HashiCorp Vault Associate (003) Question 105
Single answer4a Explain the purpose of a lease IDA security engineer uses Vault's database secrets engine to generate dynamic PostgreSQL credentials for an application. During a deployment rollback, the team needs to immediately revoke only the credentials issued to one failed application instance without affecting other active instances that received their own credentials. Which piece of information should the engineer use to identify and revoke just that specific set of issued credentials?
- A
The lease ID returned when the dynamic credentials were generated
- B
The Vault token accessor for the engineer who requested the credentials
- C
The mount path of the database secrets engine
- D
The role name used to generate the credentials
Show answer and explanation
Correct answer: A
Explanation
The purpose of a lease ID in Vault is to uniquely track a leased secret instance, especially for dynamic secrets such as database credentials. When Vault returns a secret with a lease, it includes a lease ID so clients or operators can perform actions on that specific lease, such as lookup, renewal if renewable, or revocation. In practice, this is essential when multiple applications or instances use the same secrets engine and role, because the lease ID lets you manage one issued secret without affecting others. This aligns with Vault documentation on leases and dynamic secrets, where lease IDs are central to managing the lifecycle of issued secrets.
- A. Correct.
Correct. A lease ID uniquely identifies a leased secret returned by Vault, such as dynamic database credentials. The lease ID is used for lease lifecycle operations like lookup, renew when allowed, and revoke. In this scenario, revoking by lease ID lets the engineer target only the credentials issued to the failed instance instead of all credentials from the role or mount.
- B. Incorrect.
Incorrect. A token accessor identifies a token in a limited way and is used for token-related operations, not for uniquely identifying and revoking a specific leased secret like dynamic database credentials. Confusing token management with secret lease management is a common misconception.
- C. Incorrect.
Incorrect. The mount path identifies which secrets engine is in use, but it does not identify one specific issued credential set. Revoking at the mount level would be much broader than needed and could impact other applications using the same engine.
- D. Incorrect.
Incorrect. The role name determines how credentials are generated, but many different leases can be created from the same role. Using the role name alone would not isolate the single credential set issued to the failed instance.