nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #54

You are managing a Vault implementation that has been integrated with Azure SQL database to provide dynamic credentials. You have created a role that will provide database credentials for database…

The correct answer is B. vault lease revoke v-token-dba_acccss-tr2t4x9pxvqlz8878s9s-1513446795. To proactively revoke a dynamically generated credential from Vault, the vault lease revoke command should be used with the specific lease ID provided when the credential was issued.

Submitted by haru.x· Apr 18, 2026Operate Vault

Question

You are managing a Vault implementation that has been integrated with Azure SQL database to provide dynamic credentials. You have created a role that will provide database credentials for database administrators (DBAs) to use for managing their database in Azure SQL. A DBA has requested a new credential by issuing the following Vault CLI command: vault read azuresql/creds/dba_access. The following output is returned: The DBA has completed their work and would like to proactively remove the credential now that their work is complete. Which of the following commands should the DBA execute?

Exhibit

VAULT-ASSOCIATE-002 question #54 exhibit

Options

  • Avault delete azuresql/creds/dba_access
  • Bvault lease revoke v-token-dba_acccss-tr2t4x9pxvqlz8878s9s-1513446795
  • Cvault delete azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-
  • Dvault lease revoke azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    92% (23)
  • C
    4% (1)

Why each option

To proactively revoke a dynamically generated credential from Vault, the `vault lease revoke` command should be used with the specific lease ID provided when the credential was issued.

Avault delete azuresql/creds/dba_access

`vault delete` is used for deleting static secrets or configuration paths, not for revoking dynamic leases.

Bvault lease revoke v-token-dba_acccss-tr2t4x9pxvqlz8878s9s-1513446795Correct

Dynamic secrets in Vault are issued with a lease ID (e.g., `v-token-dba_acccss-tr2t4x9pxvqlz8878s9s-1513446795`). To proactively remove or invalidate a specific credential before its lease expires, the `vault lease revoke` command must be used along with the exact lease ID that was returned when the secret was read.

Cvault delete azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-

`vault delete` is incorrect for dynamic secret revocation, and the path provided is incomplete and incorrect for a deletion operation on a lease ID.

Dvault lease revoke azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-

While `vault lease revoke` is the correct command, the path `azuresql/creds/dba_access/2e5b1e0b-a081-c7el-5622-` is an incorrect format for a lease ID; lease IDs have a specific structure beginning with `v-`.

Concept tested: Vault dynamic secret lease revocation

Source: https://developer.hashicorp.com/vault/docs/commands/lease/revoke

Topics

#Dynamic Secrets#Leases#Vault CLI

Community Discussion

No community discussion yet for this question.

Full VAULT-ASSOCIATE-002 Practice