VA-003 Compare authentication methods — 15 Questions

Question 1

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Accepted Answer

Migrate users to an external identity provider and use LDAP or OIDC auth.. The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.

Answer

Switch to token-based authentication and issue tokens with TTL.

Answer

Use Vault's password policy plugin with Userpass.

Answer

Configure password policies in Vault's Userpass auth method.

Question 2

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

Accepted Answer

Okta. Okta supports Time-based One-Time Password (TOTP) as an authentication factor, which is the standard method used by authenticator apps like Google Authenticator or Microsoft Authenticator. TOTP generates a temporary code based on a shared secret and the current time, as defined in RFC 6238, and Okta's multifactor authentication (MFA) policies can require this OTP for user login. This makes Okta the correct choice for authenticating with an OTP from an authenticator app.

Answer

Userpass

Answer

GitHub

Answer

LDAP

Question 3

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Accepted Answer

Kubernetes. Option C (Kubernetes) is correct because Vault's Kubernetes auth method has a pod present its service account JWT, which Vault validates against the Kubernetes TokenReview API; the pod holds no long-lived Vault credential, only a short-lived, auto-rotated token. Option E (AWS) is correct because the AWS auth method uses AWS IAM credentials or instance identity (e.g., an EC2 instance profile's signed STS GetCallerIdentity request) to prove identity, so no static Vault secret is stored on the machine. Option A (LDAP) is incorrect because LDAP auth requires the client to supply a username and password (a static secret) bound to a directory account. Option D (Userpass) is incorrect because it authenticates with a stored username/password pair configured in Vault. Option B (AppRole) is incorrect because, although it uses a RoleID and SecretID, the SecretID is a static secret that must be delivered to and stored by the client.

Answer

LDAP

Answer

AppRole

Answer

Userpass

Question 4

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Accepted Answer

Setting a secret_id_num_uses limit. AppRole security is strengthened by limiting how a SecretID can be used and how long it lives: option C, setting a secret_id_num_uses limit, restricts the SecretID to a fixed number of login attempts, so a leaked SecretID cannot be replayed indefinitely. Option D, binding the SecretID to a specific CIDR block, ensures the SecretID is only usable from an expected source network, preventing use from unauthorized hosts. Option E, setting a secret_id_ttl, gives the SecretID a finite lifetime so it expires automatically and cannot be used for long-term unauthorized access. The unmarked options do not belong because the RoleID is not a secret (it is often public and can be discovered), and while token policies are important for authorization, they govern what the resulting token can do rather than being a factor that secures the AppRole authentication method itself.

Answer

Keeping the RoleID secret

Answer

Configuring token policies

Question 5

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Accepted Answer

Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.. Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.

Answer

Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.

Answer

Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.

Answer

Use TLS cert auth, generate a certificate per microservice, and mount as a secret.

Question 6

Match each Vault secret engine to its primary purpose.

Accepted Answer

KV: Stores arbitrary secrets as key-value pairs.. Correct matches: KV -> static secrets, AWS -> dynamic AWS credentials, PKI -> certificates. Common confusions involve swapping purposes between engines.

Answer

KV: Generates dynamic database credentials.

Answer

AWS: Issues X.509 certificates.

Answer

Transit: Manages SSH keys.

Question 7

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Accepted Answer

Create separate AppRole roles for each application. Creating separate AppRole roles for each application allows the administrator to isolate token generation per application, preventing a single role from being overwhelmed by multiple clients. This maintains security by ensuring each application has its own set of credentials and policies, reducing the total number of tokens without compromising access control.

Answer

Decrease the token TTL on the AppRole role

Answer

Periodically rotate the secret ID

Answer

Set secret_id_num_uses to 1 on the AppRole role

Question 8

An organization uses Vault with the JWT/OIDC authentication method. After configuring the provider, users can authenticate, but the scopes requested do not include the email claim needed for policy mapping. What should the administrator do?

Accepted Answer

Add the 'email' scope to the OIDC auth method config. The email claim is not included in the JWT because the OIDC provider was not requested to issue it. In OIDC, claims are delivered only when the corresponding scope (e.g., 'email') is included in the authentication request. Adding the 'email' scope to the Vault OIDC auth method configuration ensures the provider returns the email claim, which can then be used for policy mapping.

Answer

Add a policy that uses the email claim

Answer

Modify the OIDC provider's configuration in Vault

Answer

Create a custom claim mapping in the OIDC auth method

Question 9

Which TWO of the following are valid authentication methods in HashiCorp Vault? (Choose two.)

Accepted Answer

GitHub. GitHub (A) is a valid Vault auth method: the GitHub auth method lets clients authenticate by presenting a GitHub personal access token, which Vault verifies against the GitHub API and then maps to a Vault token via configured policies. Cloud Foundry (D) is also a valid Vault auth method: it allows applications running in Cloud Foundry to authenticate using their CF instance identity (a signed CF instance certificate), which Vault validates against the CF API to issue a token. SAML (B) is not a native Vault auth method (SAML is typically handled via an OIDC/JWT-based flow or an external IdP, not a dedicated SAML auth backend). RADIUS (C) is not a built-in Vault auth method (Vault does not ship a RADIUS auth backend). SSH (E) is not an authentication method in Vault; Vault's SSH secrets engine is used to issue SSH credentials/certificates, not to authenticate clients to Vault.

