HashiCorpAssociate levelPage 2 of 3

HashiCorp Vault Associate (003) exam dumps: questions 101 to 200 of 243

Page 2 of the free HashiCorp Vault Associate (003) question bank for the Vault Associate (003) exam. Questions 101 to 200 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated June 2026

Start timed practice exam Questions 101 to 200

Free HashiCorp Vault Associate (003) practice questions

Questions 101 to 105 of 243

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

HashiCorp Vault Associate (003) Question 101

Single answer4 Vault leases

A team uses Vault's database secrets engine to generate short-lived PostgreSQL credentials for an application. The app authenticates with AppRole, reads database credentials, and stores the returned username/password in memory. After several hours, the app begins failing to connect to the database because the generated credentials have expired. The team wants the application to keep using dynamically generated credentials without manual intervention and without increasing the role's TTLs. Which approach is the most appropriate?

A
Have the application renew the lease for the generated database credentials before the lease expires, and handle cases where renewal is not allowed by fetching new credentials
B
Renew the AppRole Secret ID lease only, because renewing the authentication material automatically extends all secret leases created by that client
C
Increase the token TTL on the AppRole login token, because secret leases inherit their lifetime from the client token and will extend automatically
D
Tune the database secrets engine mount with a longer default_lease_ttl so existing issued credentials become renewable for a longer period

Show answer and explanation

Correct answer: A

Explanation

Vault leases are central to how dynamic secrets are managed. When a secrets engine such as the database secrets engine issues credentials, Vault returns lease metadata including a lease ID, duration, and whether the lease is renewable. For long-running applications, best practice is to renew renewable leases before expiration and to be prepared to fetch a new secret if renewal is denied or unsupported. This is distinct from token renewal: renewing an auth token or AppRole Secret ID does not automatically renew dynamic secret leases. Likewise, changing mount TTL settings is not a retroactive fix for already-issued credentials and would not meet the requirement to avoid longer TTLs. HashiCorp Vault documentation for leases, lease renewal, and dynamic secrets emphasizes explicit lease lifecycle management by the client or by Vault Agent patterns where appropriate.

A. Correct.
Correct. Dynamic secrets such as database credentials are returned with a lease. The client should track the lease duration and renew the lease before it expires when the backend supports renewal. If the lease is not renewable or renewal fails, the correct fallback is to request a fresh set of credentials and update the application to use them. This is the practical pattern for long-running applications that rely on leased dynamic secrets.
B. Incorrect.
Incorrect. Secret ID is part of AppRole authentication, not the lease on the generated database credentials. Renewing or replacing authentication material does not automatically renew unrelated secret leases. Secret leases must be renewed directly, and some may not be renewable depending on backend behavior and lease settings.
C. Incorrect.
Incorrect. A client token's lifetime and a secret's lease are related operationally, but renewing the token does not automatically renew every leased secret obtained with that token. Dynamic secrets have their own lease IDs and renewal semantics. The application must explicitly renew the secret lease or request new credentials.
D. Incorrect.
Incorrect. Mount tuning affects leases issued after the change, not credentials that have already been issued. Also, making the mount's default TTL longer is contrary to the scenario requirement to avoid increasing TTLs. It does not solve the need for ongoing lease management in the application.

HashiCorp Vault Associate (003) Question 102

Single answer4 Vault leases

A team uses Vault's database secrets engine to generate short-lived PostgreSQL credentials for an internal reporting application. The application authenticates to Vault, reads dynamic credentials, and stores the returned username, password, and lease ID. During a deployment issue, the application instances are terminated unexpectedly before they can clean up. The security team wants the old database credentials invalidated as soon as possible rather than waiting for the full TTL to expire. Which action should an operator take in Vault to address this situation?

A
Revoke the specific lease IDs for the issued database credentials
B
Renew the leases so Vault can immediately rotate the database passwords
C
Delete the database role configuration so all existing credentials are instantly removed from the database
D
Disable the auth method used by the application so Vault automatically revokes all previously issued database credentials

Show answer and explanation

Correct answer: A

Explanation

Vault leases track the lifetime of many dynamically generated secrets, including database credentials from the database secrets engine. If a client cannot perform normal cleanup, an operator can revoke the lease to trigger immediate revocation of the underlying secret rather than waiting for the lease to expire naturally. This reflects a core Vault best practice: use renewal to extend access when still needed, and use revocation to invalidate access early. In Vault documentation, lease management centers on TTLs, renewal, and revocation, and dynamic secret engines commonly implement revocation by deleting or disabling the generated credential in the target system.

