Vault Associate · Domain 1 of 9

Vault Associate Domain 1: Authentication methods

The first objective group of the Vault Associate (003) exam: what auth methods do, how to pick one for a human or a machine, how identities and groups tie logins together, and how to enable and use auth methods from the CLI, API and UI.

Exam weight estimate
Not published
Official objectives
6
Estimated questions estimate
~9
Suggested study time estimate
6–8 hrs

About 14 min read Reviewed October 2026

Overview

Authentication methods are how a client proves who it is before Vault issues a token. HashiCorp lists six objectives here: the purpose of auth methods, choosing one for a use case, the difference between human and system methods, the purpose of identities and groups, logging in through the API, CLI and UI, and configuring auth methods through those same three interfaces. You need to know common methods such as userpass, LDAP, OIDC, GitHub, AppRole, Kubernetes and the cloud IAM methods, and that the token method is always enabled at auth/token.

The current exam is Vault Associate (003), tested against Vault 1.19 according to HashiCorp's certification page. As of October 2026 no 004 version or retirement has been announced, and HashiCorp, now part of IBM, still runs the program. HashiCorp does not publish objective weights or a question count, so the estimates here are planning figures.

How it's tested

Domain 1 questions usually describe who or what needs to log in, then ask which auth method fits, what a command does, or how identity ties logins together. Some show a vault login or curl command and ask what is missing. Read for clues such as human user, CI pipeline, Kubernetes pod or cloud workload.

  • Pick the auth method

    A client is described, such as a Jenkins job, an EC2 instance or a developer with corporate SSO, and you choose AppRole, AWS, OIDC or another fitting method.

  • Human or machine

    You decide whether a method suits interactive people or automated systems, based on how credentials are supplied and rotated.

  • Read the command

    A vault auth enable, vault login or curl call is shown, and you identify the mount path, method or parameter it uses.

Reasoning it through

A team asks how its CI pipeline should authenticate to Vault without a person typing a password. Userpass is tempting because it is simple, but it is meant for people and puts a static password in the pipeline. AppRole issues a RoleID and a short-lived SecretID that a trusted orchestrator can deliver, which is the machine-oriented choice the exam expects for generic automation.

Objectives 6

Official objectives from the HashiCorp outline, in outline order.

1a Define the purpose of authentication methodsWhat auth methods do and how they lead to a token.
What it means
Auth methods are Vault components that verify a client's identity against a trusted source, such as a password database, an LDAP directory, an OIDC provider or a cloud platform, and then return a Vault token with policies attached.
What to understand
Authentication and authorization are separate steps. The auth method answers who the client is; the policies mapped to that identity decide what it can do. Every method except the built-in token method must be enabled before use, and each one is mounted under the auth/ prefix. After login, the client sends the returned token on every request.
How it shows up
Expect a question asking what an auth method returns or what happens after successful authentication.
Common confusion
Thinking the auth method itself grants access to secrets; it only produces a token whose policies grant access.
1b Choose an authentication method based on use caseMatching the method to the client and its platform.
What it means
This objective asks you to select the auth method that best matches a scenario, considering where the client runs, what identity source already exists and how credentials can be delivered safely.
What to understand
Use the platform's own identity where possible: the Kubernetes method for pods using service account tokens, AWS, Azure or GCP methods for cloud workloads, and TLS certificates for clients with certificates. OIDC or LDAP fit organisations with an existing identity provider or directory. AppRole suits generic automation such as CI systems. GitHub and userpass work for people, with userpass mostly used for testing or small setups.
How it shows up
Scenarios name a platform or existing directory, and the best answer reuses that trusted identity rather than creating new secrets.
Common confusion
Choosing userpass or a long-lived token for an application when a platform-native method exists.
1c Explain the difference between human vs. system authentication methodsInteractive user logins compared with machine-oriented methods.
What it means
Human methods expect a person to enter credentials or complete a browser flow, while system methods are designed for applications and servers that authenticate automatically using platform identity or machine credentials.
What to understand
Userpass, LDAP, OIDC, Okta, RADIUS and GitHub are typically human-oriented. AppRole, Kubernetes, AWS, Azure, GCP and TLS certificates are typically machine-oriented, because the credential comes from the environment and can be rotated without people. Some methods, such as JWT and TLS, can serve either. Human sessions are usually short and interactive; machine logins are frequent and should avoid static secrets.
How it shows up
Questions place a method into the human or machine category, or ask why a method is unsuitable for automation.
Common confusion
Labelling AppRole as a human method because it has a username-like RoleID.
1d Define the purpose of identities and groupsEntities, aliases and groups that unify a client across methods.
What it means
Vault's identity secrets engine tracks clients as entities. Each auth method login is an alias linked to an entity, and entities can belong to groups, so policies can follow a person or service regardless of which method they used.
What to understand
An entity can have one alias per auth method mount, which lets the same person log in with LDAP and GitHub yet be treated as one identity. Policies can be attached to the entity, to groups and to the token from the auth method, and the effective set is the union. Internal groups are managed in Vault; external groups map to groups from an identity provider such as LDAP or OIDC. Entities also give a consistent client count for licensing and auditing.
How it shows up
Scenarios describe a user with several logins, or a team needing shared policies, and you choose entity, alias or group.
Common confusion
Confusing an alias with an entity; the alias is the method-specific login, the entity is the single identity behind it.
1e Authenticate to Vault using the API, CLI, and UILogging in through each interface and using the returned token.
What it means
This objective covers performing a login with vault login on the CLI, with an HTTP POST to the method's login endpoint, and through the UI's method selector, then using the token that comes back.
What to understand
On the CLI, vault login -method=userpass username=alice prompts for a password and stores the token through the token helper. With the API, a client posts credentials to a path such as /v1/auth/userpass/login/alice or /v1/auth/approle/login and reads auth.client_token from the JSON response, then sends it in the X-Vault-Token header. In the UI you pick the method and, if it uses a custom path, enter that mount path.
How it shows up
Expect to identify the right login endpoint or the field in the response that holds the token.
Common confusion
Forgetting that a method mounted at a custom path must be addressed by that path, not the default name.
1f Configure authentication methods using the API, CLI, and UIEnabling, tuning and configuring auth method mounts.
What it means
Configuring an auth method means enabling it at a path, setting its connection or trust details, creating roles or users within it, and tuning mount settings such as default and maximum TTL.
What to understand
The CLI uses vault auth enable approle or vault auth enable -path=corp-ldap ldap, then vault write to configuration and role paths such as auth/approle/role/ci. The API equivalent is a POST to /v1/sys/auth/<path> with the method type. vault auth list shows enabled methods, vault auth tune changes TTLs and vault auth disable removes a method, which also revokes tokens it issued. The UI offers the same steps under Access.
How it shows up
A configuration step is shown, and you identify the command, API path or setting it needs.
Common confusion
Assuming the token auth method can be disabled or moved; it is always mounted at auth/token.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Auth method

