VA-003 Compare authentication methods Practice Question
A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?
⚠ Common exam trap
HashiCorp often tests the misconception that AppRole is the best choice for automated workloads, but the trap here is that AppRole still requires storing a secret ID, whereas AWS IAM auth eliminates all long-lived credentials by leveraging the EC2 instance's IAM role and temporary AWS credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM auth
AWS IAM auth is the most appropriate and secure method because it allows Jenkins jobs running on EC2 instances to authenticate to Vault using the instance's AWS IAM role without storing any long-lived credentials. The EC2 instance obtains temporary AWS credentials via the instance metadata service (IMDS), and Vault validates these against AWS STS to issue a short-lived Vault token. This eliminates the need to manage static secrets or tokens in Jenkins job configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GitHub personal access token
Why it's wrong here
A GitHub personal access token authenticates to GitHub, not to Vault, and is itself a long-lived credential requiring storage and rotation. It would be correct for Vault's GitHub auth method only when Jenkins runs in GitHub Actions with an OIDC token, not on EC2.
- ✓
AWS IAM auth
Why this is correct
AWS IAM auth lets each EC2 instance present its instance profile credentials to Vault, which verifies them against AWS STS and returns a short-lived Vault token. No long-lived secrets are stored on the Jenkins hosts, satisfying the constraint.
- ✗
AppRole
Why it's wrong here
AppRole suits CI/CD pipelines that can inject a RoleID and SecretID, but EC2 instances already carry an instance identity document, so the AWS auth method exchanges that signed metadata for a Vault token without any stored secret. AppRole would require distributing and rotating those two credentials.
- ✗
Username & password (userpass)
Why it's wrong here
Userpass relies on static credentials stored and rotated manually, directly violating the no-long-lived-credentials requirement. It suits interactive human logins where a person supplies a password. For automated EC2 workloads, AWS IAM auth with a Vault role and instance identity is the credential-free mechanism.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.