VA-003 Compare authentication methods Practice Test 3 — 15 Questions

Question 1

A security engineer is comparing the token auth method with other auth methods in Vault. Which TWO statements accurately describe how the token auth method differs from methods such as userpass or approle? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The token auth method supports creating tokens with a parent token, allowing hierarchical revocation of child tokens.. The token auth method is unique because Vault enables it permanently at the reserved token/ path and because it supports parent-child token creation for hierarchical revocation. Those two properties distinguish it from methods like userpass or approle, which are mounted at chosen paths and issue tokens through their own login endpoints without exposing parent token controls.

Answer

The token auth method requires an external identity provider to validate the token before use.

Answer

Tokens created by the token auth method never expire and must be manually revoked.

Answer

Tokens issued by other auth methods are not valid for API calls unless the token auth method is also enabled.

Question 2

An administrator is evaluating authentication methods for a mixed environment that includes human operators and automated batch jobs. The administrator wants methods that can issue tokens carrying identity metadata usable in Vault policies, and that support mapping external group or claim information to Vault policies. Which two authentication methods provide claim- or group-based policy mapping out of the box? (Choose two.)

Accepted Answer

OIDC auth, which maps claims from the ID token, such as groups or email, to Vault policies through the role's bound_claims and claim_mappings.. OIDC and LDAP both natively translate external identity information into Vault policy decisions: OIDC through bound_claims and claim_mappings on the role, and LDAP through directory group resolution tied to external group policies. Token, AppRole, and Cert auth authenticate without deriving policies from external group or claim data, so they do not fit the requirement.

Answer

Cert auth, which extracts organizational unit fields from the client certificate and maps each OU to a distinct Vault policy.

Answer

Token auth, which reads labels embedded in a wrapping token and maps them to policies at unwrap time.

Answer

AppRole auth, which parses group claims from the secret ID and maps them to policies automatically.

Question 3

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

Accepted Answer

JWT/OIDC. JWT/OIDC authentication allows a DevOps pipeline to exchange a signed JSON Web Token (JWT) from an external identity provider (e.g., GitHub Actions, GitLab CI) for a short-lived Vault token. This eliminates the need to store a long-lived secret in the CI/CD pipeline because the JWT is dynamically generated by the CI platform and validated by Vault using the OIDC provider's public keys. The resulting Vault token has a configurable TTL, typically minutes, aligning with the requirement for short-lived credentials.

Answer

AWS IAM

Answer

AppRole

Answer

Username & Password

Question 4

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

Accepted Answer

Kubernetes. The Kubernetes authentication method is correct because it allows pods to authenticate to Vault using their service account token, which is automatically mounted into the pod. This eliminates the need to hardcode any secrets in the pod definition, as Vault verifies the token against the Kubernetes API server and issues a temporary Vault token based on the pod's identity.

Answer

LDAP

Answer

Username & Password

Answer

AppRole

Question 5

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Accepted Answer

AWS. (AWS) is correct because the AWS authentication method in Vault allows EC2 instances to authenticate using their AWS instance identity documents and PKCS#7 signatures, without requiring any long-lived secrets to be stored on the instances. Vault verifies the instance's identity by calling the AWS EC2 API to validate the document and signature, then binds the instance to a Vault role. This eliminates the need to store tokens or credentials on the instance, meeting the requirement of secretless authentication.

Answer

OIDC

Answer

TLS Certificates

Answer

AppRole

Question 6

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Accepted Answer

Set secret_id_num_uses=1 in the role.. Setting `secret_id_num_uses=1` in the AppRole role configuration ensures that each SecretID can be used only once to obtain a token. Once the SecretID is used for login, it is automatically revoked and cannot be reused. This directly satisfies the requirement of single-use SecretIDs.

Answer

Set token_num_uses=1 in the role.

Answer

Set bound_cidr_list to a specific IP.

Answer

Set secret_id_ttl=1s in the role.

Question 7

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is the correct choice because it enables Vault to authenticate users against an external corporate Active Directory (AD) server. Vault's LDAP auth method binds to the AD directory using a service account, then validates user credentials via a simple bind operation, allowing seamless integration with existing corporate identity infrastructure.

