VA-003 Compare authentication methods Practice Question
Which THREE authentication methods support generating tokens with TTL and renewable options?
⚠ Common exam trap
HashiCorp often tests the misconception that all auth methods inherently support TTL and renewable options, but in Vault, only methods that generate a token (like userpass, LDAP, and token auth) directly support these parameters, whereas methods like Kubernetes rely on role-level configuration and do not expose TTL/renewable as native auth method settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Userpass authentication
Userpass authentication (B) is correct because Vault's userpass auth method supports token generation with configurable TTL (time-to-live) and renewable options via the `token_ttl` and `token_renewable` parameters in the auth method configuration or role settings. This allows administrators to enforce session lifetimes and permit token renewal for user accounts authenticated via username/password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kubernetes authentication
Why it's wrong here
Kubernetes authentication does not directly support TTL and renewable options; token parameters are managed at the role level, not as native auth method settings.
- ✓
Userpass authentication
Why this is correct
Userpass authentication supports token TTL and renewable options via role configuration, allowing session lifetime control.
- ✗
AppRole authentication
Why it's wrong here
AppRole authentication requires role-level configuration for token parameters and does not expose TTL/renewable as native auth method settings.
- ✓
Token authentication
Why this is correct
Token authentication natively supports TTL and renewable options when creating or managing tokens.
- ✓
LDAP authentication
Why this is correct
LDAP authentication supports token TTL and renewable options via role configuration, similar to userpass.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.