Hashicorp Certified Vault Associate 002 · Free Practice Question Easy
Question 21
Julie is a developer who needs to ensure an application can properly renew its lease for AWS credentials it uses to access data in an S3 bucket. Although the application would generally use the API, what is the equivalent CLI command to perform this action?
-
A
vault lease renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99 -
B
vault renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99 -
C
vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99 -
D
vault lease renew aws/creds/s3-read-only
Reveal correct answer
Correct answer: C
Explanation
The proper command would be vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99. If you wanted to change the specific increment for the new lease, you could use the -increment flag in the command as well.
https://developer.hashicorp.com/vault/docs/commands/lease/renew
A.
The CLI command vault lease renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99 is incorrect as it references roles instead of the creds path. In this case, the focus should be on renewing the lease for the specific AWS credentials used by the application to access the S3 bucket, not the roles associated with those credentials.
B.
The CLI command vault renew aws/roles/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99 is incorrect in this context. It references roles instead of credentials, which are not the entities that need to have their lease renewed in this scenario. The correct command should target the credentials directly.
C.
The correct CLI command to renew the lease for AWS credentials used to access data in an S3 bucket is vault lease renew aws/creds/s3-read-only/39e6b9a2-296-83d9-2fe0-c11e846bdc99. This command specifically targets the credentials that need to be renewed, ensuring that the application can continue to access the data without interruption.
D.
The CLI command vault lease renew aws/creds/s3-read-only is incorrect as it does not specify the unique identifier (UUID) of the credentials that need to have their lease renewed. Without the specific identifier, the command may not target the correct credentials, potentially leading to issues with accessing the data in the S3 bucket.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
