nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #28

Which of the following describes the Vault's auth method component?

The correct answer is B. It verifies a client against an internal or external system, and generates a token with policy. Vault's authentication methods are responsible for verifying a client's identity and, upon successful verification, issuing a token with associated policies for access control.

Submitted by tunde_lagos· Apr 18, 2026Understand Vault Concepts

Question

Which of the following describes the Vault's auth method component?

Options

  • AIt verifies a client against an internal or external system, and generates a token with the
  • BIt verifies a client against an internal or external system, and generates a token with policy
  • CIt is responsible for durable storage of client tokens
  • DIt dynamically generates a unique set of secrets with appropriate permissions attached

How the community answered

(61 responses)
  • A
    3% (2)
  • B
    87% (53)
  • C
    8% (5)
  • D
    2% (1)

Why each option

Vault's authentication methods are responsible for verifying a client's identity and, upon successful verification, issuing a token with associated policies for access control.

AIt verifies a client against an internal or external system, and generates a token with the

This option is incomplete as it misses the critical aspect of attaching *policy information* to the generated token, which is essential for authorization.

BIt verifies a client against an internal or external system, and generates a token with policyCorrect

An authentication method's core function is to establish the identity of a client (user, machine, application) by verifying their credentials against an internal system (e.g., username/password) or an external system (e.g., LDAP, AWS IAM). Once authenticated, it issues a Vault token that is tied to specific policies, which define what the client is authorized to do within Vault.

CIt is responsible for durable storage of client tokens

The durable storage of client tokens (their metadata and revocation information) is handled by Vault's core backend, not specifically by the individual auth method components.

DIt dynamically generates a unique set of secrets with appropriate permissions attached

Dynamically generating unique sets of secrets with permissions is the primary function of *secrets engines*, not authentication methods.

Concept tested: Vault authentication method functionality

Source: https://developer.hashicorp.com/vault/docs/auth

Topics

#Auth Methods#Authentication#Tokens

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full VAULT-ASSOCIATE-002 Practice