

A
Increase the default lease TTL for the KV v2 mount to 1 hour.
Why wrong: This affects secret leases, not token leases.
B
Increase the token TTL for the Kubernetes auth role to 1 hour.
Token TTL directly addresses the token expiration issue.
C
Implement a renewal loop in each service to renew tokens every 10 minutes.
Why wrong: This adds complexity and may not fix the root cause if tasks exceed 15 minutes.
D
Use periodic tokens with a period of 1 hour for all services.
Why wrong: Periodic tokens can cause orphaned tokens and increase lease count.

Question 7hardmultiple choice

A DevOps team uses Vault dynamic secrets for database credentials with a lease of 1 hour. They notice that applications are making excessive calls to renew leases, causing performance issues. The team wants to reduce the renewal frequency while maintaining security. What is the best approach?

Trap 1: Remove the TTL entirely so that credentials never expire.

This violates security best practices.

Trap 2: Decrease the default lease TTL from 1 hour to 30 minutes.

This would increase renewal frequency, not decrease it.

Trap 3: Increase the maximum TTL for the role to 24 hours.

This increases the maximum possible lifetime but does not address renewal frequency; applications would still renew every hour.

A
Increase the default lease TTL to 8 hours and configure periodic tokens with a short TTL.
A longer lease reduces renewal frequency, and periodic tokens ensure the overall lifetime is bounded.
B
Remove the TTL entirely so that credentials never expire.
Why wrong: This violates security best practices.
C
Decrease the default lease TTL from 1 hour to 30 minutes.
Why wrong: This would increase renewal frequency, not decrease it.
D
Increase the maximum TTL for the role to 24 hours.
Why wrong: This increases the maximum possible lifetime but does not address renewal frequency; applications would still renew every hour.

Question 8mediummulti select

A Vault administrator needs to manage leases for dynamic secrets. Which TWO of the following are valid operations related to lease management?

Trap 1: Call the sys/leases/list endpoint to disable a lease.

This endpoint lists leases but does not disable them.

Trap 2: Call the sys/leases/extend endpoint to increase the lease duration.

There is no such endpoint; renewal is done via sys/leases/renew.

Trap 3: Call the sys/leases/rotate endpoint to rotate the secret associated…

No such endpoint exists.

A
Call the sys/leases/renew endpoint to renew a lease.
Correct operation to renew a lease.
B
Call the sys/leases/list endpoint to disable a lease.
Why wrong: This endpoint lists leases but does not disable them.
C
Call the sys/leases/revoke endpoint to revoke a lease.
Correct operation to revoke a lease.
D
Call the sys/leases/extend endpoint to increase the lease duration.
Why wrong: There is no such endpoint; renewal is done via sys/leases/renew.
E
Call the sys/leases/rotate endpoint to rotate the secret associated with a lease.
Why wrong: No such endpoint exists.

Question 9easymultiple choice

A developer is troubleshooting an application that uses Vault's PostgreSQL secrets engine. The application successfully obtains a database credential from Vault, but after 30 minutes, the application starts receiving authentication errors from the database. The developer checks the Vault audit logs and sees that the lease for the credential was revoked. The lease was originally created with a TTL of 1 hour. The application is not renewing the lease. The developer wants to fix the issue so that the credential works for the full 1 hour. What should the developer do?

Trap 1: Revoke the lease and request a new credential with a longer TTL.

Incorrect. Revoking the lease and requesting a new credential with a longer TTL does not solve the root cause; the application must renew the lease to maintain the credential for its full duration.

Trap 2: Increase the TTL of the database role to 2 hours.

Incorrect. Increasing the role's TTL only extends the maximum lease duration; it does not eliminate the need for the client to renew the lease.

