How should I use these Compare authentication methods practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Compare authentication methods questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Compare authentication methods domain.

VA-003 · topic practice

Compare authentication methods practice questions

Practise HashiCorp Vault Associate VA-003 Compare authentication methods practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Compare authentication methods

Practice 10 questions Browse domain →

What the exam tests

What to know about Compare authentication methods

Compare authentication methods questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Compare authentication methods exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Compare authentication methods questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Compare authentication methods explanation →

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

Trap 1: AWS IAM

AWS IAM is tied to AWS, not suitable for generic CI/CD.

Trap 2: AppRole

AppRole requires storing RoleID and SecretID, which are static secrets.

Trap 3: Username & Password

Username & Password requires storing credentials.

Study all Compare authentication methods common traps →

A
JWT/OIDC
Correct: JWT/OIDC allows token exchange without storing static secrets.
B
AWS IAM
Why wrong: AWS IAM is tied to AWS, not suitable for generic CI/CD.
C
AppRole
Why wrong: AppRole requires storing RoleID and SecretID, which are static secrets.
D
Username & Password
Why wrong: Username & Password requires storing credentials.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Compare authentication methods explanation →

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

Trap 1: LDAP

Requires LDAP credentials, which are secrets.

Trap 2: Username & Password

Requires username and password, which are secrets.

Trap 3: AppRole

AppRole requires a RoleID and SecretID, which would need to be stored.

Study all Compare authentication methods common traps →

A
LDAP
Why wrong: Requires LDAP credentials, which are secrets.
B
Kubernetes
Kubernetes auth uses the pod's service account token, no hardcoded secrets.
C
Username & Password
Why wrong: Requires username and password, which are secrets.
D
AppRole
Why wrong: AppRole requires a RoleID and SecretID, which would need to be stored.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Compare authentication methods explanation →

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

Trap 1: Switch to token-based authentication and issue tokens with TTL.

Tokens do not address password complexity.

Trap 2: Use Vault's password policy plugin with Userpass.

No such plugin exists.

Trap 3: Configure password policies in Vault's Userpass auth method.

Vault's Userpass does not support password policies.

Study all Compare authentication methods common traps →

A
Migrate users to an external identity provider and use LDAP or OIDC auth.
External IDPs can enforce password policies; Vault can leverage them.
B
Switch to token-based authentication and issue tokens with TTL.
Why wrong: Tokens do not address password complexity.
C
Use Vault's password policy plugin with Userpass.
Why wrong: No such plugin exists.
D
Configure password policies in Vault's Userpass auth method.
Why wrong: Vault's Userpass does not support password policies.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Compare authentication methods explanation →

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

Trap 1: OIDC

OIDC requires a client secret.

Trap 2: TLS Certificates

Requires distributing and managing certificates.

Trap 3: AppRole

AppRole requires a SecretID, which is a secret.

Study all Compare authentication methods common traps →

A
OIDC
Why wrong: OIDC requires a client secret.
B
AWS
AWS auth uses instance metadata, no secrets stored.
C
TLS Certificates
Why wrong: Requires distributing and managing certificates.
D
AppRole
Why wrong: AppRole requires a SecretID, which is a secret.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Compare authentication methods explanation →

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Trap 1: Set token_num_uses=1 in the role.

token_num_uses limits the generated token, not the SecretID.

Trap 2: Set bound_cidr_list to a specific IP.

CIDR list restricts network access, not usage count.

Trap 3: Set secret_id_ttl=1s in the role.

TTL controls time, not usage count.

Study all Compare authentication methods common traps →

A
Set token_num_uses=1 in the role.
Why wrong: token_num_uses limits the generated token, not the SecretID.
B
Set bound_cidr_list to a specific IP.
Why wrong: CIDR list restricts network access, not usage count.
C
Set secret_id_ttl=1s in the role.
Why wrong: TTL controls time, not usage count.
D
Set secret_id_num_uses=1 in the role.
secret_id_num_uses limits the number of times a SecretID can be used.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Compare authentication methods explanation →

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

Trap 1: Userpass

Userpass does not support OTP.

Trap 2: GitHub

GitHub does not support OTP for Vault auth.

Trap 3: LDAP

LDAP does not natively support OTP.

