VA-003 Compare authentication methods — Timed 40 Questions

Question 1

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Accepted Answer

Migrate users to an external identity provider and use LDAP or OIDC auth.. The Userpass auth method in Vault does not natively support password complexity or expiration policies. Migrating to an external identity provider (IdP) via LDAP or OIDC allows the organization to enforce these policies externally, where they are natively supported, and then federate authentication into Vault. This approach leverages the IdP's mature password management capabilities while maintaining Vault's authorization and audit controls.

Answer

Switch to token-based authentication and issue tokens with TTL.

Answer

Use Vault's password policy plugin with Userpass.

Answer

Configure password policies in Vault's Userpass auth method.

Question 2

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

Accepted Answer

Okta. Okta supports Time-based One-Time Password (TOTP) as an authentication factor, which is the standard method used by authenticator apps like Google Authenticator or Microsoft Authenticator. TOTP generates a temporary code based on a shared secret and the current time, as defined in RFC 6238, and Okta's multifactor authentication (MFA) policies can require this OTP for user login. This makes Okta the correct choice for authenticating with an OTP from an authenticator app.

Answer

Userpass

Answer

GitHub

Answer

LDAP

Question 3

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Accepted Answer

Kubernetes. Option C (Kubernetes) is correct because Vault's Kubernetes auth method has a pod present its service account JWT, which Vault validates against the Kubernetes TokenReview API; the pod holds no long-lived Vault credential, only a short-lived, auto-rotated token. Option E (AWS) is correct because the AWS auth method uses AWS IAM credentials or instance identity (e.g., an EC2 instance profile's signed STS GetCallerIdentity request) to prove identity, so no static Vault secret is stored on the machine. Option A (LDAP) is incorrect because LDAP auth requires the client to supply a username and password (a static secret) bound to a directory account. Option D (Userpass) is incorrect because it authenticates with a stored username/password pair configured in Vault. Option B (AppRole) is incorrect because, although it uses a RoleID and SecretID, the SecretID is a static secret that must be delivered to and stored by the client.

Answer

LDAP

Answer

AppRole

Answer

Userpass

Question 4

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Accepted Answer

Setting a secret_id_num_uses limit. AppRole security is strengthened by limiting how a SecretID can be used and how long it lives: option C, setting a secret_id_num_uses limit, restricts the SecretID to a fixed number of login attempts, so a leaked SecretID cannot be replayed indefinitely. Option D, binding the SecretID to a specific CIDR block, ensures the SecretID is only usable from an expected source network, preventing use from unauthorized hosts. Option E, setting a secret_id_ttl, gives the SecretID a finite lifetime so it expires automatically and cannot be used for long-term unauthorized access. The unmarked options do not belong because the RoleID is not a secret (it is often public and can be discovered), and while token policies are important for authorization, they govern what the resulting token can do rather than being a factor that secures the AppRole authentication method itself.

Answer

Keeping the RoleID secret

Answer

Configuring token policies

Question 5

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Accepted Answer

Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.. Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.

Answer

Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.

Answer

Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.

Answer

Use TLS cert auth, generate a certificate per microservice, and mount as a secret.

Question 6

Match each Vault secret engine to its primary purpose.

Accepted Answer

KV: Stores arbitrary secrets as key-value pairs.. Correct matches: KV -> static secrets, AWS -> dynamic AWS credentials, PKI -> certificates. Common confusions involve swapping purposes between engines.

Answer

KV: Generates dynamic database credentials.

Answer

AWS: Issues X.509 certificates.

Answer

Transit: Manages SSH keys.

Question 7

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Accepted Answer

Create separate AppRole roles for each application. Creating separate AppRole roles for each application allows the administrator to isolate token generation per application, preventing a single role from being overwhelmed by multiple clients. This maintains security by ensuring each application has its own set of credentials and policies, reducing the total number of tokens without compromising access control.

Answer

Decrease the token TTL on the AppRole role

Answer

Periodically rotate the secret ID

Answer

Set secret_id_num_uses to 1 on the AppRole role

Question 8

An organization uses Vault with the JWT/OIDC authentication method. After configuring the provider, users can authenticate, but the scopes requested do not include the email claim needed for policy mapping. What should the administrator do?

Accepted Answer

Add the 'email' scope to the OIDC auth method config. The email claim is not included in the JWT because the OIDC provider was not requested to issue it. In OIDC, claims are delivered only when the corresponding scope (e.g., 'email') is included in the authentication request. Adding the 'email' scope to the Vault OIDC auth method configuration ensures the provider returns the email claim, which can then be used for policy mapping.

Answer

Add a policy that uses the email claim

Answer

Modify the OIDC provider's configuration in Vault

Answer

Create a custom claim mapping in the OIDC auth method

Question 9

Which TWO of the following are valid authentication methods in HashiCorp Vault? (Choose two.)

