VA-003 Compare authentication methods Practice Question
Which TWO of the following are differences between using Vault's token auth method and other auth methods? (Choose two.)
⚠ Common exam trap
HashiCorp often tests the misconception that token auth is just another optional auth method like LDAP or AppRole, when in reality it is the mandatory, always-enabled foundation that all other auth methods depend on.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Token auth is always enabled and cannot be disabled
Token auth is always enabled and cannot be disabled because it is the core authentication mechanism that Vault uses internally to represent all authenticated sessions. Every other auth method ultimately produces a Vault token, making the token auth method the foundational layer that cannot be removed or turned off without breaking Vault's entire authentication model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Token auth is always enabled and cannot be disabled
Why this is correct
Token auth is the default and can't be disabled.
- ✗
Token auth does not support policies
Why it's wrong here
Token auth supports policies.
- ✗
Token auth is the only method that can create periodic tokens
Why it's wrong here
Other methods can also create periodic tokens.
- ✗
Token auth cannot be used to create a root token
Why it's wrong here
Root tokens can be created via token auth.
- ✓
Token auth is typically used for Vault's own internal token management, not for end-user authentication
Why this is correct
Other methods are preferred for external auth.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.