HashiCorp Vault Associate (003) Question 100
Single answer4 Vault leasesA team uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an internal reporting application. The role is configured with a default TTL of 1 hour and a max TTL of 24 hours. During a deployment issue, the application stops renewing its credentials and continues trying to use the same username and password. About 70 minutes after the credentials were issued, database connections begin failing. What is the most likely explanation?
- A
The lease expired because the application did not renew it before the 1-hour TTL, so Vault revoked the dynamic credentials.
- B
The token used by the application automatically converted the lease into a periodic lease, so the credentials should have remained valid until the 24-hour max TTL.
- C
Dynamic database credentials do not use leases; only tokens expire, so the database itself likely rejected the user for an unrelated reason.
- D
Vault does not revoke credentials when a lease expires unless an operator manually runs a revoke command.
Show answer and explanation
Correct answer: A
Explanation
Vault leases are central to how dynamic secrets are managed. When Vault issues dynamic database credentials, it associates them with a lease ID and a TTL. The client can renew the lease if the secret is renewable, but if renewal does not occur before expiration, Vault revokes the secret automatically. In practice, that means the database credentials generated by Vault are no longer valid after the lease expires. The role's default TTL controls the initial lease duration, while the max TTL limits how far renewals can extend the lifetime. This scenario tests the practical distinction between initial TTL, renewal, and max TTL. HashiCorp Vault documentation for leases, dynamic secrets, and the database secrets engine emphasizes that leased secrets expire and are revoked automatically unless renewed within allowed limits.
- A. Correct.
Correct. Dynamic secrets from the database secrets engine are leased secrets. If the client does not renew the lease before the TTL expires, the lease reaches expiration and Vault revokes the secret. For database secrets, revocation typically means Vault runs the configured revocation statements, causing the generated database credentials to stop working. Since the default TTL is 1 hour, failures starting around 70 minutes strongly indicate the lease expired and was not renewed.
- B. Incorrect.
Incorrect. A periodic token is a token property, not a property that automatically changes a secret lease. Secret leases still have their own TTL and renewal behavior. The 24-hour max TTL does not mean the lease stays valid for 24 hours without renewal; it means renewals cannot extend the lease past that maximum lifetime.
- C. Incorrect.
Incorrect. Dynamic secrets such as database credentials absolutely do use leases in Vault. This is one of the core reasons to use dynamic secrets: Vault can issue time-bound credentials and revoke them automatically when the lease expires or is revoked explicitly.
- D. Incorrect.
Incorrect. One of Vault's key capabilities is automatic revocation of leased dynamic secrets on expiration. Manual revocation is possible, but it is not required for an expired lease to trigger revocation behavior.