HashiCorp Vault Associate (003) Question 106
Single answer4a Explain the purpose of a lease IDA platform team uses Vault to generate dynamic database credentials for an application through the database secrets engine. During troubleshooting, the team finds that one set of credentials should be invalidated immediately because the application server was compromised. They still have the Vault response from when the credentials were issued, including a value named "lease_id". What is the primary purpose of that lease ID in this situation?
- A
It uniquely identifies the issued secret lease so Vault can renew or revoke that specific secret
- B
It serves as the username that the application must present to the database for authentication
- C
It is the identifier of the Vault policy that granted access to the secret and is used to edit permissions
- D
It permanently identifies the database role configuration in Vault so future credentials use the same settings
Show answer and explanation
Correct answer: A
Explanation
The purpose of a lease ID is to let Vault track and manage a specific leased secret over its lifetime. For secrets engines that return leased secrets, such as dynamic database credentials, the lease ID can be used with Vault lease operations to renew or revoke that exact secret. This is especially important in incident response and operational cleanup, where revoking one compromised credential is preferable to disabling an entire role or secrets engine. HashiCorp Vault documentation describes leases as the mechanism Vault uses to associate a TTL with secrets and manage their renewal and revocation. A key best practice is to retain lease information for dynamic secrets when applications or operators may need to renew or revoke them later.
- A. Correct.
Correct. In Vault, a lease ID identifies a leased secret instance, such as dynamic database credentials. It is used by Vault to track that secret's lifetime and to support lease operations like renewal and revocation. In this scenario, having the lease ID allows the team to target the exact issued secret for revocation rather than changing the entire role or waiting for TTL expiration.
- B. Incorrect.
Incorrect. The lease ID is not a database username or password and is not presented to the target system for authentication. Dynamic credentials may include a generated username and password, but the lease ID is Vault metadata used to manage the secret.
- C. Incorrect.
Incorrect. Policies in Vault are separate from leases. A lease ID does not identify the policy that allowed the read operation, nor is it used to modify authorization rules. Someone might choose this if they confuse access control metadata with secret lifecycle metadata.
- D. Incorrect.
Incorrect. A database role in Vault defines how credentials are generated, but the lease ID does not identify the role configuration itself. It identifies a particular issued secret instance created from that role. Future credentials may be generated from the same role, but they will have different lease IDs.