Study all Compare authentication methods common traps →

A
Okta
Okta supports TOTP via the Okta API.
B
Userpass
Why wrong: Userpass does not support OTP.
C
GitHub
Why wrong: GitHub does not support OTP for Vault auth.
D
LDAP
Why wrong: LDAP does not natively support OTP.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Compare authentication methods explanation →

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

Trap 1: Okta

Okta is a separate identity provider.

Trap 2: AppRole

AppRole is for machine-to-machine authentication.

Trap 3: Userpass

Userpass is for local Vault users, not AD.

Study all Compare authentication methods common traps →

A
Okta
Why wrong: Okta is a separate identity provider.
B
AppRole
Why wrong: AppRole is for machine-to-machine authentication.
C
Userpass
Why wrong: Userpass is for local Vault users, not AD.
D
LDAP
LDAP can connect to Active Directory.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Compare authentication methods explanation →

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Trap 1: Vault validates the token's scope.

Vault does not validate token scope.

Trap 2: Users must generate a personal access token with repo scope.

No specific scope is required beyond the ability to read team membership.

Trap 3: The GitHub token must include the team scope.

The token does not need a team scope; Vault uses the API to check membership.

Study all Compare authentication methods common traps →

A
Vault validates the token's scope.
Why wrong: Vault does not validate token scope.
B
Users must generate a personal access token with repo scope.
Why wrong: No specific scope is required beyond the ability to read team membership.
C
The GitHub token must include the team scope.
Why wrong: The token does not need a team scope; Vault uses the API to check membership.
D
Map the GitHub team to a Vault policy in the auth method configuration.
Mapping teams to policies is required to enforce membership.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Compare authentication methods explanation →

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Trap 1: LDAP

LDAP requires credentials.

Trap 2: AppRole

AppRole requires a SecretID, which is a static secret.

Trap 3: Userpass

Userpass requires a password.

Study all Compare authentication methods common traps →

A
LDAP
Why wrong: LDAP requires credentials.
B
AppRole
Why wrong: AppRole requires a SecretID, which is a static secret.
C
Kubernetes
Kubernetes auth uses the pod's service account token, no static secret.
D
Userpass
Why wrong: Userpass requires a password.
E
AWS
AWS auth uses instance identity documents, no static secret.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Compare authentication methods explanation →

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Trap 1: Keeping the RoleID secret

RoleID is not a secret; it is a username-like identifier.

Trap 2: Configuring token policies

Token policies control authorization, not authentication security.

Study all Compare authentication methods common traps →

A
Keeping the RoleID secret
Why wrong: RoleID is not a secret; it is a username-like identifier.
B
Configuring token policies
Why wrong: Token policies control authorization, not authentication security.
C
Setting a secret_id_num_uses limit
Prevents replay attacks.
D
Binding the SecretID to a specific CIDR block
Limits where the SecretID can be used.
E
Setting a secret_id_ttl
Limits the lifetime of the SecretID.

Full breakdown with real-world context →

Question 11easymulti select

Read the full Compare authentication methods explanation →

Which TWO authentication methods are designed for human users? (Choose two.)

Trap 1: AWS

Designed for AWS instances.

Trap 2: Kubernetes

Designed for pods.

Trap 3: AppRole

Designed for machines.

Study all Compare authentication methods common traps →

A
AWS
Why wrong: Designed for AWS instances.
B
Kubernetes
Why wrong: Designed for pods.
C
AppRole
Why wrong: Designed for machines.
D
OIDC
Designed for humans using SSO.
E
Userpass
Designed for humans with username and password.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Compare authentication methods explanation →

A financial services company runs a microservices architecture on Kubernetes. Each microservice needs to authenticate to Vault to retrieve database credentials. The security team mandates that no secrets (tokens, passwords, certificates) be stored in container images or Kubernetes secrets. They also require that each microservice can only access its own secrets. The platform team is evaluating authentication methods. They consider using AppRole, but are concerned about distributing the SecretID. They also consider Kubernetes auth, but are unsure how to restrict access per microservice. They test with a Kubernetes deployment and find that any pod in the namespace can authenticate to Vault. What should they do to meet all requirements?

Trap 1: Use Kubernetes auth with a single role for the namespace, and rely…

A single role allows any pod in the namespace to authenticate, violating per-service isolation.

