HashiCorp Vault Associate (003) Question 119
Single answer4c Describe how to revoke leasesA security team discovers that a database credential generated by Vault's database secrets engine may have been exposed in application logs. The team wants to immediately invalidate only that specific dynamic credential without affecting other active database credentials issued by the same role. Which action should the Vault administrator take?
- A
Run
vault lease revoke <lease_id>for the lease associated with the exposed credential - B
Disable and re-enable the database secrets engine mount to force all issued credentials to expire
- C
Run
vault token revoke <token>for the application's Vault token because revoking the token automatically revokes only the exposed database credential - D
Wait for the credential's TTL to expire because Vault does not support early revocation of dynamic secrets
Show answer and explanation
Correct answer: A
Explanation
In Vault, many dynamic secrets are associated with leases, and administrators can revoke those leases directly when a secret must be invalidated before its natural expiration. For a single compromised database credential, the most precise action is to revoke that lease by its lease ID using the CLI or the corresponding sys/leases revoke API path. This avoids unnecessary impact on other credentials. By contrast, disabling the secrets engine is a broad action that revokes all leases under the mount, and revoking a token may revoke multiple child leases tied to that token. HashiCorp Vault documentation on leases and dynamic secrets emphasizes explicit revocation as a standard operational control for exposed or no-longer-needed credentials.
- A. Correct.
Correct. Dynamic secrets such as database credentials are issued with leases, and Vault supports revoking a specific lease directly. Using
vault lease revoke <lease_id>targets only that leased secret, which is the right response when a single exposed credential must be invalidated immediately without disrupting other credentials. - B. Incorrect.
Incorrect. Disabling a secrets engine mount revokes all secrets and leases under that mount, which is far broader than required in this scenario. While this would invalidate the exposed credential, it would also disrupt unrelated applications using other active credentials from the same engine.
- C. Incorrect.
Incorrect. Revoking the client token can revoke leases created through that token, but it is not the best choice here because the requirement is to invalidate only the specific exposed credential. If the token has created multiple leased secrets, revoking the token could revoke more than intended. This reflects a common misconception between token revocation and direct lease revocation.
- D. Incorrect.
Incorrect. Vault does support revoking dynamic secrets before their TTL expires. In fact, one of the main benefits of dynamic secrets is that they can be explicitly revoked when no longer needed or when compromise is suspected.