HashiCorp Vault Associate (003) Question 20
Single answer1d Define the purpose of identities and groupsA company uses Vault with both LDAP and GitHub auth methods. Several engineers authenticate with either method depending on where they are working, but the security team wants each engineer to receive the same set of policies regardless of which auth method they use. They also want to assign additional access to all platform engineers as a team, without attaching duplicate policies to every individual user record. Which approach best meets these requirements?
- A
Create a separate policy on each auth method role so that LDAP and GitHub logins independently assign identical policies to each user
- B
Use the identity secrets engine to store each engineer's credentials once, then attach policies directly to the stored identity
- C
Create identity entities for the engineers, link their LDAP and GitHub aliases to the same entity, and use an external or internal identity group to assign shared team policies
- D
Create one token per engineer with a long TTL and share that token across both LDAP and GitHub workflows so policy mapping stays consistent
Show answer and explanation
Correct answer: C
Explanation
Vault's Identity system exists to unify client identities across multiple authentication methods and to make policy assignment easier to manage at scale. An entity represents the underlying user or machine, while aliases connect that entity to logins from specific auth methods. Groups provide a way to collect entities and assign policies once at the group level instead of repeating them on every user or auth method mapping. In this scenario, linking a user's LDAP and GitHub aliases to the same entity ensures consistent identity-based access regardless of how they authenticate. Then, using an identity group for platform engineers allows shared policies to be managed centrally. This aligns with Vault best practices and the documented purpose of entities, aliases, and groups in the Identity system.
- A. Incorrect.
Incorrect. While auth method mappings can assign policies at login, this duplicates policy management across auth methods and does not solve the core problem of recognizing the same person across multiple auth backends. Vault identity entities and aliases are designed for this exact use case.
- B. Incorrect.
Incorrect. Vault does not have an "identity secrets engine" for storing user credentials in the way described here. The Identity system manages entities, aliases, groups, and metadata to unify identity across auth methods; it is not a credential vault for end-user login records.
- C. Correct.
Correct. In Vault, an entity represents a single client identity, and aliases map that entity to accounts from different auth methods such as LDAP and GitHub. Groups let administrators assign policies to collections of entities, reducing duplication. This allows the same engineer to receive consistent identity-based policies no matter which auth method they use, while also granting team-level access through group membership.
- D. Incorrect.
Incorrect. Tokens are issued after authentication and are not a mechanism for unifying identity across multiple auth methods. Sharing long-lived tokens is also a poor security practice because it weakens accountability, complicates revocation, and bypasses the intended authentication workflow.