Trap 2: Use AppRole with a unique RoleID and SecretID per microservice,…

This stores secrets in Kubernetes secrets, violating the mandate.

Trap 3: Use TLS cert auth, generate a certificate per microservice, and…

This stores certificates, which are secrets.

Study all Compare authentication methods common traps →

A
Use Kubernetes auth with a single role for the namespace, and rely on token TTL to limit exposure.
Why wrong: A single role allows any pod in the namespace to authenticate, violating per-service isolation.
B
Use AppRole with a unique RoleID and SecretID per microservice, distribute via Kubernetes secrets.
Why wrong: This stores secrets in Kubernetes secrets, violating the mandate.
C
Use TLS cert auth, generate a certificate per microservice, and mount as a secret.
Why wrong: This stores certificates, which are secrets.
D
Use Kubernetes auth, create a role per microservice, bind to specific service account names, and assign appropriate policies.
Kubernetes auth can bind to specific service accounts, and policies enforce access.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full NAT/PAT explanation →

A startup uses Vault to manage secrets for their web application. They currently have a single admin user who authenticates with a root token. They want to allow two developers to authenticate with their own credentials and restrict them to read-only access to a specific path 'secret/data/webapp'. They decide to use the Userpass auth method. The admin creates a user 'dev1' with password 'password123' and assigns a policy 'webapp-readonly' that grants read capability on 'secret/data/webapp'. However, when dev1 tries to log in, Vault returns a permission denied error. The admin checks the token and sees no policies attached. What is the most likely issue?

Trap 1: The policy 'webapp-readonly' does not exist.

The policy was created.

Trap 2: The user 'dev1' does not exist.

The user was created.

Trap 3: The password is incorrect.

The password was set correctly.

Study all Compare authentication methods common traps →

A
The policy 'webapp-readonly' does not exist.
Why wrong: The policy was created.
B
The admin did not assign any policies to the user.
Userpass requires explicit policy assignment; without it, no policies are attached.
C
The user 'dev1' does not exist.
Why wrong: The user was created.
D
The password is incorrect.
Why wrong: The password was set correctly.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full Compare authentication methods explanation →

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediumdrag order

Read the full Compare authentication methods explanation →

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching

Read the full Compare authentication methods explanation →

Match each Vault secret engine to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Key-value storage with versioning

Dynamic AWS IAM credentials

X.509 certificate generation

Encryption as a service

Dynamic database credentials

Question 17mediummatching

Read the full Compare authentication methods explanation →

Match each Vault replication type to its behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Disaster recovery, async replication

Scale read operations, active-standby

Replicate only mount-specific data

Replicate all data across clusters

Question 18easymultiple choice

Read the full Compare authentication methods explanation →

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

Trap 1: GitHub personal access token

GitHub tokens are long-lived and require secure storage.

Trap 2: AppRole

AppRole still requires a secret ID that must be securely delivered.

Trap 3: Username & password (userpass)

Userpass requires a password, which is a long-lived credential.

Study all Compare authentication methods common traps →

A
GitHub personal access token
Why wrong: GitHub tokens are long-lived and require secure storage.
B
AWS IAM auth
AWS IAM auth allows instances to authenticate using IAM roles without storing static credentials.
C
AppRole
Why wrong: AppRole still requires a secret ID that must be securely delivered.
D
Username & password (userpass)
Why wrong: Userpass requires a password, which is a long-lived credential.

Full breakdown with real-world context →

Question 19mediummultiple choice

Read the full Compare authentication methods explanation →

A security administrator notices that a Vault client using AppRole authentication is generating a very large number of tokens, causing performance issues. The administrator finds that the same AppRole role is used by multiple applications. What should the administrator do to reduce the number of tokens while maintaining security?

Trap 1: Decrease the token TTL on the AppRole role

Shorter TTL means tokens expire faster but doesn't limit the rate of token generation.

Trap 2: Periodically rotate the secret ID

Rotation does not limit the number of active tokens.

Trap 3: Set secret_id_num_uses to 1 on the AppRole role

This limits the number of uses of each secret ID, not the number of tokens issued.

