VA-003 Compare authentication methods Practice Question
A security engineer is comparing the AppRole and Kubernetes auth methods for a containerized application. The application runs in a Kubernetes cluster and needs to authenticate to Vault. The engineer wants to minimize the risk of secret leakage and avoid manual secret rotation. Which statement best describes the advantage of Kubernetes auth over AppRole in this scenario?
⚠ Common exam trap
The trap here is assuming AppRole is always more secure due to CIDR binding, overlooking that Kubernetes auth eliminates static secrets entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kubernetes auth uses a service account token that is automatically mounted and rotated by Kubernetes, eliminating the need to store a static secret_id.
Kubernetes auth uses the pod's service account token, which Kubernetes automatically mounts and rotates. This removes the need to store a static secret_id, reducing leakage risk and manual rotation. AppRole requires a secret_id that must be protected and rotated, making Kubernetes auth advantageous in this containerized scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kubernetes auth automatically rotates the Vault token every 24 hours without any configuration.
Why it's wrong here
Kubernetes auth does not automatically rotate Vault tokens; token TTLs are configured in the Vault role. The service account token is rotated by Kubernetes, but Vault tokens have their own TTL and renewal behavior. This statement conflates the two and is incorrect about automatic rotation.
- ✗
AppRole is always more secure because it supports CIDR binding, while Kubernetes auth does not.
Why it's wrong here
AppRole supports CIDR binding, but Kubernetes auth also supports binding to service account names, namespaces, and even pod labels. More importantly, AppRole requires storing a secret_id, which is a static secret. Kubernetes auth avoids that, so it is not inherently less secure. The statement overgeneralizes security.
- ✓
Kubernetes auth uses a service account token that is automatically mounted and rotated by Kubernetes, eliminating the need to store a static secret_id.
Why this is correct
Kubernetes auth leverages the pod's service account token, which Kubernetes automatically mounts and rotates. This eliminates the need to store a static secret_id as with AppRole. The application does not manage any long-lived secret, reducing leakage risk and manual rotation overhead. This directly addresses the engineer's goals.
- ✗
Kubernetes auth requires a secret_id that is stored in a Kubernetes Secret and manually rotated.
Why it's wrong here
Kubernetes auth does not use a secret_id; it uses the service account token. Storing a secret_id in a Kubernetes Secret would reintroduce a static secret and manual rotation, which is exactly what the engineer wants to avoid. This statement misrepresents how Kubernetes auth works.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.