HashiCorp Vault Associate (003) Question 11
Single answer1b Choose an authentication method based on use caseA company runs Vault in its own datacenter and has two authentication needs. First, human operators should sign in to the Vault UI and CLI using their existing corporate credentials managed in Active Directory. Second, Java applications running on virtual machines in the datacenter need to authenticate to Vault automatically without storing long-lived Vault tokens on disk. The security team also wants application identity tied to the host where the app is running. Which authentication method best meets the application authentication requirement?
- A
LDAP auth method, because it uses the same Active Directory accounts as the operators
- B
AppRole auth method, because the applications can log in with a RoleID and SecretID from any VM
- C
Userpass auth method, because each application can have a dedicated username and password managed in Vault
- D
TLS certificate auth method, because Vault can authenticate the client based on its presented certificate and map identity to the machine or workload
Show answer and explanation
Correct answer: D
Explanation
This scenario separates human and machine authentication, which is a key design skill for Vault Associate candidates. LDAP is commonly chosen for human users authenticating with existing enterprise directory credentials, especially when the organization already uses Active Directory. For application authentication, the best choice depends on the environment and security requirements. Here, the important clues are: the apps run on datacenter VMs, authentication should be automatic, long-lived Vault tokens should not be stored on disk, and identity should be tied to the host or workload. Those requirements align well with the TLS certificate auth method, where the client presents a certificate and Vault authenticates based on that certificate. By contrast, AppRole is a common machine auth method but relies on distributing credentials such as SecretIDs and does not inherently prove host identity. HashiCorp documentation and best practices emphasize selecting auth methods based on who or what is authenticating and what source of trust already exists, such as enterprise directories for people and platform or certificate identity for machines.
- A. Incorrect.
Incorrect. LDAP auth is a strong choice for human users who should authenticate with existing Active Directory credentials, especially for UI and CLI access. However, it is not the best fit for non-human applications on VMs that need automated authentication without relying on user credentials. Using LDAP for apps often leads to shared service-account passwords and weaker machine identity.
- B. Incorrect.
Incorrect. AppRole is commonly used for machine authentication and is better than human-oriented methods such as LDAP or Userpass. However, the scenario specifically calls for tying application identity to the host where the app is running and avoiding long-lived credentials on disk. AppRole still requires handling RoleID and typically a SecretID, so it does not inherently bind identity to the machine in the same way client certificate authentication can.
- C. Incorrect.
Incorrect. Userpass is designed for username/password-based login and is generally appropriate only for simple human authentication use cases or testing. For production applications, it introduces password management overhead and does not provide strong host-based identity. It also conflicts with the goal of avoiding long-lived Vault credentials stored on disk.
- D. Correct.
Correct. TLS certificate auth is well suited when applications run on known hosts or workloads that can present client certificates. Vault can authenticate the presented certificate and create an identity tied to that certificate's subject or other certificate attributes. This supports automated login for applications and aligns with the requirement to associate application identity with the machine or workload rather than a shared password or static token.