Compare authentication methods →easyMultiple ChoiceObjective-mapped

VA-003 Compare authentication methods Practice Question

Exhibit

Refer to the exhibit.

```
$ vault auth list
Path      Type      Accessor                    Description                       Default TTL
----      ----      --------                    -----------                       -----------
token/    token     auth_token_xxx              token based credentials           system
audit/    userpass  auth_userpass_xxx           n/a                               24h
prod/     approle   auth_approle_xxx            n/a                               24h
```

Refer to the exhibit. Which authentication method is currently enabled for production applications?

⚠ Common exam trap

HashiCorp often tests the distinction between human-centric authentication methods (LDAP, Userpass) and machine-centric methods (AppRole, Token), and the trap here is that candidates mistakenly choose Token because it is simpler, overlooking that AppRole is specifically designed for production applications requiring dynamic, role-based credentials.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AppRole

The exhibit shows that the production applications are configured with the 'AppRole' authentication method, which is indicated by the presence of a RoleID and SecretID in the application configuration. AppRole is a machine-oriented authentication method in HashiCorp Vault that allows applications to authenticate using a pair of credentials (RoleID and SecretID), making it suitable for automated, non-human workflows. The other methods listed (Token, LDAP, Userpass) are either human-centric or not configured for these applications.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Token
Why it's wrong here
Token is at token/ path.
✗
LDAP
Why it's wrong here
LDAP is not mounted.
✓
AppRole
Why this is correct
AppRole is mounted at prod/.
✗
Userpass
Why it's wrong here
Userpass is a human-centric authentication method typically mounted at 'userpass/' and is not used for machine-to-machine authentication in production applications.

Go deeper

VA-003 Compare authentication methods Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question