HashiCorp Vault Associate (003) Question 109
Single answer4a Explain the purpose of a lease IDA platform engineer retrieves short-lived database credentials from Vault's database secrets engine for a batch job. The job finishes early, and the engineer wants to clean up the credentials immediately instead of waiting for the TTL to expire. The application log captured the lease ID returned with the secret. What is the primary purpose of that lease ID in this scenario?
- A
It uniquely identifies the leased secret so Vault can renew or revoke that specific secret instance
- B
It acts as the username that the batch job must present when connecting to the database
- C
It replaces the client token and can be used to authenticate future API requests to Vault
- D
It permanently identifies the database role that created the secret, even after the secret expires
Show answer and explanation
Correct answer: A
Explanation
In Vault, many generated or dynamic secrets are issued with a lease. The lease ID is the handle Vault uses to track that specific secret instance so it can be renewed or revoked before its TTL expires. This is especially important for operational cleanup of dynamic credentials, such as database usernames and passwords created by the database secrets engine. Best practice is to revoke leased secrets when they are no longer needed rather than relying only on expiration. Vault documentation on leases and dynamic secrets explains that lease IDs are used for lifecycle operations like renew and revoke; they are not authentication credentials and they do not represent the underlying role or policy object.
- A. Correct.
Correct. A lease ID is returned for leased secrets, especially dynamic secrets such as database credentials. Its purpose is to identify that specific issued secret so Vault can manage its lifecycle, including renewal and revocation. In this scenario, the engineer can use the lease ID to revoke the credentials early rather than waiting for the lease to expire.
- B. Incorrect.
Incorrect. The lease ID is metadata for Vault's lease management, not a database username. Dynamic database credentials typically include separate connection fields such as username and password. Confusing the lease ID with the credential itself is a common mistake.
- C. Incorrect.
Incorrect. Authentication to Vault is done with a client token or another auth method, not with a lease ID. A lease ID is associated with a secret that has been issued, whereas a token is used to prove identity and authorization to Vault APIs.
- D. Incorrect.
Incorrect. The lease ID identifies a particular leased secret instance, not the role definition itself. The database role is a configuration object in the secrets engine, while the lease ID tracks one issued set of credentials and its lifecycle.