VA-003 Compare authentication methods — 30 Questions

Question 1

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

Accepted Answer

JWT/OIDC. JWT/OIDC authentication allows a DevOps pipeline to exchange a signed JSON Web Token (JWT) from an external identity provider (e.g., GitHub Actions, GitLab CI) for a short-lived Vault token. This eliminates the need to store a long-lived secret in the CI/CD pipeline because the JWT is dynamically generated by the CI platform and validated by Vault using the OIDC provider's public keys. The resulting Vault token has a configurable TTL, typically minutes, aligning with the requirement for short-lived credentials.

Answer

AWS IAM

Answer

AppRole

Answer

Username & Password

Question 2

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

Accepted Answer

Kubernetes. The Kubernetes authentication method is correct because it allows pods to authenticate to Vault using their service account token, which is automatically mounted into the pod. This eliminates the need to hardcode any secrets in the pod definition, as Vault verifies the token against the Kubernetes API server and issues a temporary Vault token based on the pod's identity.

Answer

LDAP

Answer

Username & Password

Answer

AppRole

Question 3

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Accepted Answer

Migrate users to an external identity provider and use LDAP or OIDC auth.. The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.

Answer

Switch to token-based authentication and issue tokens with TTL.

Answer

Use Vault's password policy plugin with Userpass.

Answer

Configure password policies in Vault's Userpass auth method.

Question 4

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Accepted Answer

AWS. Option B (AWS) is correct because the AWS authentication method in Vault allows EC2 instances to authenticate using their AWS instance identity documents and PKCS#7 signatures, without requiring any long-lived secrets to be stored on the instances. Vault verifies the instance's identity by calling the AWS EC2 API to validate the document and signature, then binds the instance to a Vault role. This eliminates the need to store tokens or credentials on the instance, meeting the requirement of secretless authentication.

Answer

OIDC

Answer

TLS Certificates

Answer

AppRole

Question 5

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Accepted Answer

Set secret_id_num_uses=1 in the role.. Option D is correct because setting `secret_id_num_uses=1` in the AppRole role configuration ensures that each SecretID can be used only once to obtain a token. Once the SecretID is used for login, it is automatically revoked and cannot be reused. This directly satisfies the requirement of single-use SecretIDs.

Answer

Set token_num_uses=1 in the role.

Answer

Set bound_cidr_list to a specific IP.

Answer

Set secret_id_ttl=1s in the role.

Question 6

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

Accepted Answer

Okta. Okta supports Time-based One-Time Password (TOTP) as an authentication factor, which is the standard method used by authenticator apps like Google Authenticator or Microsoft Authenticator. TOTP generates a temporary code based on a shared secret and the current time, as defined in RFC 6238, and Okta's multifactor authentication (MFA) policies can require this OTP for user login. This makes Okta the correct choice for authenticating with an OTP from an authenticator app.

Answer

Userpass

Answer

GitHub

Answer

LDAP

Question 7

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it enables Vault to authenticate users against an external corporate Active Directory (AD) server. Vault's LDAP auth method binds to the AD directory using a service account, then validates user credentials via a simple bind operation, allowing seamless integration with existing corporate identity infrastructure.

Answer

Okta

Answer

AppRole

Answer

Userpass

Question 8

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Accepted Answer

Map the GitHub team to a Vault policy in the auth method configuration.. Option D is correct because Vault's GitHub auth method requires mapping GitHub teams to Vault policies. When a user authenticates with a GitHub personal access token, Vault checks the token's associated teams against the configured team-to-policy mappings. Only users belonging to a mapped team receive the corresponding Vault policy, enabling access control based on team membership.

Answer

Vault validates the token's scope.

Answer

Users must generate a personal access token with repo scope.

Answer

The GitHub token must include the team scope.

Question 9

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Accepted Answer

Kubernetes. Kubernetes authentication in Vault uses the Kubernetes service account token (a JWT) to authenticate. The JWT is dynamically generated by the Kubernetes API server and is not a static secret stored by the machine; Vault verifies it against the Kubernetes API server's token review endpoint. This allows the machine to authenticate without storing a long-lived static credential.

Answer

LDAP

Answer

AppRole

Answer

Userpass

Question 10

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Accepted Answer

Setting a secret_id_num_uses limit. Option C is correct because setting a `secret_id_num_uses` limit restricts the number of times a SecretID can be used to obtain a token from Vault. This prevents replay attacks and limits the blast radius if a SecretID is leaked, as it becomes invalid after the specified number of uses.

Answer

Keeping the RoleID secret

Answer

Configuring token policies

Question 11

Which TWO authentication methods are designed for human users? (Choose two.)

Accepted Answer

OIDC. OIDC (OpenID Connect) is an identity layer built on top of OAuth 2.0 that allows human users to authenticate via an external identity provider (IdP) using tokens (ID tokens in JWT format). It is specifically designed for human user authentication, enabling single sign-on (SSO) across applications.

Answer

AWS

Answer

Kubernetes

Answer

AppRole

Question 12

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Accepted Answer

Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.. Option D is correct because Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.

Answer

Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.

Answer

Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.

Answer

Use TLS cert auth, generate a certificate per microservice, and mount as a secret.

Question 13

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Accepted Answer

The admin did not assign any policies to the user.. The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.

Answer

The policy 'webapp-readonly' does not exist.

Answer

The user 'dev1' does not exist.

Answer

The password is incorrect.

Question 14

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Question 15

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Question 16

Match each Vault secret engine to its primary purpose.

Question 17

Match each Vault replication type to its behavior.

Question 18

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Accepted Answer

AWS IAM auth. AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.

Answer

GitHub personal access token

Answer

AppRole

Answer

Username & password (userpass)

Question 19

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Accepted Answer

Create separate AppRole roles for each application. Option B is correct because creating separate AppRole roles for each application allows better control and reduces token blast radius. Option A is wrong because increasing secret_id_num_uses doesn't limit token count per use. Option C is wrong because decreasing token TTL might cause more frequent renewal but not reduce total token count necessarily. Option D is wrong because periodically rotating secret IDs doesn't limit token generation.

Answer

Decrease the token TTL on the AppRole role

Answer

Periodically rotate the secret ID

Answer

Set secret_id_num_uses to 1 on the AppRole role

Question 20

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault