VA-003 Manage Vault leases Practice Question
Which of the following factors determine the actual TTL of a lease issued by a secrets engine? (Choose three.)
⚠ Common exam trap
Watch out — candidates often assume the requesting token's TTL directly controls the lease TTL, but Vault decouples token and lease lifetimes, using the role and system settings as the authoritative source.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The system's max_lease_ttl configuration
The actual TTL of a lease issued by a secrets engine is determined by the minimum of three values: the role's `default_ttl`, the role's `max_ttl`, and the system's `max_lease_ttl` configuration. The system's `max_lease_ttl` acts as a hard upper bound that cannot be exceeded by any lease, regardless of role settings. This ensures that even if a role has a longer `default_ttl`, the system-wide limit will cap the lease duration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The system's max_lease_ttl configuration
Why this is correct
Global maximum TTL for all leases.
- ✗
The requesting token's TTL
Why it's wrong here
Token TTL does not affect lease TTL.
- ✓
The role's default_ttl
Why this is correct
Sets the initial TTL for the lease.
- ✗
The backend's rotation period
Why it's wrong here
Rotation period is for periodic password changes, not lease TTL.
- ✓
The role's max_ttl
Why this is correct
Caps the total lifespan of the lease, including renewals.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.