VA-003 Compare authentication methods Practice Question
A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?
⚠ Common exam trap
Test-takers frequently think Kubernetes auth cannot restrict access per pod, but Vault tests that by binding Vault roles to specific service account names (not just namespaces), you achieve per-microservice isolation without storing any secrets in the cluster.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.
Kubernetes auth allows Vault to authenticate pods via their service account tokens, and by creating a separate Vault role per microservice bound to a specific Kubernetes service account name, each pod can only authenticate to its designated role. This ensures that only pods with the correct service account can retrieve their own secrets, meeting the requirement that no secrets are stored in images or Kubernetes Secrets and that access is restricted per microservice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.
Why it's wrong here
A single role allows any pod in the namespace to authenticate, violating per-service isolation.
- ✗
Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.
Why it's wrong here
This stores secrets in Kubernetes secrets, violating the mandate.
- ✗
Use TLS cert auth, generate a certificate per microservice, and mount as a secret.
Why it's wrong here
This stores certificates, which are secrets.
- ✓
Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.
Why this is correct
Kubernetes auth can bind to specific service accounts, and policies enforce access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.