HashiCorp Vault Associate (003) Question 107
Single answer4a Explain the purpose of a lease IDA platform team retrieves dynamic database credentials from Vault for a temporary troubleshooting task. After the task is complete, the team wants to invalidate only that specific set of credentials immediately without affecting the role configuration or other active credentials issued from the same secrets engine. Which Vault concept enables this targeted action?
- A
The lease ID returned with the secret, which can be used to renew or revoke that specific secret lease
- B
The token accessor, which directly identifies and revokes any dynamic secret generated by Vault
- C
The mount path of the database secrets engine, which is used to revoke only one generated username and password pair
- D
The entity ID in the identity store, which maps the user to a single dynamic credential that can be invalidated
Show answer and explanation
Correct answer: A
Explanation
The purpose of a lease ID in Vault is to uniquely identify a leased secret so Vault can control that secret's lifecycle. For secrets that support leasing, such as many dynamic secrets, Vault commonly returns metadata including a lease ID, lease duration, and whether the lease is renewable. The lease ID is then used by Vault operations to renew or revoke that individual lease. This is important in real environments because teams often need to invalidate one issued credential set without changing the secrets engine configuration, deleting the role, or affecting other consumers. HashiCorp Vault documentation on leases and dynamic secrets emphasizes that leased secrets can be renewed or revoked and that the lease ID is the identifier used for that management.
- A. Correct.
Correct. For leased secrets such as dynamic database credentials, Vault returns a lease ID that uniquely identifies that issued secret lease. The lease ID exists so Vault can manage the lifecycle of that secret, including renewal and revocation of that specific credential set. This is exactly what the team needs when they want to invalidate one set of generated credentials without changing the underlying role or broadly revoking other leases.
- B. Incorrect.
Incorrect. A token accessor is related to a Vault token, not to a leased dynamic secret like database credentials. Accessors can be used for token lookup and revocation workflows, but they do not serve as the identifier for a specific database secret lease. This distractor reflects the common confusion between token management and secret lease management.
- C. Incorrect.
Incorrect. The mount path identifies where a secrets engine is enabled, such as database/ or aws/, but it does not uniquely identify an individual issued secret. Revocation based only on the mount path would not target one specific generated credential set. This option is plausible because mount paths are often part of lease-related API paths, but they are not themselves the purpose of the lease ID.
- D. Incorrect.
Incorrect. An entity ID belongs to Vault Identity and represents a user or machine identity across auth methods. It is not the mechanism used to track and revoke one specific leased secret. Someone might choose this if they are thinking about who requested the secret rather than how Vault tracks the issued secret itself.