Accepted Answer

GitHub. GitHub (A) is a valid Vault auth method: the GitHub auth method lets clients authenticate by presenting a GitHub personal access token, which Vault verifies against the GitHub API and then maps to a Vault token via configured policies. Cloud Foundry (D) is also a valid Vault auth method: it allows applications running in Cloud Foundry to authenticate using their CF instance identity (a signed CF instance certificate), which Vault validates against the CF API to issue a token. SAML (B) is not a native Vault auth method (SAML is typically handled via an OIDC/JWT-based flow or an external IdP, not a dedicated SAML auth backend). RADIUS (C) is not a built-in Vault auth method (Vault does not ship a RADIUS auth backend). SSH (E) is not an authentication method in Vault; Vault's SSH secrets engine is used to issue SSH credentials/certificates, not to authenticate clients to Vault.

Answer

SAML

Answer

RADIUS

Answer

SSH

Question 10

Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)

Accepted Answer

Token auth is always enabled and cannot be disabled. Option A is correct because the token auth method is built into Vault as the core authentication mechanism and is always enabled; it cannot be disabled, unlike other auth methods (e.g., userpass, LDAP, AWS, Kubernetes) that must be explicitly enabled and can be disabled. Option E is correct because the token auth method is primarily intended for Vault's internal token management—issuing, renewing, and revoking tokens—rather than for authenticating external end users, who normally authenticate through other methods that then issue them a token. Option B is wrong because token auth fully supports policies; tokens carry policies that determine the permissions granted to the client. Option C is wrong because periodic tokens are a property of tokens themselves and can be created via other auth methods as well (for example, by configuring a periodic token through token roles or auth method roles), not exclusively through token auth. Option D is wrong because the token auth method can indeed be used to create root tokens (for example, via `vault token create -policy=root` when permitted), so it is not a difference that excludes root token creation.

Answer

Token auth does not support policies

Answer

Token auth is the only method that can create periodic tokens

Answer

Token auth cannot be used to create a root token

Question 11

A development team wants to authenticate to Vault using a method that does not require storing secrets in source code and supports automatic rotation of credentials. Which authentication method best meets these requirements?

Accepted Answer

AWS IAM authentication. AWS IAM authentication allows Vault to authenticate using AWS IAM credentials (access key/secret key or instance metadata) without storing any secrets in source code. It supports automatic credential rotation by leveraging AWS IAM roles and STS to generate temporary credentials, which Vault can validate via the AWS API. This eliminates the need for long-lived secrets in code and enables seamless rotation.

Answer

Token authentication

Answer

LDAP authentication

Answer

Userpass authentication

Question 12

An organization uses AppRole with secret_id generation via the Vault API. Security policy requires that each secret_id can be used only once and must expire after 1 hour. The configuration must use Vault's standard duration format with hour suffix (e.g., 1h). Which configuration option should be set on the AppRole role to enforce this?

Accepted Answer

secret_id_num_uses=1, secret_id_ttl=1h. The security policy requires both single-use (secret_id_num_uses=1) and a 1-hour expiration (secret_id_ttl=1h). In Vault's AppRole authentication, secret_id_num_uses controls how many times a secret_id can be used, and secret_id_ttl sets the time-to-live. Option D is incorrect because it specifies the TTL in minutes (60m) instead of the required hours format. Therefore, only B satisfies the exact requirement.

Answer

secret_id_num_uses=1

Answer

secret_id_ttl=1h

Answer

secret_id_num_uses=1, secret_id_ttl=60m

Question 13

A company is migrating from on-premises to cloud and needs to authenticate applications using short-lived credentials. They have a mix of workloads: some on AWS EC2, some on Kubernetes, and some in their own datacenter. Which Vault authentication method provides a unified solution that works across all these environments without requiring a shared secret?

Accepted Answer

JWT/OIDC authentication. JWT/OIDC authentication is the correct choice because it provides a unified, standards-based method for verifying identity across AWS EC2, Kubernetes, and on-premises environments without requiring a shared secret. By leveraging OpenID Connect (OIDC) identity tokens issued by trusted providers (e.g., AWS IAM Identity Center, Kubernetes service account token, or an on-premises IdP), Vault can validate the token's signature and claims to authenticate workloads. This eliminates the need for pre-shared secrets or per-environment-specific integrations, making it ideal for heterogeneous deployments.

Answer

AWS IAM authentication

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 14

A large enterprise uses Azure Active Directory as its identity provider. They want to authenticate users to Vault using Azure AD tokens. However, they require that Vault validate the token's signature and claims without contacting Azure AD every time. Which authentication method should they use?

Accepted Answer

OIDC authentication. (OIDC authentication) is correct because OpenID Connect (OIDC) allows Vault to validate an Microsoft Entra ID token's signature and claims locally using the provider's JWKS (JSON Web Key Set) endpoint, without requiring a round-trip to Microsoft Entra ID for every authentication request. This satisfies the requirement for offline token validation while still leveraging Microsoft Entra ID as the identity provider.

Answer

LDAP authentication

Answer

Token authentication

Answer

Azure authentication

Question 15

An administrator needs to enable authentication method for human users that integrates with an existing LDAP directory. The company wants to ensure that Vault can perform group-based policy assignment based on LDAP group membership. Which configuration step is mandatory to map LDAP groups to Vault policies?