A
Revoke the lease and request a new credential with a longer TTL.
Why wrong: Incorrect. Revoking the lease and requesting a new credential with a longer TTL does not solve the root cause; the application must renew the lease to maintain the credential for its full duration.
B
Modify the application to renew the lease before it expires using the lease ID.
Correct. The application must actively renew the lease using its lease ID before the lease expires to avoid authentication errors.
C
Use the lease ID from the response to call sys/leases/renew periodically.
Correct. Calling `sys/leases/renew` periodically with the lease ID is a valid method to renew the lease, provided the renewal occurs before the TTL expires.
D
Increase the TTL of the database role to 2 hours.
Why wrong: Incorrect. Increasing the role's TTL only extends the maximum lease duration; it does not eliminate the need for the client to renew the lease.

Question 10mediummultiple choice

A company uses Vault to manage database credentials for its applications. The applications request a one-hour TTL for database secrets, but the database engine's default lease TTL is set to 24 hours. The Vault administrator wants to ensure that leases are revoked promptly after the applications finish using them, to minimize the window of exposure. Which approach best achieves this goal?

Trap 1: Set the default lease TTL on the database mount to 1 hour.

The default lease TTL applies to all secrets without a specific role TTL; but the role TTL overrides the default. Also, the default lease TTL is already 24h, but changing it to 1h would affect other roles that might need longer leases.

Trap 2: Increase the system's default lease TTL to 48 hours to give…

This would lengthen the lease duration, increasing the exposure window, which is the opposite of the goal.

Trap 3: Manually revoke leases after each application finishes using them.

Manual revocation is not scalable and prone to human error; automated TTL-based expiry is preferred.

A
Set the default lease TTL on the database mount to 1 hour.
Why wrong: The default lease TTL applies to all secrets without a specific role TTL; but the role TTL overrides the default. Also, the default lease TTL is already 24h, but changing it to 1h would affect other roles that might need longer leases.
B
Configure the database role with a TTL of 1 hour and an explicit max TTL of 2 hours.
This ensures each lease expires after 1 hour, and the explicit max TTL prevents any renewal beyond 2 hours, minimizing exposure.
C
Increase the system's default lease TTL to 48 hours to give applications more flexibility.
Why wrong: This would lengthen the lease duration, increasing the exposure window, which is the opposite of the goal.
D
Manually revoke leases after each application finishes using them.
Why wrong: Manual revocation is not scalable and prone to human error; automated TTL-based expiry is preferred.

Question 11hardmulti select

An organization uses Vault's AWS secrets engine to generate temporary IAM credentials. The Vault administrator has set the default lease TTL on the AWS mount to 15 minutes. A developer creates a role with role TTL of 30 minutes and explicit max TTL of 1 hour. Which TWO statements are true regarding the lease behavior for credentials generated under this role?

Trap 1: The lease can be renewed indefinitely up to the system max TTL.

The explicit max TTL of 1 hour is a hard limit; renewal beyond that is not allowed.

Trap 2: The initial lease duration will be 15 minutes (the default lease…

The role TTL (30m) overrides the default lease TTL.

Trap 3: The lease duration is the minimum of default lease and role TTL.

The role TTL takes precedence over the default lease; it is not the minimum.

A
The initial lease duration will be 30 minutes (the role TTL).
The role TTL is used as the lease duration at creation time.
B
The lease can be renewed up to a total lifetime of 1 hour (explicit max TTL).
The explicit max TTL sets the maximum lifetime of the lease, including renewals.
C
The lease can be renewed indefinitely up to the system max TTL.
Why wrong: The explicit max TTL of 1 hour is a hard limit; renewal beyond that is not allowed.
D
The initial lease duration will be 15 minutes (the default lease TTL).
Why wrong: The role TTL (30m) overrides the default lease TTL.
E
The lease duration is the minimum of default lease and role TTL.
Why wrong: The role TTL takes precedence over the default lease; it is not the minimum.

Question 12mediumdrag order

Drag and drop the steps to configure Vault's audit logging to a file into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Perform operations to generate log entries, then enable audit…

This is incorrect because you cannot generate audit logs before enabling an audit device; the audit device must be enabled first for Vault to record operations.

Trap 2: Verify audit log, then enable audit device, then perform operations…

This is incorrect because verification requires existing log entries, which cannot occur before enabling the audit device and performing operations.

