VA-003 Compare authentication methods Practice Question
This VA-003 practice question tests your understanding of compare authentication methods. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.
Option D is correct because Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.
Why it's wrong here
A single role allows any pod in the namespace to authenticate, violating per-service isolation.
✗
Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.
Why it's wrong here
This stores secrets in Kubernetes secrets, violating the mandate.
✗
Use TLS cert auth, generate a certificate per microservice, and mount as a secret.
Why it's wrong here
This stores certificates, which are secrets.
✓
Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.
Why this is correct
Kubernetes auth can bind to specific service accounts, and policies enforce access.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think Kubernetes auth cannot restrict access per pod, but Cisco tests that by binding Vault roles to specific service account names (not just namespaces), you achieve per-microservice isolation without storing any secrets in the cluster.
Detailed technical explanation
How to think about this question
Under the hood, Vault's Kubernetes auth method validates the JWT token presented by a pod against the Kubernetes TokenReview API, and the bound service account names in the Vault role are matched against the `sub` claim (e.g., `system:serviceaccount:<namespace>:<sa-name>`) in the JWT. This allows fine-grained access control without ever storing static secrets in the cluster, as the service account token is automatically rotated by Kubernetes. A real-world scenario where this matters is in multi-tenant clusters where different teams manage different microservices, and using separate service accounts per microservice ensures that a compromised pod cannot escalate privileges to access other services' secrets.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Compare authentication methods — This question tests Compare authentication methods — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies. — Option D is correct because Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.
What should I do if I get this VA-003 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.