VA-003 Compare authentication methods Practice Question
An organization uses Vault with the JWT/OIDC authentication method. After configuring the provider, users can authenticate, but the scopes requested do not include the email claim needed for policy mapping. What should the administrator do?
⚠ Common exam trap
HashiCorp often tests the distinction between configuring the auth method (Vault side) versus the provider side, and the trap here is that candidates mistakenly think they need to modify the external OIDC provider or create a claim mapping, when the fix is simply adding the missing scope to Vault's OIDC configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the 'email' scope to the OIDC auth method config
The email claim is not included in the JWT because the OIDC provider was not requested to issue it. In OIDC, claims are delivered only when the corresponding scope (e.g., 'email') is included in the authentication request. Adding the 'email' scope to the Vault OIDC auth method configuration ensures the provider returns the email claim, which can then be used for policy mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a policy that uses the email claim
Why it's wrong here
Policy cannot request scopes.
- ✗
Modify the OIDC provider's configuration in Vault
Why it's wrong here
Provider config doesn't include scopes.
- ✗
Create a custom claim mapping in the OIDC auth method
Why it's wrong here
Claim mapping interprets claims but doesn't request missing ones.
- ✓
Add the 'email' scope to the OIDC auth method config
Why this is correct
Adding the scope requests the email claim from the provider.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.