VA-003 Compare authentication methods Practice Question
Which TWO statements correctly describe differences between AppRole and Kubernetes authentication methods?
⚠ Common exam trap
HashiCorp often tests the misconception that both methods use a similar two-factor credential model, but the trap is that Kubernetes authentication relies solely on a signed JWT from the Kubernetes API server, not a separate secret_id, and that AppRole tokens are not inherently batch tokens.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.
AppRole authentication indeed requires a RoleID and SecretID to be presented by the client to obtain a Vault token, whereas Kubernetes authentication requires a service account token (a JWT) that is signed by the Kubernetes API server. This is a fundamental difference in the credential material each method uses to prove identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AppRole requires a role_id and secret_id, while Kubernetes requires a service account token.
Why this is correct
AppRole uses two components; Kubernetes uses a single token.
- ✗
Kubernetes auth requires the secret_id to be specified in a configuration file.
Why it's wrong here
Kubernetes auth uses a token, not a secret_id.
- ✓
Kubernetes authentication uses JWT tokens that are signed by the Kubernetes API server.
Why this is correct
The service account token is a JWT signed by the cluster.
- ✗
Both AppRole and Kubernetes support response wrapping for initial credentials.
Why it's wrong here
Only AppRole supports secret_id wrapping; Kubernetes token is already short-lived.
- ✗
AppRole tokens are always batch tokens, while Kubernetes tokens are service tokens.
Why it's wrong here
Both methods can generate service tokens by default.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.