HashiCorp Vault Associate (003) Question 102
Single answer4 Vault leasesA team uses Vault's database secrets engine to generate short-lived PostgreSQL credentials for an internal reporting application. The application authenticates to Vault, reads dynamic credentials, and stores the returned username, password, and lease ID. During a deployment issue, the application instances are terminated unexpectedly before they can clean up. The security team wants the old database credentials invalidated as soon as possible rather than waiting for the full TTL to expire. Which action should an operator take in Vault to address this situation?
- A
Revoke the specific lease IDs for the issued database credentials
- B
Renew the leases so Vault can immediately rotate the database passwords
- C
Delete the database role configuration so all existing credentials are instantly removed from the database
- D
Disable the auth method used by the application so Vault automatically revokes all previously issued database credentials
Show answer and explanation
Correct answer: A
Explanation
Vault leases track the lifetime of many dynamically generated secrets, including database credentials from the database secrets engine. If a client cannot perform normal cleanup, an operator can revoke the lease to trigger immediate revocation of the underlying secret rather than waiting for the lease to expire naturally. This reflects a core Vault best practice: use renewal to extend access when still needed, and use revocation to invalidate access early. In Vault documentation, lease management centers on TTLs, renewal, and revocation, and dynamic secret engines commonly implement revocation by deleting or disabling the generated credential in the target system.
- A. Correct.
Correct. Dynamic secrets issued by the database secrets engine are associated with leases. Revoking a lease tells Vault to perform the secret engine's revocation action, which for database credentials typically means removing or disabling the generated database user immediately. This is the correct operational response when you know the affected lease IDs and want to invalidate those credentials before their TTL expires.
- B. Incorrect.
Incorrect. Renewing a lease extends its validity period; it does not invalidate the secret. An operator might choose this option because lease renewal is a common lease operation, but it has the opposite effect here: it would keep the credentials valid longer, not shorten their lifetime.
- C. Incorrect.
Incorrect. Deleting the database role affects future credential generation and may disrupt applications, but it is not the targeted way to immediately revoke already issued leased credentials. Existing dynamic secrets are managed through their leases and should be revoked directly when possible.
- D. Incorrect.
Incorrect. Disabling an auth method impacts authentication via that method, not necessarily the lifecycle of secrets already issued by another secrets engine. A common misconception is that auth tokens and secret leases are the same thing. While tokens can be revoked and token revocation can affect child tokens, disabling an auth method is not the appropriate mechanism for directly revoking previously issued database dynamic secret leases.