HashiCorp Vault Associate (003) Question 18
Single answer1c Explain the difference between human vs. system authentication methodsA company uses Vault for both administrator access and application access. Security requires that employees sign in with their corporate identity provider and complete MFA, while a containerized billing service running in Kubernetes must authenticate without any interactive login. The Vault team wants each access pattern to use an authentication method that matches its identity type and operational needs. Which option best meets these requirements?
- A
Use the OIDC auth method for employees and the Kubernetes auth method for the billing service.
- B
Use the userpass auth method for employees and the token auth method with long-lived static tokens for the billing service.
- C
Use the Kubernetes auth method for employees and the OIDC auth method for the billing service.
- D
Use the LDAP auth method for employees and require the billing service to authenticate by manually entering a username and password stored in an environment variable.
Show answer and explanation
Correct answer: A
Explanation
Vault authentication methods are commonly divided by who or what is authenticating: humans or systems. Human authentication methods are typically interactive and tied to a user directory or identity provider, such as OIDC, LDAP, userpass, or Okta, depending on the environment. These methods are appropriate when a person signs in and may need SSO and MFA. System authentication methods are intended for applications, services, or workloads and are usually non-interactive, such as Kubernetes, AppRole, AWS, Azure, GCP, cert, or JWT/OIDC for workload identities. In this scenario, OIDC is the best fit for employees because it integrates with the corporate IdP and MFA, while Kubernetes auth is the best fit for a service running in Kubernetes because it uses the pod's service account identity instead of static credentials. This aligns with HashiCorp guidance to choose auth methods based on the authenticating entity and environment, and to avoid unnecessary use of long-lived static tokens or manually managed credentials for applications.
- A. Correct.
Correct. This matches human and system authentication methods to the appropriate use cases. OIDC is designed for human users authenticating through an external identity provider, which supports enterprise SSO flows and commonly integrates with MFA at the IdP. The Kubernetes auth method is designed for workloads running in Kubernetes and allows the application to authenticate non-interactively using its service account identity. This is a standard best-practice split: human users use an interactive auth method tied to corporate identity, while machines use a platform or workload identity-based auth method.
- B. Incorrect.
Incorrect. Userpass can authenticate humans, but it is generally less aligned with enterprise best practices than federating through an identity provider using OIDC for SSO and MFA. The larger problem is using long-lived static tokens for the billing service. While token auth exists, distributing and storing static tokens in applications is typically less secure and less operationally desirable than using a native machine auth method such as Kubernetes auth, which lets the workload prove its identity dynamically.
- C. Incorrect.
Incorrect. This reverses the intended use of these methods. The Kubernetes auth method is for workloads running in Kubernetes, not for employees performing interactive sign-in. OIDC is built around browser-based or interactive login flows through an identity provider and is therefore appropriate for human users, not headless services that need non-interactive authentication during startup or runtime.
- D. Incorrect.
Incorrect. LDAP can be used for human authentication in some environments, so that part is plausible. However, the billing service portion is not appropriate. Requiring a service to use a manually managed username and password, especially one stored in an environment variable, is a weak pattern compared with a dedicated machine auth method. It does not meet the stated requirement for non-interactive authentication in a way that leverages the workload's platform identity, and it increases secret distribution and rotation risk.