    A plugin that verifies identity and returns a token.

    Remember
    It authenticates; policies authorize.
    Tested as
    Purpose and definition questions.
    Trap
    Thinking it grants secret access directly.

  • Token auth method

    The built-in method behind every other login.

    Remember
    Always enabled at auth/token and cannot be disabled.
    Tested as
    Configuration questions.
    Trap
    Trying to enable or disable it.

  • AppRole

    Machine method using a RoleID and SecretID.

    Remember
    The SecretID should be short-lived and delivered by a trusted party.
    Tested as
    Automation and CI scenarios.
    Trap
    Treating the RoleID alone as a secret.

  • Kubernetes auth method

    Pods log in with their service account token.

    Remember
    Vault validates the JWT with the Kubernetes API.
    Tested as
    Platform-native choice questions.
    Trap
    Creating AppRole credentials for pods instead.

  • Cloud IAM methods

    AWS, Azure and GCP methods trust cloud identity.

    Remember
    No static secret needs to be placed on the workload.
    Tested as
    Cloud workload scenarios.
    Trap
    Copying access keys onto instances.

  • OIDC and LDAP

    Human logins backed by an existing identity provider.

    Remember
    Reuse corporate SSO or directory groups.
    Tested as
    Human user scenarios.
    Trap
    Building userpass accounts that duplicate the directory.

  • Entity

    Vault's single record of a client identity.

    Remember
    Links aliases from several auth methods.
    Tested as
    Identity questions.
    Trap
    Confusing it with a token.

  • Alias

    A login identity within one auth method mount.

    Remember
    Maps to exactly one entity.
    Tested as
    Identity questions.
    Trap
    Expecting one alias to span mounts.

  • Internal and external groups

    Groups managed in Vault or mapped from an IdP.

    Remember
    Group policies are inherited by member entities.
    Tested as
    Shared policy scenarios.
    Trap
    Assuming external group membership is edited in Vault.

  • Auth mount path

    Where a method is enabled under auth/.

    Remember
    Custom paths change the login endpoint.
    Tested as
    CLI and API syntax questions.
    Trap
    Using the default path for a custom mount.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Human vs. system auth methods

ConceptMeaningKey differenceCommon trap
Userpass / LDAP / OIDC A person supplies credentials or completes SSO Interactive, tied to a human identity Using them inside unattended automation
AppRole Application supplies RoleID and SecretID Built for machines without platform identity Calling it a human method
Kubernetes / AWS / Azure / GCP Workload proves identity from its platform No static secret to distribute Overlooking them in favor of AppRole

Entity vs. alias vs. group

ConceptMeaningKey differenceCommon trap
Entity One identity for a person or service Aggregates aliases and policies Treating it as a login credential
Alias The method-specific login name One per auth mount per entity Assuming it holds policies across methods
Group A collection of entities or subgroups Policies apply to all members Forgetting external groups come from the IdP

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Userpass for apps

    What candidates pick
    Create a userpass account for a CI pipeline.
    Why it looks right
    It is the simplest method to set up.
    Why it's wrong
    Userpass targets people and leaves a static password in automation; AppRole or a platform method fits machines.

