VA-003 Compare authentication methods Practice Question
A platform team operates Vault in a hybrid cloud. They want a single authentication method that lets employees use their existing cloud provider identity (e.g., AWS IAM role, Azure managed identity) to log in without distributing Vault-specific credentials. Which authentication method should they enable?
⚠ Common exam trap
It's easy for candidates to confuse Cloud Foundry auth (for PaaS apps) with cloud provider auth methods that leverage AWS IAM or Azure managed identity for user and machine login.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud auth method (e.g., AWS, Azure, GCP)
Cloud auth methods (AWS, Azure, GCP) enable authentication using existing cloud provider identities. For AWS, Vault uses the IAM principal's signed request to verify identity; for Azure, it validates managed identity tokens. This eliminates the need to distribute Vault-specific credentials and aligns with the hybrid cloud requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
GitHub auth method
Why it's wrong here
GitHub auth is for authenticating with a GitHub personal access token or via OAuth, not with cloud provider identities like AWS IAM or Azure managed identity. It would require employees to have GitHub accounts and does not integrate with the hybrid cloud identity sources described, so it is unsuitable.
- ✗
Username & Password auth method
Why it's wrong here
Username & Password (Userpass) auth requires Vault-specific credentials stored in Vault. It does not leverage AWS IAM roles or Azure managed identities, so employees would need separate Vault passwords. This contradicts the goal of using existing cloud provider identity and avoiding extra credential distribution.
- ✓
Cloud auth method (e.g., AWS, Azure, GCP)
Why this is correct
Cloud auth methods (AWS, Azure, GCP) allow users and machines to authenticate using their existing cloud provider identity. For AWS, Vault verifies the IAM principal via signed STS requests; for Azure, it validates managed identity tokens. This matches the requirement to use existing cloud identity without distributing Vault-specific credentials.
- ✗
Cloud Foundry auth method
Why it's wrong here
Cloud Foundry auth is designed for applications running on Cloud Foundry (PaaS) to authenticate via their instance identity, not for employees using AWS IAM or Azure managed identities. It requires a Cloud Foundry deployment and does not integrate with AWS IAM roles or Azure managed identity, so it fails to meet the hybrid cloud employee login requirement.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.