A. Correct.
Correct. Dynamic secrets issued by the database secrets engine are associated with leases. Revoking a lease tells Vault to perform the secret engine's revocation action, which for database credentials typically means removing or disabling the generated database user immediately. This is the correct operational response when you know the affected lease IDs and want to invalidate those credentials before their TTL expires.
B. Incorrect.
Incorrect. Renewing a lease extends its validity period; it does not invalidate the secret. An operator might choose this option because lease renewal is a common lease operation, but it has the opposite effect here: it would keep the credentials valid longer, not shorten their lifetime.
C. Incorrect.
Incorrect. Deleting the database role affects future credential generation and may disrupt applications, but it is not the targeted way to immediately revoke already issued leased credentials. Existing dynamic secrets are managed through their leases and should be revoked directly when possible.
D. Incorrect.
Incorrect. Disabling an auth method impacts authentication via that method, not necessarily the lifecycle of secrets already issued by another secrets engine. A common misconception is that auth tokens and secret leases are the same thing. While tokens can be revoked and token revocation can affect child tokens, disabling an auth method is not the appropriate mechanism for directly revoking previously issued database dynamic secret leases.

HashiCorp Vault Associate (003) Question 103

Single answer4 Vault leases

A platform team uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an internal reporting service. The service authenticates to Vault with AppRole, reads database credentials, and then runs long-lived jobs that can last several hours. Recently, jobs have started failing because the database username created by Vault disappears before the job completes. The team wants the application to keep using dynamic credentials but avoid manual operator intervention. Which action is the BEST solution?

A
Have the application renew the lease for the dynamic database credentials before the lease expires, up to the role or mount maximum TTL
B
Increase the AppRole token TTL only, because the database credentials lease automatically extends whenever the client token is still valid
C
Convert the database role from dynamic credentials to static credentials, because only static credentials support renewal for long-running jobs
D
Use a periodic token for AppRole and assume all secrets read with that token will remain valid as long as the periodic token is renewed

Show answer and explanation

Correct answer: A

Explanation

In Vault, leases control the lifetime of many dynamically generated secrets, such as credentials from the database secrets engine. A client token and a secret lease are separate objects with separate TTLs. If an application needs a dynamic secret longer than its initial TTL, the correct operational pattern is to renew the secret's lease before expiration, assuming the lease is renewable and has not reached a configured maximum TTL. If the lease is allowed to expire, Vault revokes the secret, which for database credentials commonly means deleting or disabling the generated username. This scenario tests the important distinction between token renewal and secret lease renewal. Vault documentation for leases, token concepts, and dynamic secrets emphasizes that secret leases must be managed explicitly and are constrained by backend and role TTL settings.

A. Correct.
Correct. Dynamic secrets issued by Vault, including database credentials, are associated with a lease. If the secret is renewable, the client should renew that lease before it expires. Renewal extends the lease only within the limits configured by the secrets engine, mount, and role settings such as max TTL. This is the standard way for an application to keep leased dynamic credentials valid during long-running work.
B. Incorrect.
Incorrect. A valid client token does not automatically renew the lease on a secret that was previously issued. Token lifetime and secret lease lifetime are related but distinct concepts in Vault. If the database credentials have their own lease and TTL, that lease must be renewed separately if renewable. Raising only the AppRole token TTL may prevent token expiration, but it will not by itself keep the database username from being revoked when its lease expires.
C. Incorrect.
Incorrect. Static credentials are not the best solution here because the requirement is to continue using dynamic credentials. Dynamic database credentials are specifically designed for this use case, and lease renewal is the appropriate mechanism when jobs outlast the initial TTL. Choosing static credentials would reduce the benefits of ephemeral, automatically revoked access.
D. Incorrect.
Incorrect. Periodic tokens can be renewed indefinitely if the holder continues renewing them, but that behavior applies to the token, not to every leased secret obtained with it. Dynamic secrets such as database credentials still have their own leases and renewal behavior. Renewing a periodic token does not automatically make those secret leases indefinite.

HashiCorp Vault Associate (003) Question 104

Single answer4 Vault leases

A team uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an internal reporting application. The security team wants those credentials to stop working immediately when the application is decommissioned, instead of waiting for the lease TTL to expire. An operator has the lease ID returned when the credentials were issued. What is the most appropriate action to meet this requirement?