Answer

Okta

Answer

AppRole

Answer

Userpass

Question 8

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Accepted Answer

Map the GitHub team to a Vault policy in the auth method configuration.. Vault's GitHub auth method requires mapping GitHub teams to Vault policies. When a user authenticates with a GitHub personal access token, Vault checks the token's associated teams against the configured team-to-policy mappings. Only users belonging to a mapped team receive the corresponding Vault policy, enabling access control based on team membership.

Answer

Vault validates the token's scope.

Answer

Users must generate a personal access token with repo scope.

Answer

The GitHub token must include the team scope.

Question 9

Which TWO authentication methods are designed for human users? (Choose two.)

Accepted Answer

OIDC. OIDC (Option D) is correct because it is an authentication method built for human users, allowing them to authenticate through an external OpenID Connect identity provider (e.g., Okta, Microsoft Entra ID, Google) using browser-based SSO flows rather than static secrets. Userpass (Option E) is also correct because it is Vault's native username-and-password method intended for interactive human logins, where credentials are stored as password hashes and can be rotated by the user. By contrast, AWS (Option A) is a machine-oriented method that authenticates workloads using AWS IAM credentials or instance metadata, not people. Kubernetes (Option B) is likewise designed for pods and service accounts to authenticate via Kubernetes ServiceAccount tokens, not human users. AppRole (Option C) is a machine-to-machine method that issues RoleID and SecretID credentials for automated applications, so it is not intended for human authentication.

Answer

AWS

Answer

Kubernetes

Answer

AppRole

Question 10

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Accepted Answer

The admin did not assign any policies to the user.. The most likely issue is that the admin created the user 'dev1' but did not assign any policies to that user. In Vault's Userpass auth method, simply creating a user does not attach any policies; the admin must explicitly specify the policies when creating or updating the user. Without a policy attached, the token issued upon login has no capabilities, resulting in a permission denied error even if the policy 'webapp-readonly' exists.

Answer

The policy 'webapp-readonly' does not exist.

Answer

The user 'dev1' does not exist.

Answer

The password is incorrect.

Question 11

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Accepted Answer

Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.. First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.

Answer

Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.

Answer

Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.

Answer

Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.

Question 12

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Accepted Answer

Enable the Kubernetes auth method, then configure it with the Kubernetes host and CA cert, then create a role that binds a service account, then deploy a pod using that service account, then verify login using the Vault token.. The correct sequence for setting up Vault's Kubernetes auth method is: enable the auth method, configure it with the Kubernetes API server details, create a role that binds to a service account, deploy a pod using that service account, and finally verify login. This order ensures that each prerequisite is fulfilled before the subsequent step can function correctly.

Answer

Configure the Kubernetes auth method with host and CA cert, then enable it, then create a role, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then create a role, then configure the auth method, then deploy a pod, then verify login.

Answer

Enable the Kubernetes auth method, then configure it, then deploy a pod, then create a role, then verify login.

Question 13

Match each Vault replication type to its behavior.

Accepted Answer

Performance Replication: Replicates mounts and policies but not secrets; used to scale read operations across clusters.. Performance Replication replicates mounts/policies (not secrets) for read scaling; DR Replication replicates everything for failover. Common confusions include swapping the two or inventing non-existent types like Snapshot or Local Replication.

Answer

Performance Replication: Replicates everything including secrets and tokens; used for failover.

Answer

Snapshot Replication: Replicates the entire state of Vault at a point in time for backup.

Answer

Disaster Recovery Replication: Replicates mounts and policies but not secrets; used to scale read operations.

Answer

Local Replication: Replicates data within a single cluster to ensure durability.

Question 14

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Accepted Answer

AWS IAM auth. AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.

Answer

GitHub personal access token

Answer

AppRole

Answer

Username & password (userpass)

Question 15

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Accepted Answer

The binddn or bindpass configured in Vault is incorrect. The error 'LDAP bind failed: invalid credentials' specifically indicates that the authentication attempt to the LDAP server using the configured binddn and bindpass failed. Since the LDAP server is reachable, the most direct cause is that the bind credentials stored in Vault's LDAP configuration do not match what the LDAP server expects. This is a configuration mismatch, not a connectivity or TLS issue.

Answer

Vault is not configured to use SSL/TLS for LDAP

Answer

The LDAP server does not allow anonymous binds

Answer

The LDAP server certificate is not trusted by Vault