HashiCorp Vault Associate (003) Question 115
Single answer4c Describe how to revoke leasesA security team discovers that a developer accidentally exposed a database credential generated by Vault's database secrets engine. The leaked credential is tied to a specific lease ID shown in the audit log. The team wants to invalidate only that compromised dynamic secret immediately, without affecting other database credentials issued by Vault. Which action should they take?
- A
Run
vault lease revoke <lease_id>for the compromised lease - B
Run
vault token revoke <lease_id>because every lease is backed by a token - C
Disable and re-enable the database secrets engine to force all issued credentials to expire
- D
Run
vault lease renew <lease_id>to rotate the compromised credential
Show answer and explanation
Correct answer: A
Explanation
When a specific dynamic secret is compromised, the best practice is to revoke that exact lease rather than take broader action. In Vault, a lease represents a time-bound secret issued by a secrets engine. The vault lease revoke command, or the corresponding API endpoint, tells Vault to execute the secrets engine's revocation logic for that lease. For the database secrets engine, this typically means removing or disabling the generated database user or credentials. By contrast, vault token revoke applies to tokens, not secret leases, and disabling a secrets engine is a much broader operational action that impacts all issued secrets from that mount. HashiCorp Vault documentation distinguishes token revocation from lease revocation and describes lease revocation as the correct mechanism for invalidating dynamic secrets without unnecessary disruption.
- A. Correct.
Correct. Revoking the specific lease ID is the appropriate way to invalidate a single dynamic secret issued by Vault. For secrets engines that support revocation, Vault performs the revocation action associated with that lease, such as deleting or disabling the generated database credential. This is the least disruptive option because it targets only the compromised secret.
- B. Incorrect.
Incorrect. Tokens and leases are related but not interchangeable.
vault token revokeis used to revoke Vault tokens, not arbitrary secret leases from engines like the database secrets engine. A leaked dynamic secret lease should be revoked through the lease revocation workflow, not token revocation, unless the problem specifically involves a token. - C. Incorrect.
Incorrect. Disabling the secrets engine would revoke all secrets and affect all clients using that engine. While this can invalidate issued credentials, it is far more disruptive than necessary when the team only needs to revoke one compromised lease. This option reflects a common misconception that engine-level actions are the normal first response for a single leaked credential.
- D. Incorrect.
Incorrect. Renewing a lease extends its validity; it does not invalidate the existing secret or rotate it automatically in this context. If a credential is compromised, renewal makes the problem worse by potentially keeping it valid longer. Revocation, not renewal, is the correct response.