VA-003 Compare authentication methods Practice Test 3 — 15 Questions

Question 1

A development team wants to authenticate to Vault using a method that does not require storing secrets in source code and supports automatic rotation of credentials. Which authentication method best meets these requirements?

Accepted Answer

AWS IAM authentication. AWS IAM authentication allows Vault to authenticate using AWS IAM credentials (access key/secret key or instance metadata) without storing any secrets in source code. It supports automatic credential rotation by leveraging AWS IAM roles and STS to generate temporary credentials, which Vault can validate via the AWS API. This eliminates the need for long-lived secrets in code and enables seamless rotation.

Answer

Token authentication

Answer

LDAP authentication

Answer

Userpass authentication

Question 2

An organization uses AppRole with secret_id generation via the Vault API. Security policy requires that each secret_id can be used only once and must expire after 1 hour. Which configuration option should be set on the AppRole role to enforce this?

Accepted Answer

secret_id_num_uses=1, secret_id_ttl=1h. Option B is correct because the security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Setting both ensures the secret_id is invalidated after one use or after one hour, whichever comes first, meeting the policy exactly.

Answer

secret_id_num_uses=1

Answer

secret_id_ttl=1h

Answer

secret_id_num_uses=1, secret_id_ttl=60m

Question 3

A company is migrating from on-premises to cloud and needs to authenticate applications using short-lived credentials. They have a mix of workloads: some on AWS EC2, some on Kubernetes, and some in their own datacenter. Which Vault authentication method provides a unified solution that works across all these environments without requiring a shared secret?

Accepted Answer

JWT/OIDC authentication. JWT/OIDC authentication is the correct choice because it provides a unified, standards-based method for verifying identity across AWS EC2, Kubernetes, and on-premises environments without requiring a shared secret. By leveraging OpenID Connect (OIDC) identity tokens issued by trusted providers (e.g., AWS IAM Identity Center, Kubernetes service account token, or an on-premises IdP), Vault can validate the token's signature and claims to authenticate workloads. This eliminates the need for pre-shared secrets or per-environment-specific integrations, making it ideal for heterogeneous deployments.

Answer

AWS IAM authentication

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 4

A CI/CD pipeline runs in a Kubernetes cluster and needs to authenticate to Vault to fetch secrets. The pipeline should not have to manage any long-lived credentials. Which authentication method is most suitable?

Accepted Answer

Kubernetes authentication. The Kubernetes authentication method allows the CI/CD pipeline to authenticate to Vault using its Kubernetes service account token, which is automatically mounted into the pod. This eliminates the need for managing long-lived credentials because Vault verifies the token against the Kubernetes API server and issues a short-lived Vault token in return.

Answer

Token authentication

Answer

LDAP authentication

Answer

AWS IAM authentication

Question 5

An administrator wants to use Vault's authentication method that allows users to log in with their corporate credentials via a federated identity system. The credentials are stored in an external identity provider (IdP) and Vault should not store any passwords. Which authentication method should be configured?

Accepted Answer

OIDC authentication. OIDC authentication delegates authentication to an external IdP, Vault never sees the password. LDAP stores hashed passwords at rest, userpass stores hashed passwords, and token is Vault-native.

Answer

LDAP authentication

Answer

Userpass authentication

Answer

Token authentication

Question 6

A large enterprise uses Azure Active Directory as its identity provider. They want to authenticate users to Vault using Azure AD tokens. However, they require that Vault validate the token's signature and claims without contacting Azure AD every time. Which authentication method should they use?

Accepted Answer

OIDC authentication. Option B (OIDC authentication) is correct because OpenID Connect (OIDC) allows Vault to validate an Azure AD token's signature and claims locally using the provider's JWKS (JSON Web Key Set) endpoint, without requiring a round-trip to Azure AD for every authentication request. This satisfies the requirement for offline token validation while still leveraging Azure AD as the identity provider.

Answer

LDAP authentication

Answer

Token authentication

Answer

Azure authentication

Question 7

A security team wants to allow applications to authenticate to Vault without storing any secrets in configuration files. The applications run on AWS EC2 instances with an IAM role attached. Which Vault authentication method leverages the EC2 instance metadata to obtain credentials?

Accepted Answer

AWS IAM authentication. AWS IAM authentication (option D) is correct because it allows applications running on EC2 instances with an attached IAM role to authenticate to Vault without storing any secrets. The Vault client uses the EC2 instance metadata service (IMDS) to retrieve the instance identity document and its signature, which are then presented to Vault. Vault verifies these credentials against the AWS API, confirming the instance's identity and IAM role, thereby enabling secure, secretless authentication.

Answer

GCP IAM authentication

Answer

Userpass authentication

Answer

AppRole authentication

Question 8

An administrator needs to enable authentication method for human users that integrates with an existing LDAP directory. The company wants to ensure that Vault can perform group-based policy assignment based on LDAP group membership. Which configuration step is mandatory to map LDAP groups to Vault policies?