Trap 3: Enable audit device, then verify the audit log, then perform…

This is incorrect because verifying immediately after enabling, before any operations, would yield no log entries, making verification futile.

A
Enable audit device, then perform operations to generate log entries, then verify the audit log.
This is the correct order because the audit device must be enabled first so that Vault can record operations. Then, performing operations generates log entries. Finally, verification checks that the logs are being written correctly.
B
Perform operations to generate log entries, then enable audit device, then verify the audit log.
Why wrong: This is incorrect because you cannot generate audit logs before enabling an audit device; the audit device must be enabled first for Vault to record operations.
C
Verify audit log, then enable audit device, then perform operations to generate log entries.
Why wrong: This is incorrect because verification requires existing log entries, which cannot occur before enabling the audit device and performing operations.
D
Enable audit device, then verify the audit log, then perform operations to generate log entries.
Why wrong: This is incorrect because verifying immediately after enabling, before any operations, would yield no log entries, making verification futile.

Question 13mediummatching

Match each Vault term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Encrypted state requiring unseal

Decrypt master key to access data

Encryption layer protecting storage

Key splitting for unseal

Superuser token with full access

Trap 1: Policy: A method used to authenticate a user or machine to Vault

Incorrect: This describes an auth method, not a policy. Policies define access rules.

Trap 2: Auth Method: A set of rules defining access permissions in Vault

Incorrect: This describes a policy, not an auth method. Auth methods handle authentication.

A
Secret: A piece of sensitive data stored in Vault
Correct: A secret is any sensitive data like passwords or API keys stored in Vault.
B
Token: A credential used to authenticate to Vault
Correct: Tokens are the primary method of authentication to Vault.
C
Policy: A method used to authenticate a user or machine to Vault
Why wrong: Incorrect: This describes an auth method, not a policy. Policies define access rules.
D
Auth Method: A set of rules defining access permissions in Vault
Why wrong: Incorrect: This describes a policy, not an auth method. Auth methods handle authentication.

Question 14hardmultiple choice

An administrator notices that after revoking a specific lease, the underlying database credential is still accessible. What is the most likely cause?

Trap 1: The secret engine caches credentials.

Vault does not cache database credentials after lease revocation.

Trap 2: The lease ID was incorrect.

An incorrect lease ID would result in no revocation, but the administrator revoked a specific lease, so the ID was likely correct.

Trap 3: The lease was renewed after revocation.

Once revoked, a lease cannot be renewed.

A
The revocation script failed to delete the database user.
If the revocation script fails, the credential remains despite lease revocation.
B
The secret engine caches credentials.
Why wrong: Vault does not cache database credentials after lease revocation.
C
The lease ID was incorrect.
Why wrong: An incorrect lease ID would result in no revocation, but the administrator revoked a specific lease, so the ID was likely correct.
D
The lease was renewed after revocation.
Why wrong: Once revoked, a lease cannot be renewed.

Question 15easymultiple choice

What command is used to view the remaining time on a lease?

Trap 1: vault lease info <lease_id>

No such command exists.

Trap 2: vault status <lease_id>

The 'vault status' command checks server health, not lease info.

Trap 3: vault read <lease_id>

The 'vault read' command is for reading secrets, not lease details.

A
vault lease lookup <lease_id>
This command shows lease information including TTL.
B
vault lease info <lease_id>
Why wrong: No such command exists.
C
vault status <lease_id>
Why wrong: The 'vault status' command checks server health, not lease info.
D
vault read <lease_id>
Why wrong: The 'vault read' command is for reading secrets, not lease details.

Question 16hardmultiple choice

A Vault cluster is sealed. An operator attempts to renew a lease but gets an error. What is the most likely error?

Trap 1: Upstream error

Upstream errors are related to backend issues, not sealing.

Trap 2: Permission denied

Permission errors occur when the token lacks capabilities, not due to sealing.

Trap 3: Lease not found

Lease not found occurs if the lease ID is invalid or expired, not due to sealing.

