HashiCorp Vault Associate (003) Question 19
Single answer1c Explain the difference between human vs. system authentication methodsA company uses Vault for both employee access and application access. Employees authenticate through the corporate identity provider and need short-lived interactive sessions in the Vault UI and CLI. Separately, a payment service running in Kubernetes must authenticate to Vault automatically without any human entering credentials, so it can read dynamic database credentials at startup. Which authentication approach best matches these two use cases?
- A
Use OIDC auth for employees and Kubernetes auth for the payment service
- B
Use Kubernetes auth for employees and userpass auth for the payment service
- C
Use token auth for employees and LDAP auth for the payment service
- D
Use AppRole auth for employees and GitHub auth for the payment service
Show answer and explanation
Correct answer: A
Explanation
Vault authentication methods generally fall into two practical categories: human authentication methods and system authentication methods. Human auth methods are used by people logging in interactively, often through an external identity system, and include methods such as OIDC, LDAP, GitHub, and userpass. System auth methods are intended for applications, services, and automated processes, and include methods such as Kubernetes, AppRole, AWS, Azure, GCP, and cert, depending on the environment. In this scenario, employees need an interactive login tied to the corporate identity provider, making OIDC the best fit. The payment service is a non-human workload running in Kubernetes and should authenticate automatically using Kubernetes auth. This aligns with HashiCorp guidance to choose auth methods based on the identity source available to the client and to prefer platform or workload identity for machine authentication rather than static human credentials.
- A. Correct.
Correct. OIDC is a human-oriented authentication method commonly used to integrate Vault with an external identity provider for interactive login through the UI or CLI. Kubernetes auth is a system-oriented method designed for workloads running in Kubernetes to authenticate automatically using service account identity, which is appropriate for non-human applications.
- B. Incorrect.
Incorrect. Kubernetes auth is intended for workloads running inside Kubernetes, not for human users logging in interactively. Userpass can be used for username/password logins, but it is generally not the best fit for an automated service because it relies on static credentials managed directly in Vault rather than a platform identity designed for machine authentication.
- C. Incorrect.
Incorrect. Token auth is not typically the primary human authentication method because users usually obtain tokens by authenticating through an auth method such as OIDC, LDAP, or userpass. LDAP is a human-focused auth method that validates user credentials against a directory service, so it is not a good fit for an application running unattended in Kubernetes.
- D. Incorrect.
Incorrect. AppRole is a machine-oriented auth method commonly used by applications and automation, not by human users needing interactive SSO-based access. GitHub auth is also primarily for human users based on GitHub identity and organization/team membership, so it does not match the payment service use case.