HashiCorp Vault Associate (003) Question 112
Single answer4b Describe how to renew leasesA platform team stores short-lived database credentials in Vault using a dynamic secrets engine. An application has already authenticated, read database credentials, and now needs to keep using those same credentials for a longer-running job without requesting a brand-new secret. The team confirms that the lease is renewable and has not yet reached its maximum TTL. Which action should the application take to extend the lifetime of the existing database credential lease?
- A
Call Vault's lease renewal endpoint (for example, via
vault lease renew <lease_id>or the corresponding API) using the secret's lease ID - B
Re-run the original read request for the database credential path; Vault will automatically extend the current lease instead of issuing a new one
- C
Use token renewal on the application's client token; renewing the token also renews all dynamic secret leases tied to that token
- D
Update the database secrets engine role with a longer default TTL; Vault will immediately lengthen the already-issued lease
Show answer and explanation
Correct answer: A
Explanation
In Vault, many dynamically generated secrets are issued with a lease ID, a TTL, and a renewable flag. If an application needs to continue using the same secret instance, it should renew that secret's lease rather than re-read the secret or rely on token renewal. The relevant operational pattern is to call the lease renewal endpoint or use the CLI to renew the specific lease ID. This works only when the lease is renewable and still within allowed limits such as max TTL enforced by the secrets engine or role configuration. Re-reading a dynamic secret path commonly creates a new secret, which can break a long-running process that still depends on the original credentials. Likewise, token renewal and secret lease renewal are separate actions in Vault. These behaviors align with Vault documentation on leases, TTLs, renewable leases, and dynamic secrets lifecycle management.
- A. Correct.
Correct. Renewable secrets are extended by renewing their lease, typically by calling the sys/leases renewal API or using the CLI command that renews the specific lease ID. This is the correct way to keep the same issued dynamic secret valid longer, as long as the lease is marked renewable and has not exceeded backend limits such as max TTL.
- B. Incorrect.
Incorrect. Reading the secret path again usually requests a new secret issuance, not a renewal of the existing lease. For dynamic secrets such as database credentials, this commonly results in a new username/password pair and a different lease, which does not preserve the original credentials for the running job.
- C. Incorrect.
Incorrect. Renewing the client token extends the token's lifetime if the token itself is renewable, but it does not automatically renew every leased secret created under that token. Secret leases and token leases are related but managed separately in Vault.
- D. Incorrect.
Incorrect. Changing the role's TTL settings affects future secrets issued from that role, not leases that have already been created. Existing leases must still be renewed explicitly, and any renewal remains subject to the secret engine's configured limits.