HashiCorp Vault Associate (003) Question 114
Single answer4b Describe how to renew leasesA team runs an application that retrieves dynamic database credentials from Vault using the database secrets engine. The application stores the lease ID returned by Vault and wants to keep the credentials valid for as long as the app is running, without requesting brand-new credentials each time. During testing, the engineer notices that some credentials can be extended while others cannot. Which action should the engineer take to renew the existing credentials when renewal is allowed?
- A
Call Vault's lease renewal endpoint or use
vault lease renew <lease_id>with the lease ID returned when the credentials were issued - B
Re-run the original read request against the database secrets path; Vault will treat the new read as a renewal of the existing lease
- C
Use
vault token renewbecause all leases in Vault are renewed through the token renewal API - D
Update the database role's TTL in Vault; changing the role automatically renews all currently issued leases
Show answer and explanation
Correct answer: A
Explanation
In Vault, many dynamic secrets are issued with a lease ID, a TTL, and a renewable flag. To extend the life of an existing leased secret, the client must use Vault's lease renewal process, typically via the /sys/leases/renew API or the vault lease renew CLI command. This is different from renewing a token with vault token renew. It is also different from reading the secret again, which commonly creates a new secret and lease rather than extending the existing one. Whether renewal succeeds depends on whether the lease is marked renewable and on limits such as the mount or role's maximum TTL. This matches Vault best practices: track the lease ID for dynamic secrets and renew it before expiration when the lease is renewable; otherwise, fetch a new secret.
- A. Correct.
Correct. Dynamic secrets issued by engines such as the database secrets engine include a lease ID. If the secret is renewable, the client can renew that lease by calling the lease renewal API or using the CLI command
vault lease renewwith that lease ID. This extends the lifetime of the existing lease, subject to the secret engine's rules and max TTL limits. - B. Incorrect.
Incorrect. Reading the secret path again does not renew the existing lease. For dynamic secrets, a new read usually generates a new set of credentials and a new lease rather than extending the current one. Someone might choose this option if they confuse reissuing credentials with renewing a lease.
- C. Incorrect.
Incorrect.
vault token renewis used to renew Vault tokens, not arbitrary secret leases. Tokens and leases are related concepts, but they are renewed through different mechanisms. This distractor targets the common misconception that all time-based items in Vault are renewed the same way. - D. Incorrect.
Incorrect. Changing a database role's TTL settings affects future secret issuance behavior and renewal constraints, but it does not automatically renew already-issued leases. Existing leases must be renewed explicitly if they are renewable, and they still cannot exceed configured limits.