HashiCorp Vault Associate (003) Question 17
Single answer1c Explain the difference between human vs. system authentication methodsA company uses Vault for both employee access and application access. Employees log in to the Vault UI through the corporate identity provider, while a CI/CD pipeline running in Kubernetes needs to retrieve short-lived database credentials without any human interaction. The security team wants each access pattern to use the most appropriate authentication method and to preserve clear auditability of who or what authenticated. Which approach best meets these requirements?
- A
Configure OIDC auth for employees and Kubernetes auth for the CI/CD pipeline, because OIDC is suited for human interactive login and Kubernetes auth is suited for workload identity.
- B
Configure userpass auth for employees and token auth for the CI/CD pipeline, because both are simple and avoid dependence on external identity systems.
- C
Configure AppRole auth for employees and LDAP auth for the CI/CD pipeline, because AppRole provides named identities for people and LDAP works well for automated applications.
- D
Configure GitHub auth for employees and cert auth for the CI/CD pipeline, because both methods are intended primarily for human users and provide the same audit characteristics.
Show answer and explanation
Correct answer: A
Explanation
Vault distinguishes between human authentication methods and system authentication methods based on how identities are presented and whether interaction is expected. Human auth methods typically integrate with an identity provider or directory and support interactive login, such as OIDC, LDAP, or sometimes GitHub. System auth methods are intended for applications, services, and workloads that authenticate programmatically without human input, such as Kubernetes, AppRole, AWS, Azure, GCP, or cert auth depending on the environment. In this scenario, OIDC is the appropriate choice for employees because it aligns with corporate SSO and user identity lifecycle management. Kubernetes auth is the appropriate choice for the CI/CD pipeline because the workload runs in Kubernetes and can authenticate using its service account identity. This follows HashiCorp guidance to choose auth methods based on the identity source and operating environment, while also improving audit clarity by separating human and machine access patterns.
- A. Correct.
Correct. This matches Vault best practices for human versus system authentication. OIDC is commonly used for human users because it supports interactive login through an external identity provider and maps naturally to corporate SSO. Kubernetes auth is designed for workloads running in Kubernetes, allowing pods or service accounts to authenticate non-interactively using their platform identity. This also helps audit logs distinguish between human logins and machine/workload logins.
- B. Incorrect.
Incorrect. Userpass can work for human users, but it is generally not preferred over centralized identity methods like OIDC or LDAP for enterprise employee access. More importantly, using token auth directly for a CI/CD pipeline is usually not the best choice for initial authentication because a token must already exist and be distributed securely. Token auth is not a primary machine identity method in the same way Kubernetes auth, AppRole, or cloud auth methods are.
- C. Incorrect.
Incorrect. This reverses the intended use cases. AppRole is designed primarily for machines and applications, not for human interactive login. LDAP is typically used to authenticate human users against a directory service, not as the usual authentication method for a Kubernetes-based pipeline workload. A candidate might choose this option by confusing "role" with a person’s role, but in Vault AppRole is a machine-oriented auth method.
- D. Incorrect.
Incorrect. GitHub auth can be used for human users in some environments, but it is not the best answer for a general corporate employee SSO scenario when the requirement is login through a corporate identity provider. The statement that both methods are intended primarily for human users is also false: cert auth is commonly used for machines or services presenting client certificates. In addition, the claim that they provide the same audit characteristics is misleading because Vault audit logs reflect the auth method and entity information differently depending on how authentication is configured.