VA-003 Compare authentication methods Practice Test 2 — 15 Questions

Question 1

Match each Vault secret engine to its primary purpose.

Question 2

Match each Vault replication type to its behavior.

Question 3

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Accepted Answer

AWS IAM auth. AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.

Answer

GitHub personal access token

Answer

AppRole

Answer

Username & password (userpass)

Question 4

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Accepted Answer

Create separate AppRole roles for each application. Option B is correct because creating separate AppRole roles for each application allows better control and reduces token blast radius. Option A is wrong because increasing secret_id_num_uses doesn't limit token count per use. Option C is wrong because decreasing token TTL might cause more frequent renewal but not reduce total token count necessarily. Option D is wrong because periodically rotating secret IDs doesn't limit token generation.

Answer

Decrease the token TTL on the AppRole role

Answer

Periodically rotate the secret ID

Answer

Set secret_id_num_uses to 1 on the AppRole role

Question 5

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault

Question 6

An administrator wants to allow users to authenticate to Vault using their existing corporate GitHub accounts. Which authentication method should be enabled?

Accepted Answer

GitHub. The GitHub authentication method in Vault allows users to authenticate using their existing corporate GitHub accounts by mapping GitHub teams to Vault policies. This is the only option that directly integrates with GitHub's OAuth-based authentication flow, enabling single sign-on without requiring additional directory services or identity providers.

Answer

LDAP

Answer

Okta

Answer

Username & password (userpass)

Question 7

A company has a Vault cluster and wants to allow applications running in Kubernetes pods to authenticate without storing static secrets. Which Vault authentication method is specifically designed for Kubernetes?

Accepted Answer

Kubernetes. The Kubernetes auth method is specifically designed for Kubernetes workloads. It allows pods to authenticate to Vault using their Kubernetes service account token, which Vault validates against the Kubernetes API server. This eliminates the need to store static secrets in the cluster.

Answer

AWS IAM

Answer

JWT/OIDC

Answer

AppRole

Question 8

During an audit, it is discovered that a single AppRole role is used by hundreds of applications, and it is impossible to revoke access for a single compromised application without affecting others. What should be done to improve the security posture?

Accepted Answer

Create a unique AppRole role for each application. Creating a unique AppRole role for each application ensures that each application has its own set of credentials (RoleID and SecretID). This allows you to revoke access for a single compromised application by deleting or disabling its specific AppRole role, without impacting other applications. This directly addresses the core issue of shared credentials and provides granular access control.

Answer

Schedule periodic secret ID rotation

Answer

Reduce the token TTL to 1 minute

Answer

Add CIDR bindings to the AppRole role

Question 9

Which authentication method in Vault uses a shared secret (Role ID) and a dynamic secret (Secret ID) to authenticate machines or applications?

Accepted Answer

AppRole. AppRole is the correct authentication method because it is specifically designed for machine-to-machine or application-to-application authentication in Vault. It uses a static Role ID (like a username) combined with a dynamically generated Secret ID (like a password) that can be created, revoked, or have a time-to-live, providing a secure and flexible way for non-human entities to obtain a Vault token.

Answer

LDAP

Answer

Username & password (userpass)

Answer

Okta

Question 10

A Vault administrator needs to allow users to authenticate using their existing corporate Active Directory credentials. The administrator has configured the LDAP authentication method but users cannot log in. The Vault logs show 'LDAP bind successful' but then 'user not found in group' error. What is the most likely issue?

Accepted Answer

The groupfilter or groupattr configuration is incorrect. The error 'LDAP bind successful' confirms that the Vault server can connect and authenticate to the LDAP server using the bind credentials. The subsequent 'user not found in group' error indicates that while the user exists and can bind, the group membership lookup fails. This is most commonly caused by an incorrect `groupfilter` or `groupattr` configuration, which defines how Vault queries the LDAP directory to map users to groups for authorization.

Answer

The LDAP server hostname is incorrect

Answer

The userattr configuration is incorrect

Answer

The LDAP server does not allow anonymous queries

Question 11

An organization uses Vault with the JWT/OIDC authentication method. After configuring the provider, users can authenticate, but the scopes requested do not include the email claim needed for policy mapping. What should the administrator do?

Accepted Answer

Add the 'email' scope to the OIDC auth method config. The email claim is not included in the JWT because the OIDC provider was not requested to issue it. In OIDC, claims are delivered only when the corresponding scope (e.g., 'email') is included in the authentication request. Adding the 'email' scope to the Vault OIDC auth method configuration ensures the provider returns the email claim, which can then be used for policy mapping.

Answer

Add a policy that uses the email claim

Answer

Modify the OIDC provider's configuration in Vault

Answer

Create a custom claim mapping in the OIDC auth method

Question 12

Which TWO of the following are valid authentication methods in HashiCorp Vault? (Choose two.)

Accepted Answer

GitHub. GitHub is a valid authentication method in HashiCorp Vault. It allows users to authenticate using their GitHub personal access tokens, which are mapped to Vault policies based on the user's team membership in a specified GitHub organization. This method is commonly used for integrating Vault with existing GitHub workflows.

Answer

SAML

Answer

RADIUS

Answer

SSH

Question 13

Which THREE of the following are true statements about the AppRole authentication method? (Choose three.)

Accepted Answer

Vault can generate a wrapped Secret ID for secure delivery. Option B is correct because Vault supports wrapping the Secret ID in a single-use, time-limited JWT-based response-wrapping token. This allows the Secret ID to be securely delivered to the target application without exposing it in transit, as the wrapping token can be unwrapped only by the intended recipient using a separate unwrap operation.

Answer

The Secret ID contains the token policies

Answer

The Secret ID can only be used once

Question 14

Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)

Accepted Answer

Token auth is always enabled and cannot be disabled. Token auth is always enabled and cannot be disabled because it is the core authentication mechanism that Vault uses internally to represent all authenticated sessions. Every other auth method ultimately produces a Vault token, making the token auth method the foundational layer that cannot be removed or turned off without breaking Vault's entire authentication model.

Answer

Token auth does not support policies

Answer

Token auth is the only method that can create periodic tokens

Answer

Token auth cannot be used to create a root token

Question 15

Refer to the exhibit. Which authentication method is currently enabled for production applications?

Accepted Answer

AppRole. The exhibit shows that the production applications are configured with the 'AppRole' authentication method, which is indicated by the presence of a RoleID and SecretID in the application configuration. AppRole is a machine-oriented authentication method in HashiCorp Vault that allows applications to authenticate using a pair of credentials (RoleID and SecretID), making it suitable for automated, non-human workflows. The other methods listed (Token, LDAP, Userpass) are either human-centric or not configured for these applications.

Answer

Token

Answer

LDAP

Answer

Userpass