HashiCorp Vault Associate (003) Question 116
Single answer4c Describe how to revoke leasesA team retrieves dynamic PostgreSQL credentials from Vault's database secrets engine for a deployment. During troubleshooting, an engineer accidentally exposes one set of credentials in a shared log. The security team wants Vault to immediately invalidate only that exposed credential without affecting other active database leases issued by the same role. Which action should the engineer take?
- A
Call the lease revocation endpoint or CLI command for that specific lease ID, such as
vault lease revoke <lease_id> - B
Disable and re-enable the database secrets engine mount so Vault removes the compromised credential
- C
Delete the Vault policy that allowed access to the database role so the exposed credential can no longer be used
- D
Revoke the user's token with
vault token revokebecause revoking the token automatically revokes only the leaked database credential
Show answer and explanation
Correct answer: A
Explanation
Vault leases represent issued dynamic secrets and can be revoked before their TTL expires. In a real incident response scenario, the recommended targeted action is to revoke the exact lease associated with the exposed secret, typically with vault lease revoke <lease_id> or the equivalent API call to the sys/leases revocation endpoint. This causes Vault to execute the secrets engine's revocation workflow for that lease. By contrast, changing policies affects authorization, not already-issued secrets; disabling the mount is excessively disruptive; and revoking the parent token may revoke more than the single compromised secret. This aligns with Vault documentation and operational best practice for handling compromised dynamic credentials.
- A. Correct.
Correct. To invalidate one specific dynamic secret, revoke its lease directly using the lease ID returned when the secret was issued. For secrets engines that support revocation, Vault runs the revocation logic for that lease, such as removing or invalidating the generated database user. This is the most targeted response and avoids disrupting other valid leases from the same role.
- B. Incorrect.
Incorrect. Disabling a secrets engine mount is a broad administrative action and would affect all secrets and configuration under that mount, not just the single leaked credential. This is far more disruptive than necessary for a single exposed lease.
- C. Incorrect.
Incorrect. Policies control future access to Vault APIs; they do not retroactively invalidate a dynamic secret that has already been issued. The leaked database credential would still exist until it expires or its lease is revoked.
- D. Incorrect.
Incorrect. Revoking the token can revoke leases associated with that token, but the question asks for the most precise way to invalidate only the exposed credential. Token revocation may impact multiple leases created under that token and is not the best targeted action when the specific lease ID is known.