Accepted Answer

Set the 'groups' attribute to 'memberOf'. The 'groups' attribute mapping must be set to point to the LDAP attribute containing group membership. The 'users' attribute is for user mapping, 'upndomain' is for UPN suffix, 'certificate' is for TLS.

Answer

Set the 'upndomain' parameter to 'company.com'

Answer

Set the 'users' attribute to 'sAMAccountName'

Answer

Set the 'certificate' parameter with the LDAP server certificate

Question 9

A company uses both userpass and AppRole authentication methods. They notice that tokens issued via AppRole are not properly revoked when the corresponding secret_id is deleted. Which concept explains this behavior?

Accepted Answer

Tokens are independent of secret_id after login; deleting secret_id does not revoke the token.. When a token is issued via AppRole, the token is created after a successful login using a secret_id. The token itself is independent of the secret_id; deleting the secret_id does not affect the token's lifecycle. Token revocation must be performed explicitly on the token, not by removing the secret_id.

Answer

The secret_id TTL was not set, causing the token to outlive the secret_id.

Answer

AppRole does not support entity aliases, so revoking the secret_id does not affect the token.

Answer

The token was created with a periodic token and cannot be revoked.

Question 10

Which TWO authentication methods support multi-factor authentication (MFA) natively within Vault Enterprise?

Accepted Answer

Userpass authentication. Userpass authentication in Vault Enterprise supports MFA natively because it can be configured with a second factor such as TOTP, Duo, or Okta directly within the auth method's configuration. This allows the userpass method to enforce both a password and an additional authentication factor without requiring an external identity provider or custom wrapper.

Answer

AWS IAM authentication

Answer

Token authentication

Answer

Kubernetes authentication

Question 11

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.. Option A is correct because AppRole authentication indeed requires a RoleID and SecretID to be presented by the client to obtain a Vault token, whereas Kubernetes authentication requires a service account token (a JWT) that is signed by the Kubernetes API server. This is a fundamental difference in the credential material each method uses to prove identity.

Answer

Kubernetes auth requires the secret_id to be specified in a configuration file.

Answer

Both AppRole and Kubernetes support response wrapping for initial credentials.

Answer

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Question 12

Which THREE authentication methods support generating tokens with TTL and renewable options?

Accepted Answer

Userpass authentication. Userpass authentication (B) is correct because Vault's userpass auth method supports token generation with configurable TTL (time-to-live) and renewable options via the `token_ttl` and `token_renewable` parameters in the auth method configuration or role settings. This allows administrators to enforce session lifetimes and permit token renewal for user accounts authenticated via username/password.

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 13

A Vault administrator runs `vault auth list` and sees the output above. The administrator wants to disable the default token authentication method to improve security. Which command should they run?

Accepted Answer

vault auth disable token/. The `vault auth list` output shows that the default token authentication method is enabled at the `token/` path. To disable it, the administrator must run `vault auth disable token/`, which removes the token auth method entirely. This improves security by preventing unauthenticated users from using the default token login endpoint, forcing the use of other configured auth methods like LDAP or AppRole.

Answer

vault auth disable userpass/

Answer

vault auth disable ldap/

Answer

vault auth disable approle/

Question 14

A user 'john' logs in via the userpass method. The output shows a token with a duration of 768 hours. However, the userpass mount is configured with `token_ttl=24h`. What is the most likely reason for the longer token duration?

Accepted Answer

The user has a custom `ttl` set in the userpass configuration for user 'john'.. Option B is correct because the userpass mount allows per-user TTL overrides via the `token_ttl` parameter when creating or updating a user. Even though the mount has a default `token_ttl=24h`, if user 'john' was configured with a specific `token_ttl` of 768 hours, that per-user setting takes precedence over the mount-level default. This is a common way to grant specific users longer token lifetimes without changing the mount's default policy.

Answer

The system backend is configured with a max_ttl that overrides the mount setting.

Answer

The mount token_ttl is only applied if the user does not specify a `token_policies` parameter.

Answer

The token was issued with a periodic token and ignores the TTL.

Question 15

A Vault administrator is configuring AppRole authentication via the configuration file shown. After running `vault server -config=config.json`, they try to enable AppRole at a different path. What will happen?

Accepted Answer

The admin can enable AppRole at another path without issues.. Option C is correct because AppRole authentication can be enabled at any mount path, regardless of whether it is pre-configured in the Vault configuration file. The configuration file only defines the initial backend settings; it does not prevent the admin from enabling the same auth method at a different path using the `vault auth enable` command. Vault allows multiple mounts of the same auth method type at different paths, each with its own configuration.

Answer

The backend will be disabled when Vault starts.

Answer

The admin must modify the config file to change the path.

Answer

Vault will fail to start because the path is already used.