Answer

SAML

Answer

RADIUS

Answer

SSH

Question 10

Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)

Accepted Answer

Token auth is always enabled and cannot be disabled. Option A is correct because the token auth method is built into Vault as the core authentication mechanism and is always enabled; it cannot be disabled, unlike other auth methods (e.g., userpass, LDAP, AWS, Kubernetes) that must be explicitly enabled and can be disabled. Option E is correct because the token auth method is primarily intended for Vault's internal token management—issuing, renewing, and revoking tokens—rather than for authenticating external end users, who normally authenticate through other methods that then issue them a token. Option B is wrong because token auth fully supports policies; tokens carry policies that determine the permissions granted to the client. Option C is wrong because periodic tokens are a property of tokens themselves and can be created via other auth methods as well (for example, by configuring a periodic token through token roles or auth method roles), not exclusively through token auth. Option D is wrong because the token auth method can indeed be used to create root tokens (for example, via `vault token create -policy=root` when permitted), so it is not a difference that excludes root token creation.

Answer

Token auth does not support policies

Answer

Token auth is the only method that can create periodic tokens

Answer

Token auth cannot be used to create a root token

Question 11

A development team wants to authenticate to Vault using a method that does not require storing secrets in source code and supports automatic rotation of credentials. Which authentication method best meets these requirements?

Accepted Answer

AWS IAM authentication. AWS IAM authentication allows Vault to authenticate using AWS IAM credentials (access key/secret key or instance metadata) without storing any secrets in source code. It supports automatic credential rotation by leveraging AWS IAM roles and STS to generate temporary credentials, which Vault can validate via the AWS API. This eliminates the need for long-lived secrets in code and enables seamless rotation.

Answer

Token authentication

Answer

LDAP authentication

Answer

Userpass authentication

Question 12

An organization uses AppRole with secret_id generation via the Vault API. Security policy requires that each secret_id can be used only once and must expire after 1 hour. The configuration must use Vault's standard duration format with hour suffix (e.g., 1h). Which configuration option should be set on the AppRole role to enforce this?

Accepted Answer

secret_id_num_uses=1, secret_id_ttl=1h. The security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Option D is incorrect because it specifies the TTL in minutes (60m) instead of the required hours format. Therefore, only B satisfies the exact requirement.

Answer

secret_id_num_uses=1

Answer

secret_id_ttl=1h

Answer

secret_id_num_uses=1, secret_id_ttl=60m

Question 13

A company is migrating from on-premises to cloud and needs to authenticate applications using short-lived credentials. They have a mix of workloads: some on AWS EC2, some on Kubernetes, and some in their own datacenter. Which Vault authentication method provides a unified solution that works across all these environments without requiring a shared secret?

Accepted Answer

JWT/OIDC authentication. JWT/OIDC authentication is the correct choice because it provides a unified, standards-based method for verifying identity across AWS EC2, Kubernetes, and on-premises environments without requiring a shared secret. By leveraging OpenID Connect (OIDC) identity tokens issued by trusted providers (e.g., AWS IAM Identity Center, Kubernetes service account token, or an on-premises IdP), Vault can validate the token's signature and claims to authenticate workloads. This eliminates the need for pre-shared secrets or per-environment-specific integrations, making it ideal for heterogeneous deployments.

Answer

AWS IAM authentication

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 14

A large enterprise uses Azure Active Directory as its identity provider. They want to authenticate users to Vault using Azure AD tokens. However, they require that Vault validate the token's signature and claims without contacting Azure AD every time. Which authentication method should they use?

Accepted Answer

OIDC authentication. (OIDC authentication) is correct because OpenID Connect (OIDC) allows Vault to validate an Microsoft Entra ID token's signature and claims locally using the provider's JWKS (JSON Web Key Set) endpoint, without requiring a round-trip to Microsoft Entra ID for every authentication request. This satisfies the requirement for offline token validation while still leveraging Microsoft Entra ID as the identity provider.

Answer

LDAP authentication

Answer

Token authentication

Answer

Azure authentication

Question 15

An administrator needs to enable authentication method for human users that integrates with an existing LDAP directory. The company wants to ensure that Vault can perform group-based policy assignment based on LDAP group membership. Which configuration step is mandatory to map LDAP groups to Vault policies?

Accepted Answer

Set the 'groups' attribute to 'memberOf'. The 'groups' attribute mapping must be set to point to the LDAP attribute containing group membership. The 'users' attribute is for user mapping, 'upndomain' is for UPN suffix, 'certificate' is for TLS.

Answer

Set the 'upndomain' parameter to 'company.com'

Answer

Set the 'users' attribute to 'sAMAccountName'

Answer

Set the 'certificate' parameter with the LDAP server certificate