AppRole Authentication: How to Configure Single-Use SecretIDs
An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?
Quick Answer
The answer is to set `secret_id_num_uses=1` in the AppRole role configuration. This parameter directly enforces single-use SecretID behavior by limiting the number of times a given SecretID can be presented during login; after the first successful authentication, Vault automatically revokes that SecretID, making it impossible to reuse. On the HashiCorp Vault Associate VA-003 exam, this concept tests your understanding of AppRole’s fine-grained control over credential lifecycle, often appearing as a distractor where candidates confuse `secret_id_num_uses` with `token_num_uses` or `secret_id_ttl`. A common trap is thinking that setting `token_num_uses=1` achieves the same result, but that limits the token’s lifespan, not the SecretID’s usage. To remember: think “SecretID, one and done” — the SecretID itself is consumed after a single login, while the token it generates can have its own separate constraints.
⚠ Common exam trap
HashiCorp often tests the distinction between `secret_id_num_uses` (controls SecretID reuse) and `token_num_uses` (controls token reuse), leading candidates to confuse the two and incorrectly select Option A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set secret_id_num_uses=1 in the role.
Setting `secret_id_num_uses=1` in the AppRole role configuration ensures that each SecretID can be used only once to obtain a token. Once the SecretID is used for login, it is automatically revoked and cannot be reused. This directly satisfies the requirement of single-use SecretIDs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set token_num_uses=1 in the role.
Why it's wrong here
token_num_uses=1 limits the issued token to a single use, not the SecretID itself; the SecretID remains valid for further logins. It is tempting because it sounds like one-use enforcement, and would be correct for constraining a token's API calls, not for making each SecretID single-use.
- ✗
Set bound_cidr_list to a specific IP.
Why it's wrong here
bound_cidr_list restricts the source addresses from which a SecretID may be used; it does not consume or invalidate the SecretID after one login. It is tempting because it tightens AppRole security, and would be correct for limiting logins to known network ranges, not for enforcing single-use SecretIDs.
- ✗
Set secret_id_ttl=1s in the role.
Why it's wrong here
secret_id_ttl=1s sets an expiry window, not a usage count; a SecretID could still be used repeatedly within that second. It is tempting because short TTLs appear to restrict reuse, and would be correct for time-bounding SecretIDs, not for enforcing exactly one login per SecretID.
- ✓
Set secret_id_num_uses=1 in the role.
Why this is correct
Setting secret_id_num_uses=1 makes each SecretID valid for a single authentication attempt, so a captured SecretID cannot be replayed. This directly satisfies the stem's constraint that each SecretID be usable only once, unlike TTL settings which limit time rather than use count.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on VA-003
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)
hard- A.Keeping the RoleID secret
- B.Configuring token policies
- ✓ C.Setting a secret_id_num_uses limit
- ✓ D.Binding the SecretID to a specific CIDR block
- ✓ E.Setting a secret_id_ttl
Why C: AppRole security is strengthened by limiting how a SecretID can be used and how long it lives: option C, setting a secret_id_num_uses limit, restricts the SecretID to a fixed number of login attempts, so a leaked SecretID cannot be replayed indefinitely. Option D, binding the SecretID to a specific CIDR block, ensures the SecretID is only usable from an expected source network, preventing use from unauthorized hosts. Option E, setting a secret_id_ttl, gives the SecretID a finite lifetime so it expires automatically and cannot be used for long-term unauthorized access. The unmarked options do not belong because the RoleID is not a secret (it is often public and can be discovered), and while token policies are important for authorization, they govern what the resulting token can do rather than being a factor that secures the AppRole authentication method itself.
Variation 2. Drag and drop the steps to enable AppRole authentication in Vault into the correct order.
medium- ✓ A.Enable AppRole authentication, create a role, retrieve the RoleID, generate a SecretID, then login.
- B.Create a role, enable AppRole authentication, retrieve the RoleID, generate a SecretID, then login.
- C.Enable AppRole authentication, create a role, generate a SecretID, retrieve the RoleID, then login.
- D.Enable AppRole authentication, create a role, retrieve the RoleID, login, then generate a SecretID.
Why A: First enable the auth method, then create the role, then retrieve the RoleID, generate a SecretID, and finally login.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.