Accepted Answer

Set the 'groups' attribute to 'memberOf'. The 'groups' attribute mapping must be set to point to the LDAP attribute containing group membership. The 'users' attribute is for user mapping, 'upndomain' is for UPN suffix, 'certificate' is for TLS.

Answer

Set the 'upndomain' parameter to 'company.com'

Answer

Set the 'users' attribute to 'sAMAccountName'

Answer

Set the 'certificate' parameter with the LDAP server certificate

Question 16

Which TWO authentication methods support multi-factor authentication (MFA) natively within Vault Enterprise?

Accepted Answer

Userpass authentication. Userpass authentication (C) is correct because Vault Enterprise natively supports MFA on the userpass auth method, allowing a username/password login to be combined with a second factor such as TOTP, Duo, or Okta before a token is issued. LDAP authentication (D) is also correct because Vault Enterprise supports MFA enforcement on the LDAP auth method, so an LDAP bind can be paired with an additional MFA method during login. AWS IAM (A), Token (B), and Kubernetes (E) are not among the auth methods that support native MFA enforcement in Vault Enterprise; token auth is already a bearer credential, and AWS IAM/Kubernetes rely on their own signed or service-account assertions rather than Vault's MFA login flow.

Answer

AWS IAM authentication

Answer

Token authentication

Answer

Kubernetes authentication

Question 17

Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?

Accepted Answer

AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.. Option A is correct because AppRole is a machine-oriented auth method that authenticates with a role_id (identifying the role) plus a secret_id (the secret half of the credential pair), whereas the Kubernetes auth method authenticates a pod by presenting its Kubernetes service account token. Option C is correct because the Kubernetes auth method validates a JWT/service account token that is issued and signed by the Kubernetes API server, verifying it against the cluster's token review and the configured issuer/keys. Option B is wrong because secret_id is an AppRole concept, not a Kubernetes auth requirement, and Kubernetes auth does not require a secret_id in a configuration file. Option D is wrong because response wrapping is a general Vault feature available across auth methods, so it is not a distinguishing difference between AppRole and Kubernetes. Option E is wrong because neither method forces a fixed token type: token type (service vs. batch) is determined by the role's token configuration, not by the auth method itself.

Answer

Kubernetes auth requires the secret_id to be specified in a configuration file.

Answer

Both AppRole and Kubernetes support response wrapping for initial credentials.

Answer

AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.

Question 18

Which THREE authentication methods support generating tokens with TTL and renewable options?

Accepted Answer

Userpass authentication. Userpass authentication (B) is correct because Vault's userpass auth method issues a client token upon login whose TTL and max_ttl are governed by the method's token configuration and the user's policies, and that token can be renewed via the token renewal endpoint. Token authentication (D) is correct because tokens themselves are the core credential type in Vault: they carry an explicit TTL and max_ttl, and clients can renew them with 'vault token renew' or the auth/token/renew API, optionally using periodic tokens for indefinite renewal. LDAP authentication (E) is correct because the LDAP auth method returns a Vault token on successful bind, and its TTL, max_ttl, and renewability are configurable through the method's token settings just like other auth backends. Kubernetes authentication (A) does issue tokens with configurable TTLs, but it is not among the marked correct answers here, so it is excluded. AppRole authentication (C) likewise produces tokens with TTL and renewal behavior, but it is not marked correct in this question and is therefore not counted.

Answer

Kubernetes authentication

Answer

AppRole authentication

Question 19

A Vault administrator runs `vault auth list` and sees the output above. The administrator wants to disable the default token authentication method to improve security. Which command should they run?

Accepted Answer

vault auth disable token/. The `vault auth list` output shows that the default token authentication method is enabled at the `token/` path. To disable it, the administrator must run `vault auth disable token/`, which removes the token auth method entirely. This improves security by preventing unauthenticated users from using the default token login endpoint, forcing the use of other configured auth methods like LDAP or AppRole.

Answer

vault auth disable userpass/

Answer

vault auth disable ldap/

Answer

vault auth disable approle/

Question 20

A user 'john' logs in via the userpass method. The output shows a token with a duration of 768 hours. However, the userpass mount is configured with `token_ttl=24h`. What is the most likely reason for the longer token duration?

Accepted Answer

The user has a custom `ttl` set in the userpass configuration for user 'john'.. The userpass mount allows per-user TTL overrides via the `token_ttl` parameter when creating or updating a user. Even though the mount has a default `token_ttl=24h`, if user 'john' was configured with a specific `token_ttl` of 768 hours, that per-user setting takes precedence over the mount-level default. This is a common way to grant specific users longer token lifetimes without changing the mount's default policy.

Answer

The system backend is configured with a max_ttl that overrides the mount setting.

Answer

The mount token_ttl is only applied if the user does not specify a `token_policies` parameter.

Answer

The token was issued with a periodic token and ignores the TTL.