A
Vault is sealed
Vault returns an error indicating it is sealed when trying to perform operations.
B
Upstream error
Why wrong: Upstream errors are related to backend issues, not sealing.
C
Permission denied
Why wrong: Permission errors occur when the token lacks capabilities, not due to sealing.
D
Lease not found
Why wrong: Lease not found occurs if the lease ID is invalid or expired, not due to sealing.

Question 17mediummultiple choice

A developer wants to ensure that their application automatically renews its secret leases before expiration. Which approach is recommended?

Trap 1: Set the lease TTL to infinite.

Lease TTL cannot be infinite; there is always a maximum.

Trap 2: Use a cron job to call vault lease renew periodically.

While possible, it is not recommended due to complexity and reliability issues.

Trap 3: Use periodic tokens with auto-renewal.

Periodic tokens are for token renewal, not secret lease renewal.

A
Set the lease TTL to infinite.
Why wrong: Lease TTL cannot be infinite; there is always a maximum.
B
Use a cron job to call vault lease renew periodically.
Why wrong: While possible, it is not recommended due to complexity and reliability issues.
C
Use Vault agent with a template and renew capability.
Vault Agent is designed for automatic lifecycle management of leases.
D
Use periodic tokens with auto-renewal.
Why wrong: Periodic tokens are for token renewal, not secret lease renewal.

Question 18easymultiple choice

Which of the following best describes a Vault lease?

Trap 1: A permission to access a path.

Permissions are defined by policies, not leases.

Trap 2: A contract to use a secret for a certain duration.

This is a partial description but not the most accurate; leases also include renewal and revocation.

Trap 3: The actual secret value.

The secret value is separate from the lease.

A
A permission to access a path.
Why wrong: Permissions are defined by policies, not leases.
B
A time-limited agreement that governs the lifecycle of a secret.
This accurately describes a lease as a time-bound contract for secret usage.
C
A contract to use a secret for a certain duration.
Why wrong: This is a partial description but not the most accurate; leases also include renewal and revocation.
D
The actual secret value.
Why wrong: The secret value is separate from the lease.

Question 19mediummultiple choice

An operator runs vault lease list and sees many expired leases. Why are expired leases still listed?

Trap 1: The leases are not actually expired.

The operator observed expired leases, so they are expired.

Trap 2: The operator has a permission to see expired leases.

All listed leases are visible regardless of expiration status.

Trap 3: Expired leases are never removed.

Vault removes expired leases eventually via garbage collection.

A
The leases are not actually expired.
Why wrong: The operator observed expired leases, so they are expired.
B
The operator has a permission to see expired leases.
Why wrong: All listed leases are visible regardless of expiration status.
C
Vault keeps expired leases for auditing until cleaned up by garbage collection.
Expired leases remain in storage until garbage collection runs.
D
Expired leases are never removed.
Why wrong: Vault removes expired leases eventually via garbage collection.

Question 20easymultiple choice

What happens when a lease reaches its TTL?

Trap 1: The lease is automatically renewed.

Incorrect. Vault does not automatically renew leases. Renewal requires explicit action by the client.

Trap 2: The secret is automatically revoked.

Incorrect. The lease expiring does not automatically revoke the underlying secret; revocation is a separate process.

Trap 3: The lease is deleted from storage.

Incorrect. The lease is not immediately deleted from storage upon expiry. It remains until garbage collection occurs.

A
The lease is marked as expired and can no longer be renewed.
Correct. The lease is marked as expired and can no longer be renewed. This is the accurate description of what happens when a lease reaches its TTL.
B
The lease is automatically renewed.
Why wrong: Incorrect. Vault does not automatically renew leases. Renewal requires explicit action by the client.
C
The secret is automatically revoked.
Why wrong: Incorrect. The lease expiring does not automatically revoke the underlying secret; revocation is a separate process.
D
The lease is deleted from storage.
Why wrong: Incorrect. The lease is not immediately deleted from storage upon expiry. It remains until garbage collection occurs.