HashiCorp Vault Associate (003) Question 16
Single answer1c Explain the difference between human vs. system authentication methodsA company uses Vault for both administrator access and application access. Security policy requires that employees sign in with their corporate identity provider and complete MFA, while a payment-processing service running in Kubernetes must authenticate automatically without any human interaction or shared long-lived password. Which combination of Vault authentication methods best meets these requirements?
- A
Use OIDC auth for employees and Kubernetes auth for the payment-processing service
- B
Use userpass auth for employees and token auth with a manually created periodic token for the payment-processing service
- C
Use AppRole auth for employees and LDAP auth for the payment-processing service
- D
Use GitHub auth for employees and cert auth for the payment-processing service using the same client certificate on every pod
Show answer and explanation
Correct answer: A
Explanation
Vault authentication methods are commonly grouped by whether they are best suited for humans or systems. Human authentication methods typically support interactive login flows and enterprise identity systems, such as OIDC, which integrates with an external IdP and can inherit MFA and SSO. System authentication methods are intended for automated workloads and should rely on workload identity or short-lived credentials rather than static shared secrets. For Kubernetes workloads, the Kubernetes auth method is a strong fit because Vault can validate the pod's service account token and map it to a Vault role. This aligns with HashiCorp guidance to choose auth methods based on the platform and actor type: humans usually authenticate through centralized identity providers, while applications authenticate using platform-native or machine-oriented auth methods such as Kubernetes, AppRole, AWS, or cert auth depending on the environment. In this scenario, OIDC for employees and Kubernetes auth for the service is the most appropriate and secure combination.
- A. Correct.
Correct. OIDC auth is a human-oriented authentication method that integrates with an external identity provider and commonly supports enterprise login flows such as SSO and MFA. Kubernetes auth is designed for workloads running in Kubernetes and allows pods to authenticate using their service account identity, which avoids embedding shared long-lived credentials in the application. This matches the requirement for human interactive login and non-human automated authentication.
- B. Incorrect.
Incorrect. Userpass is generally not the best choice for employees when the requirement is to use a corporate identity provider with MFA, because userpass stores credentials in Vault rather than delegating authentication to the enterprise IdP. Token auth with a manually created periodic token can work technically for machines, but it relies on distributing a pre-created token, which is not the preferred pattern for a Kubernetes workload when the Kubernetes auth method can provide identity-based authentication without a shared secret.
- C. Incorrect.
Incorrect. AppRole is primarily intended for machines and applications, not interactive human users. LDAP can be appropriate for human users in some environments, but using LDAP for a Kubernetes service does not satisfy the requirement for automatic, non-human authentication tied to the workload identity. This option reverses the typical human-versus-system use cases.
- D. Incorrect.
Incorrect. GitHub auth can be used for human users in some setups, but it does not directly address the stated requirement to use the company's corporate identity provider with MFA as clearly as OIDC does. Cert auth can be used for machines, but reusing the same client certificate on every pod creates a shared identity and weakens auditability and credential isolation. Best practice is to avoid broad shared credentials for multiple workloads when a platform-native auth method like Kubernetes auth is available.