Vault Associate · Domain 4 of 9

Vault Associate Domain 4: Vault leases

Leases attach a lifetime to dynamic secrets and service tokens. This compact group covers what a lease ID is for, how renewal works within max TTL limits, and how leases are revoked singly or by prefix.

Exam weight estimate
Not published
Official objectives
3
Estimated questions estimate
~4
Suggested study time estimate
3–5 hrs

About 10 min read Reviewed October 2026

Overview

Vault leases are the metadata Vault attaches to dynamic secrets and service token authentications: a lease ID, a lease duration and a renewable flag. HashiCorp lists three objectives: explain the purpose of a lease ID, describe how to renew leases, and describe how to revoke leases. When a lease expires or is revoked, Vault calls the secrets engine to destroy the underlying credential, such as dropping a database user or deleting an IAM key.

Renewal uses vault lease renew with an optional -increment, which requests a new TTL measured from now and is capped by the mount's or role's max TTL. Revocation uses vault lease revoke for a single lease ID, -prefix to revoke every lease under a path, and -force only for cleanup when the backend cannot be reached. Revoking a token also revokes every lease it created.

How it's tested

Lease questions are usually short. A command and output are shown, or an incident is described, and you choose how to renew or revoke. Read the lease ID path carefully because it reveals the mount and role, and watch for max TTL limits on any renewal request.

  • Read the lease ID

    A lease ID such as database/creds/readonly/abc123 is shown, and you identify the mount, role or command that uses it.

  • Renewal arithmetic

    A lease has a remaining TTL, an increment is requested, and you work out the resulting lease within max TTL.

  • Incident revocation

    Credentials from one role are compromised, and you choose between revoking one lease, a prefix or the issuing token.

Reasoning it through

A database role has a max TTL of 24 hours. A lease issued 23 hours ago is renewed with -increment=4h. The increment looks as if it adds four hours, but it requests a TTL of four hours from now and is capped by max TTL. Only one hour remains, so Vault returns a one-hour lease and warns that the TTL was capped.

Objectives 3

Official objectives from the HashiCorp outline, in outline order.

4a Explain the purpose of a lease IDThe identifier Vault uses to track and act on a lease.
What it means
A lease ID uniquely identifies one lease. It is returned with every dynamic secret, alongside lease_duration and lease_renewable, and it is the handle used to look up, renew or revoke that secret.
What to understand
Lease IDs begin with the path that generated the secret, for example aws/creds/deploy/ followed by a unique suffix. That prefix structure is why prefix revocation works. Vault records each lease in storage and tracks it until expiry. Service token logins also have leases, while KV secrets do not create leases that Vault can revoke. vault lease lookup <lease_id> returns the issue time, expiry time and renewable status.
How it shows up
Expect to identify what a lease ID represents or which command consumes it.
Common confusion
Assuming static KV secrets receive revocable lease IDs like dynamic secrets.
4b Describe how to renew leasesExtending a lease with vault lease renew within max TTL.
What it means
Renewing a lease asks Vault to extend the life of a dynamic secret without issuing new credentials, using vault lease renew or the sys/leases/renew endpoint, provided the lease is renewable.
What to understand
The -increment value requests a new TTL counted from the current time; it is not added to the remaining TTL. The secrets engine may grant less, and the result can never pass the max TTL set by the system, mount or role. Once max TTL is reached the client must request a new secret. Applications or Vault Agent typically renew leases in the background before they expire.
How it shows up
Questions ask what TTL results from a renewal request, or why a renewal returned less than requested.
Common confusion
Adding the increment to the time left instead of measuring it from now.
4c Describe how to revoke leasesEnding leases early, individually or in bulk.
What it means
Revoking a lease ends it immediately, and Vault tells the secrets engine to destroy the credential. You can revoke one lease, all leases under a path prefix, or all leases created by a token.
What to understand
vault lease revoke <lease_id> revokes one lease. vault lease revoke -prefix aws/creds/deploy revokes every lease under that path and requires sudo on the matching sys/leases/revoke-prefix endpoint. -force, used with -prefix, removes lease entries even when the backend revocation fails, so it can leave credentials behind and is for recovery only. Revoking a token revokes all leases it created, and disabling a secrets engine revokes all its leases.
How it shows up
An incident scenario asks for the quickest way to withdraw every credential from a role or mount.
Common confusion
Using -force routinely; it skips backend cleanup and may leave live credentials.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Lease

    Metadata attaching a lifetime to a dynamic secret.

    Remember
    Includes lease_id, lease_duration and lease_renewable.
    Tested as
    Definition questions.
    Trap
    Expecting leases on KV secrets.

  • Lease ID

    Unique handle for one lease.

    Remember
    Starts with the path that issued it.
    Tested as
    Command questions.
    Trap
    Ignoring the path prefix.

  • lease_duration

    Seconds the lease remains valid.

    Remember
    Clients should renew or refresh before it ends.
    Tested as
    Output reading questions.
    Trap
    Confusing it with max TTL.

  • vault lease renew -increment

    Requests a new TTL from now.

    Remember
    Capped by max TTL.
    Tested as
    Renewal questions.
    Trap
    Adding it to remaining time.

  • Max TTL

    Ceiling for a lease's total life.

    Remember
    Set at system, mount or role level.
    Tested as
    Renewal limit questions.
    Trap
    Expecting renewal beyond it.

