HashiCorp Vault Associate (003) Question 104
Single answer4 Vault leasesA team uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an internal reporting application. The security team wants those credentials to stop working immediately when the application is decommissioned, instead of waiting for the lease TTL to expire. An operator has the lease ID returned when the credentials were issued. What is the most appropriate action to meet this requirement?
- A
Revoke the specific lease using Vault's lease revocation API or CLI so Vault runs the database secrets engine's cleanup for that credential
- B
Reduce the auth token TTL for the application so the database username and password are deleted automatically before their lease expires
- C
Seal the Vault cluster so all active leases are invalidated and the database secrets engine removes the generated user
- D
Delete the database secrets engine mount configuration so existing dynamic credentials are immediately removed from PostgreSQL
Show answer and explanation
Correct answer: A
Explanation
Vault leases are central to dynamic secrets. When a secrets engine like the database secrets engine issues credentials, Vault returns a lease ID and TTL. If the secret should no longer be valid before the TTL ends, the correct operational response is to revoke that lease. On revocation, Vault calls the secrets engine's revocation logic to clean up the external resource, such as dropping the generated database user. This is more precise and safer than changing mount settings, sealing Vault, or manipulating token TTLs. HashiCorp Vault documentation on leases, lease revoke operations, and dynamic secrets best practices emphasizes using lease revocation for immediate invalidation of issued secrets.
- A. Correct.
Correct. Dynamic secrets issued by engines such as the database secrets engine are associated with leases. Revoking the lease tells Vault to perform the engine-specific revocation action, such as deleting or disabling the generated database user, rather than waiting for normal expiration. This is the standard way to invalidate a specific dynamic secret immediately when you have its lease ID.
- B. Incorrect.
Incorrect. Token TTL and secret lease TTL are related but not interchangeable. Shortening or changing an auth token does not directly revoke an already issued dynamic secret lease on demand. In many cases, revoking a token can revoke leases created through that token, but simply reducing TTL is not an immediate targeted action for an existing lease and does not use the provided lease ID.
- C. Incorrect.
Incorrect. Sealing Vault makes Vault unavailable until unsealed; it is not an operational method for selectively revoking a single lease. Sealing does not serve as the recommended mechanism to immediately clean up one application's dynamic database credentials.
- D. Incorrect.
Incorrect. Disabling or deleting a secrets engine mount is a disruptive administrative action and not the appropriate way to revoke one credential. It affects the entire mount and all secrets under it. The requirement is to stop one set of generated credentials immediately, which is what lease revocation is designed for.