The lease Vault attaches to each dynamic secret and service token, the lease ID it returns, its path prefix, and what has no lease.
Study it
Lease IDs: what gets a lease and how the ID is built
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
An auditor wants every credential an application gets from Vault to be revocable through its lease ID. The application reads a database credential from the database secrets engine, reads a configuration value from a KV v2 secret, and encrypts records with the transit engine. Which of these responses comes with a lease ID that Vault can revoke?
AThe database credential and the KV value
BOnly the database credential
CAll three, since every response from Vault carries a lease ID
DThe database credential and the transit ciphertext
Show the answer and why
AThe database credential and the KV value
Incorrect
The KV engine stores arbitrary values and does not issue leases.
BOnly the database credential
Correct
The database engine returns the credential with a lease ID; KV does not issue leases, and transit returns ciphertext without one.
CAll three, since every response from Vault carries a lease ID
Incorrect
Leases come with dynamic secrets such as database credentials, not with every response.
DThe database credential and the transit ciphertext
Incorrect
Transit stores nothing and returns ciphertext for the caller to keep; there is nothing to lease.
A lease is Vault's promise that a dynamic secret is valid for a time, and its lease ID is what renew and revoke act on. Static KV values and transit results have no lease.
A developer writes a KV version 1 secret with vault kv put kv/partner ttl=30m api_key=k-123 and expects Vault to delete it after 30 minutes, like an expiring credential. What happens when the 30 minutes pass?
AVault revokes the secret's lease and deletes its data
BThe secret is deleted unless someone renews it with vault lease renew
CThe secret becomes unreadable until someone writes it again
DNothing; the value stays, and ttl only hints how often to re-read it
Show the answer and why
AVault revokes the secret's lease and deletes its data
Incorrect
The KV engine issues no lease and never removes data on its own.
BThe secret is deleted unless someone renews it with vault lease renew
Incorrect
There is no lease to renew; the ttl key is advisory.
CThe secret becomes unreadable until someone writes it again
Incorrect
Nothing is removed or hidden; the value stays readable after the 30 minutes.
DNothing; the value stays, and ttl only hints how often to re-read it
Correct
KV does not enforce TTLs; the ttl value is returned as a refresh interval for consumers.
The KV engine treats ttl as advisory: consumers use it to decide when to check back for a new value, and the data stays until someone changes or deletes it.
On Vault Enterprise, a runaway job once requested thousands of database credentials within minutes, each with its own lease. The team wants a hard cap on how many leases the database mount can have in use at one time. Which feature does that?
AA rate limit quota on the database mount's path
BA lease count quota on the database mount's path
CA lower max_ttl on every role of the database mount
DAn audit device filter on the database mount
Show the answer and why
AA rate limit quota on the database mount's path
Incorrect
Rate limits cap the request rate per client; they do not cap how many leases exist.
BA lease count quota on the database mount's path
Correct
Vault Enterprise lease count quotas limit the number of leases that can be in use at one time.
CA lower max_ttl on every role of the database mount
Incorrect
Shorter leases end sooner, but nothing stops a burst from creating thousands of them.
DAn audit device filter on the database mount
Incorrect
Audit devices record requests; they do not limit how many leases exist.
Resource quotas protect Vault from misbehaving clients: rate limits on request volume and, on Vault Enterprise, lease count quotas on how many leases are in use.