VA-003 Compare authentication methods Practice Question
An administrator is configuring Vault to allow employees to log in using their existing corporate credentials managed by an external identity provider that supports OIDC. The administrator wants to avoid creating local Vault users. Which authentication method should be used?
⚠ Common exam trap
The trap here is choosing a vendor-specific method like Okta when the scenario only specifies OIDC compliance, not a particular vendor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OIDC auth method
OIDC auth method enables authentication via an external OIDC identity provider, allowing employees to use corporate credentials without local Vault users. It supports standard OIDC flows and JWT validation, making it the right choice for integrating with an OIDC-capable IdP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Okta auth method
Why it's wrong here
Okta auth method is a vendor-specific integration for Okta, but the scenario describes a generic OIDC provider. While Okta supports OIDC, using the Okta auth method would be unnecessarily specific and may not work if the provider is not Okta. The OIDC auth method is the correct generic choice for any OIDC-compliant provider.
- ✓
OIDC auth method
Why this is correct
OIDC auth method allows users to authenticate via an external OIDC identity provider. It supports authorization code flow and JWT validation, enabling single sign-on without local Vault users. This matches the requirement to use existing corporate credentials managed by an OIDC provider and avoids creating local users.
- ✗
LDAP auth method
Why it's wrong here
LDAP auth can use corporate credentials, but it requires direct LDAP bind and does not leverage OIDC. It also typically requires a service account and may not support modern OIDC features like MFA or group claims. The scenario specifies an OIDC-capable identity provider, so LDAP would not utilize that capability and may require additional configuration.
- ✗
Username & Password auth method
Why it's wrong here
Username & Password auth requires creating local Vault users with passwords, which contradicts the goal of avoiding local users and using existing corporate credentials. It does not integrate with an external OIDC provider, so it is not suitable for this scenario.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.