    Clue to watch for The client is a pipeline, script or service.

  2. Auth equals access

    What candidates pick
    Assume a successful login lets the client read any secret.
    Why it looks right
    Login feels like the final gate.
    Why it's wrong
    The issued token only carries the policies mapped to that identity, and Vault denies everything else.

    Clue to watch for The question asks what a newly authenticated client can read.

  3. Disable token auth

    What candidates pick
    Plan to disable the token auth method to force SSO.
    Why it looks right
    Other methods can be disabled.
    Why it's wrong
    The token method is built in and cannot be disabled, because every other method returns a token.

    Clue to watch for An option mentions removing auth/token.

  4. AppRole for pods

    What candidates pick
    Issue AppRole credentials to Kubernetes pods.
    Why it looks right
    AppRole is the generic machine answer.
    Why it's wrong
    The Kubernetes method lets pods authenticate with their service account token, so nothing extra must be distributed.

    Clue to watch for Workloads run in Kubernetes.

  5. Two people, two entities

    What candidates pick
    Expect a user's LDAP and GitHub logins to create unrelated identities.
    Why it looks right
    Each method has its own accounts.
    Why it's wrong
    Aliases from both mounts can link to one entity, giving a single identity with merged policies.

    Clue to watch for One person, several login methods.

  6. Default path assumption

    What candidates pick
    Log in at auth/ldap when the method was enabled at auth/corp.
    Why it looks right
    Default names are familiar.
    Why it's wrong
    Vault routes logins by mount path, so the custom path must be used.

    Clue to watch for The scenario mentions -path when enabling.

Answer framework

Use these steps to answer any Domain 1 authentication scenario.

  1. Identify the client: a person at a keyboard or an application, server, pod or pipeline running unattended.
  2. Look for an existing trusted identity source, such as a cloud platform, Kubernetes, an LDAP directory or an OIDC provider, and prefer the matching method.
  3. For generic automation with no platform identity, choose AppRole and keep the SecretID short-lived and tightly delivered.
  4. Check the mount path and interface in the question, and map the action to vault auth enable, vault login or the /v1/auth or /v1/sys/auth endpoints.
  5. Remember that login only yields a token; confirm which policies the identity, entity or group carries before judging what access results.

Practice question

An organization runs microservices on EC2 instances and wants them to authenticate to Vault without storing any long-lived credentials on the instances. Developers already sign in through the corporate OIDC provider. Which auth method should the microservices use?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start a Vault dev server with vault server -dev and work through the auth methods hands on, since the exam expects you to recognise real commands and paths. Enable userpass and AppRole, create a user and a role, and log in with each. Repeat one login with curl against /v1/auth/approle/login, and read the client_token from the JSON response. Then enable a method at a custom path and confirm how the login path changes in the CLI and the UI.

Next, build a simple table of common methods with three columns: human or machine, identity source, and typical scenario. Include userpass, LDAP, OIDC, GitHub, AppRole, Kubernetes, AWS, Azure, GCP and TLS certificates. Most scenario questions in this group become quick once you can scan that table mentally.

Finish with the identity system. Create an entity, attach aliases from two methods, put the entity in a group with a policy, and confirm the resulting token carries the merged policies. Then take practice questions grouped by objective and review every miss against the official Vault documentation.

FAQ

How much of the Vault Associate exam covers Authentication methods?

HashiCorp does not publish a weight for Authentication methods. It is one of nine objective groups with six objectives, so we estimate around nine questions, but treat that as planning guidance only.

Is the Vault Associate exam still version 003?

Yes. As of October 2026 HashiCorp's certification page lists Vault Associate (003), tested against Vault 1.19, and no 004 version or retirement date has been announced.

Which auth method is best for applications?

Prefer a platform-native method such as Kubernetes, AWS, Azure or GCP when the workload runs there. Use AppRole for generic automation that has no platform identity.

Can I disable the token auth method?

No. The token method is always enabled at auth/token because every other auth method ultimately returns a Vault token.

What is the difference between an entity and an alias?

An entity is Vault's single identity for a client. An alias is that client's login within one specific auth method mount, and each alias links to one entity.

Do I need to know API endpoints for auth methods?

Yes, at a recognition level. Know that logins go to /v1/auth/<path>/login and that methods are enabled through /v1/sys/auth/<path>.

How does a custom mount path affect login?

Vault routes requests by path, so a method enabled with -path=corp must be logged into at auth/corp, using -path on the CLI or that path in the UI.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered auth method purpose, selection, identities and groups, and CLI, API and UI logins. Check that you can pick the right method quickly.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going