  • vault lease revoke

    Ends one lease immediately.

    Remember
    Vault destroys the backing credential.
    Tested as
    Revocation questions.
    Trap
    Expecting the credential to survive.

  • revoke -prefix

    Revokes all leases under a path.

    Remember
    Requires sudo on the prefix endpoint.
    Tested as
    Incident response questions.
    Trap
    Revoking leases one by one.

  • revoke -force

    Removes lease records despite backend errors.

    Remember
    Recovery only; may orphan credentials.
    Tested as
    Edge case questions.
    Trap
    Using it as standard practice.

  • Token-lease link

    Leases belong to the token that created them.

    Remember
    Revoking the token revokes its leases.
    Tested as
    Hierarchy questions.
    Trap
    Forgetting this cascade.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Revocation options

ConceptMeaningKey differenceCommon trap
revoke <lease_id> Ends a single lease Narrowest scope Too slow for a broad incident
revoke -prefix Ends every lease under a path Bulk response; needs sudo Choosing a prefix that is too broad
Revoke the token Ends the token and all its leases Scoped to one client's activity Forgetting children are revoked too

TTL concepts for leases

ConceptMeaningKey differenceCommon trap
Default TTL Lease length if none requested Starting value Treating it as a ceiling
Increment Requested new TTL on renewal Counted from now Adding it to remaining time
Max TTL Absolute limit for the lease Renewal cannot pass it Expecting increments to override it

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Increment adds time

    What candidates pick
    Calculate the new TTL as remaining time plus the increment.
    Why it looks right
    Extension sounds additive.
    Why it's wrong
    The increment requests a TTL from the current time, and max TTL can reduce it further.

    Clue to watch for Renewal output shows a smaller TTL than expected.

  2. Renew past max TTL

    What candidates pick
    Keep renewing a lease to use one credential forever.
    Why it looks right
    Renewals usually succeed.
    Why it's wrong
    Leases stop at max TTL, after which the client must obtain a new secret.

    Clue to watch for The lease is near its maximum lifetime.

  3. KV has leases

    What candidates pick
    Revoke a KV secret by lease ID.
    Why it looks right
    All secrets seem to have leases.
    Why it's wrong
    KV secrets are static and Vault does not revoke them through leases; you update or delete the value.

    Clue to watch for The secret comes from a kv mount.

  4. One by one

    What candidates pick
    Loop through lease IDs to revoke a compromised role's credentials.
    Why it looks right
    It feels controlled.
    Why it's wrong
    vault lease revoke -prefix revokes every lease under the role path in one command.

    Clue to watch for Many credentials share a role path.

  5. Force as default

    What candidates pick
    Add -force to every prefix revocation.
    Why it looks right
    It guarantees the command completes.
    Why it's wrong
    Force deletes lease records even if backend cleanup fails, which can leave valid credentials behind.

    Clue to watch for The backend is reachable and healthy.

Answer framework

Follow these steps for any Domain 4 lease question.

  1. Confirm the secret is dynamic or a service token login; static KV values are not managed through revocable leases.
  2. Read the lease ID prefix to identify the mount and role that issued the secret.
  3. For renewal, treat the increment as a TTL from now and cap the result at the max TTL that applies.
  4. For revocation, choose a single lease ID, a path prefix or the issuing token based on how wide the exposure is.
  5. Reserve -force for recovery when the backend cannot be reached, and expect Vault to destroy credentials in every other revocation, since the secrets engine removes the matching user or key.

Practice question

A security team learns that an application's database credentials, all issued from the role database/creds/orders, may be exposed. They want to invalidate every credential issued by that role immediately while leaving other roles untouched. What should they run?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Leases are easiest to learn with a real dynamic secrets engine. On a dev server, enable the database engine against a local PostgreSQL or MySQL container, or use the AWS engine in a sandbox account, and set a short default TTL and max TTL on the role. Request credentials and note the lease_id, lease_duration and renewable flag in the output.

Renew the lease with different increments and record what Vault returns each time, especially near the max TTL. Then revoke a single lease, generate several more and revoke them with -prefix, checking the database to confirm users disappear. Finally, revoke the token that requested a lease and confirm the lease goes with it.

Keep a short table of default TTL, increment and max TTL with one worked example each. Because only three objectives sit here, a focused session of a few hours plus practice questions should be enough before you move on to secrets engines.

FAQ

How many questions come from Vault leases?

HashiCorp does not publish a weight for Vault leases. It has three objectives, so we plan for roughly four questions, though leases also appear in secrets engine scenarios.

What is a lease ID used for?

It identifies one lease so you can look it up, renew it or revoke it. Its prefix shows the path that issued the secret.

Does -increment add time to the lease?

No. It requests a new TTL measured from the current time, and the result is capped by the applicable max TTL.

Do KV secrets have leases?

Not revocable ones. KV values are static, so Vault does not revoke them through leases; you change or delete the stored value instead.

When should I use revoke -prefix?

When every lease under a path, such as one role's credentials, must be revoked at once, for example after a suspected compromise.

What does revoke -force do?

With -prefix, it removes lease entries even if the secrets engine cannot revoke the credential. Use it only for recovery, since live credentials may remain.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered lease IDs, renewal within max TTL and revocation options. Check whether you can predict lease outcomes in short exam scenarios.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going