VA-003 Compare authentication methods Practice Test 1 — 15 Questions

Question 1

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

Accepted Answer

JWT/OIDC. JWT/OIDC authentication allows a DevOps pipeline to exchange a signed JSON Web Token (JWT) from an external identity provider (e.g., GitHub Actions, GitLab CI) for a short-lived Vault token. This eliminates the need to store a long-lived secret in the CI/CD pipeline because the JWT is dynamically generated by the CI platform and validated by Vault using the OIDC provider's public keys. The resulting Vault token has a configurable TTL, typically minutes, aligning with the requirement for short-lived credentials.

Answer

AWS IAM

Answer

AppRole

Answer

Username & Password

Question 2

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

Accepted Answer

Kubernetes. The Kubernetes authentication method is correct because it allows pods to authenticate to Vault using their service account token, which is automatically mounted into the pod. This eliminates the need to hardcode any secrets in the pod definition, as Vault verifies the token against the Kubernetes API server and issues a temporary Vault token based on the pod's identity.

Answer

LDAP

Answer

Username & Password

Answer

AppRole

Question 3

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Accepted Answer

Migrate users to an external identity provider and use LDAP or OIDC auth.. The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.

Answer

Switch to token-based authentication and issue tokens with TTL.

Answer

Use Vault's password policy plugin with Userpass.

Answer

Configure password policies in Vault's Userpass auth method.

Question 4

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Accepted Answer

AWS. (AWS) is correct because the AWS authentication method in Vault allows EC2 instances to authenticate using their AWS instance identity documents and PKCS#7 signatures, without requiring any long-lived secrets to be stored on the instances. Vault verifies the instance's identity by calling the AWS EC2 API to validate the document and signature, then binds the instance to a Vault role. This eliminates the need to store tokens or credentials on the instance, meeting the requirement of secretless authentication.

Answer

OIDC

Answer

TLS Certificates

Answer

AppRole

Question 5

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Accepted Answer

Set secret_id_num_uses=1 in the role.. Setting `secret_id_num_uses=1` in the AppRole role configuration ensures that each SecretID can be used only once to obtain a token. Once the SecretID is used for login, it is automatically revoked and cannot be reused. This directly satisfies the requirement of single-use SecretIDs.

Answer

Set token_num_uses=1 in the role.

Answer

Set bound_cidr_list to a specific IP.

Answer

Set secret_id_ttl=1s in the role.

Question 6

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

Accepted Answer

Okta. Okta supports Time-based One-Time Password (TOTP) as an authentication factor, which is the standard method used by authenticator apps like Google Authenticator or Microsoft Authenticator. TOTP generates a temporary code based on a shared secret and the current time, as defined in RFC 6238, and Okta's multifactor authentication (MFA) policies can require this OTP for user login. This makes Okta the correct choice for authenticating with an OTP from an authenticator app.

Answer

Userpass

Answer

GitHub

Answer

LDAP

Question 7

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it enables Vault to authenticate users against an external corporate Active Directory (AD) server. Vault's LDAP auth method binds to the AD directory using a service account, then validates user credentials via a simple bind operation, allowing seamless integration with existing corporate identity infrastructure.

Answer

Okta

Answer

AppRole

Answer

Userpass

Question 8

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Accepted Answer

Map the GitHub team to a Vault policy in the auth method configuration.. Vault's GitHub auth method requires mapping GitHub teams to Vault policies. When a user authenticates with a GitHub personal access token, Vault checks the token's associated teams against the configured team-to-policy mappings. Only users belonging to a mapped team receive the corresponding Vault policy, enabling access control based on team membership.

Answer

Vault validates the token's scope.

Answer

Users must generate a personal access token with repo scope.

Answer

The GitHub token must include the team scope.

Question 9

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Accepted Answer

Kubernetes. Kubernetes authentication in Vault uses the Kubernetes service account token (a JWT) to authenticate. The JWT is dynamically generated by the Kubernetes API server and is not a static secret stored by the machine; Vault verifies it against the Kubernetes API server's token review endpoint. This allows the machine to authenticate without storing a long-lived static credential.

Answer

LDAP

Answer

AppRole

Answer

Userpass

Question 10

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Accepted Answer

Setting a secret_id_num_uses limit. Setting a `secret_id_num_uses` limit restricts the number of times a SecretID can be used to obtain a token from Vault. This prevents replay attacks and limits the blast radius if a SecretID is leaked, as it becomes invalid after the specified number of uses.

Answer

Keeping the RoleID secret

Answer

Configuring token policies

Question 11

Which TWO authentication methods are designed for human users? (Choose two.)

Accepted Answer

OIDC. OIDC (OpenID Connect) is an identity layer built on top of OAuth 2.0 that allows human users to authenticate via an external identity provider (IdP) using tokens (ID tokens in JWT format). It is specifically designed for human user authentication, enabling single sign-on (SSO) across applications.

Answer

AWS

Answer

Kubernetes

Answer

AppRole

Question 12

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Accepted Answer

Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.. Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.

Answer

Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.

Answer

Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.

Answer

Use TLS cert auth, generate a certificate per microservice, and mount as a secret.

Question 13

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Accepted Answer

The admin did not assign any policies to the user.. The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.

Answer

The policy 'webapp-readonly' does not exist.

Answer

The user 'dev1' does not exist.

Answer

The password is incorrect.

Question 14

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 15

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Accepted Answer

Enable the Kubernetes auth method, then configure it with the Kubernetes host and CA cert, then create a role that binds a service account, then deploy a pod using that service account, then verify login using the Vault token.. The correct sequence for setting up Vault's Kubernetes auth method is: enable the auth method, configure it with the Kubernetes API server details, create a role that binds to a service account, deploy a pod using that service account, and finally verify login. This order ensures that each prerequisite is fulfilled before the subsequent step can function correctly.

Answer

Configure the Kubernetes auth method with host and CA cert, then enable it, then create a role, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then create a role, then configure the auth method, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then configure it, then deploy a pod, then create a role, then verify login.