A
Revoke the specific lease using Vault's lease revocation API or CLI so Vault runs the database secrets engine's cleanup for that credential
B
Reduce the auth token TTL for the application so the database username and password are deleted automatically before their lease expires
C
Seal the Vault cluster so all active leases are invalidated and the database secrets engine removes the generated user
D
Delete the database secrets engine mount configuration so existing dynamic credentials are immediately removed from PostgreSQL

Show answer and explanation

Correct answer: A

Explanation

Vault leases are central to dynamic secrets. When a secrets engine like the database secrets engine issues credentials, Vault returns a lease ID and TTL. If the secret should no longer be valid before the TTL ends, the correct operational response is to revoke that lease. On revocation, Vault calls the secrets engine's revocation logic to clean up the external resource, such as dropping the generated database user. This is more precise and safer than changing mount settings, sealing Vault, or manipulating token TTLs. HashiCorp Vault documentation on leases, lease revoke operations, and dynamic secrets best practices emphasizes using lease revocation for immediate invalidation of issued secrets.

A. Correct.
Correct. Dynamic secrets issued by engines such as the database secrets engine are associated with leases. Revoking the lease tells Vault to perform the engine-specific revocation action, such as deleting or disabling the generated database user, rather than waiting for normal expiration. This is the standard way to invalidate a specific dynamic secret immediately when you have its lease ID.
B. Incorrect.
Incorrect. Token TTL and secret lease TTL are related but not interchangeable. Shortening or changing an auth token does not directly revoke an already issued dynamic secret lease on demand. In many cases, revoking a token can revoke leases created through that token, but simply reducing TTL is not an immediate targeted action for an existing lease and does not use the provided lease ID.
C. Incorrect.
Incorrect. Sealing Vault makes Vault unavailable until unsealed; it is not an operational method for selectively revoking a single lease. Sealing does not serve as the recommended mechanism to immediately clean up one application's dynamic database credentials.
D. Incorrect.
Incorrect. Disabling or deleting a secrets engine mount is a disruptive administrative action and not the appropriate way to revoke one credential. It affects the entire mount and all secrets under it. The requirement is to stop one set of generated credentials immediately, which is what lease revocation is designed for.

HashiCorp Vault Associate (003) Question 105

Single answer4a Explain the purpose of a lease ID

A security engineer uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an application. During a deployment rollback, the team needs to immediately revoke only the credentials issued to one failed application instance without affecting other active instances that received their own credentials. Which piece of information should the engineer use to identify and revoke just that specific set of issued credentials?

A
The lease ID returned when the dynamic credentials were generated
B
The Vault token accessor for the engineer who requested the credentials
C
The mount path of the database secrets engine
D
The role name used to generate the credentials

Show answer and explanation

Correct answer: A

Explanation

The purpose of a lease ID in Vault is to uniquely track a leased secret instance, especially for dynamic secrets such as database credentials. When Vault returns a secret with a lease, it includes a lease ID so clients or operators can perform actions on that specific lease, such as lookup, renewal if renewable, or revocation. In practice, this is essential when multiple applications or instances use the same secrets engine and role, because the lease ID lets you manage one issued secret without affecting others. This aligns with Vault documentation on leases and dynamic secrets, where lease IDs are central to managing the lifecycle of issued secrets.

A. Correct.
Correct. A lease ID uniquely identifies a leased secret returned by Vault, such as dynamic database credentials. The lease ID is used for lease lifecycle operations like lookup, renew when allowed, and revoke. In this scenario, revoking by lease ID lets the engineer target only the credentials issued to the failed instance instead of all credentials from the role or mount.
B. Incorrect.
Incorrect. A token accessor identifies a token in a limited way and is used for token-related operations, not for uniquely identifying and revoking a specific leased secret like dynamic database credentials. Confusing token management with secret lease management is a common misconception.
C. Incorrect.
Incorrect. The mount path identifies which secrets engine is in use, but it does not identify one specific issued credential set. Revoking at the mount level would be much broader than needed and could impact other applications using the same engine.
D. Incorrect.
Incorrect. The role name determines how credentials are generated, but many different leases can be created from the same role. Using the role name alone would not isolate the single credential set issued to the failed instance.

Timed practice exam

Take a HashiCorp Vault Associate (003) practice test under exam conditions

70 questions in 60 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

HashiCorp Vault Associate (003) practice questions 101 to 200 of 243

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 3 pages of up to 100 questions.

More HashiCorp exam dumps

All HashiCorp exams

223 questions

HashiCorp Terraform Associate (004) exam dumps

Terraform Associate 004