Study all Compare authentication methods common traps →

A
Decrease the token TTL on the AppRole role
Why wrong: Shorter TTL means tokens expire faster but doesn't limit the rate of token generation.
B
Periodically rotate the secret ID
Why wrong: Rotation does not limit the number of active tokens.
C
Create separate AppRole roles for each application
This allows distinct secret IDs and token limits per application.
D
Set secret_id_num_uses to 1 on the AppRole role
Why wrong: This limits the number of uses of each secret ID, not the number of tokens issued.

Full breakdown with real-world context →

Question 20hardmultiple choice

Read the full Compare authentication methods explanation →

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Trap 1: Vault is not configured to use SSL/TLS for LDAP

Bind failures can occur with or without SSL.

Trap 2: The LDAP server does not allow anonymous binds

Vault uses a configured binddn, not anonymous binds.

Trap 3: The LDAP server certificate is not trusted by Vault

Certificate issues would cause TLS errors, not bind failures.

Study all Compare authentication methods common traps →

A
The binddn or bindpass configured in Vault is incorrect
Incorrect bind credentials cause bind failures.
B
Vault is not configured to use SSL/TLS for LDAP
Why wrong: Bind failures can occur with or without SSL.
C
The LDAP server does not allow anonymous binds
Why wrong: Vault uses a configured binddn, not anonymous binds.
D
The LDAP server certificate is not trusted by Vault
Why wrong: Certificate issues would cause TLS errors, not bind failures.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Compare authentication methods sessions

Start a Compare authentication methods only practice session

Every question in these sessions is drawn from the Compare authentication methods domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Compare authentication methods questions →Mixed VA-003 session

Frequently asked questions

What does the VA-003 exam test about Compare authentication methods?: Compare authentication methods questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Compare authentication methods questions in a focused session?: Yes — the session launcher on this page draws every question from the Compare authentication methods domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other VA-003 topics?: Use the topic links above to move to related areas, or go back to the VA-003 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the VA-003 exam covers. They are not copied from any real exam or dump site.

Compare authentication methods only

10 questions 20 questions 30 questions 50 questions

Mixed VA-003 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All VA-003 questions Compare authentication methods domain overview VA-003 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Compare authentication methods practice questions

What to know about Compare authentication methods

Common Compare authentication methods exam traps

Compare authentication methods questions

A DevOps team wants to authenticate to Vault using short-lived tokens without storing a secret in their CI/CD pipeline. Which authentication method best meets this requirement?

An organization uses Kubernetes pods to access Vault. They want to avoid hardcoding any secrets in the pod definition. Which authentication method should they use?

A security team notices that some Vault users are authenticating with the Userpass auth method, but they want to enforce password complexity and expiration. What is the best approach?

A company has multiple AWS accounts and wants to allow EC2 instances to authenticate to Vault without storing any secrets on the instances. Which authentication method should they use?

An administrator configures AppRole with a RoleID and SecretID. They want to ensure that each SecretID can be used only once. Which configuration should they use?

Which authentication method allows a user to authenticate using a one-time password (OTP) generated by an authenticator app?

A Vault administrator wants to allow users to authenticate using their corporate Active Directory credentials. Which authentication method should they enable?

A company uses Vault for secrets management. They want to authenticate using GitHub tokens, but only for users who are members of a specific GitHub team. What must be configured?

Which TWO authentication methods allow a machine to authenticate without storing a static secret? (Choose two.)

Which THREE factors contribute to the security of the AppRole authentication method? (Choose three.)

Which TWO authentication methods are designed for human users? (Choose two.)

Drag and drop the steps to enable AppRole authentication in Vault into the correct order.

Drag and drop the steps to set up Vault's Kubernetes auth method into the correct order.

Match each Vault secret engine to its primary purpose.

Match each Vault replication type to its behavior.

A DevOps team wants to automate authentication to Vault for Jenkins jobs running on AWS EC2 instances. Which authentication method is most appropriate and secure for this use case without storing long-lived credentials?

An organization uses Vault with LDAP authentication. Users report they are unable to log in, and the administrator sees errors like 'LDAP bind failed: invalid credentials' in the Vault logs. The LDAP server is reachable. What is the most likely cause?

Track your progress over time

Start a Compare authentication methods only practice session

Related VA-003 topic practice pages