HashiCorp Vault Associate (003) Question 22
Single answer1d Define the purpose of identities and groupsA company uses Vault with multiple authentication methods. Developers authenticate through GitHub, while contractors authenticate through LDAP. The security team wants everyone on the Payments team to receive the same Vault policies regardless of how they log in, and they want those permissions managed centrally instead of duplicating policy assignments on each auth method. Which Vault feature should the administrator use to meet this requirement?
- A
Create an identity group for the Payments team and attach the required policies to that group, then map the relevant GitHub and LDAP identities or external groups to it
- B
Attach the Payments policies directly to each auth method mount so any user authenticating through GitHub or LDAP automatically receives them
- C
Create a separate token role for Payments users in each auth method and assign policies there, because identity information does not persist across auth methods
- D
Use namespaces to combine GitHub and LDAP users into a single logical team, then apply one set of policies at the namespace level
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Vault Identity groups. In Vault, auth methods answer the question of who is authenticating, while Identity provides a way to unify and manage authorization for those users across auth methods. An entity represents a user or machine identity, and groups allow administrators to assign policies based on team or role rather than repeating assignments in each auth backend. External groups and aliases are commonly used to map memberships from systems like LDAP or GitHub into Vault Identity. This approach follows Vault best practices for centralized authorization and avoids policy duplication. HashiCorp documentation for the Identity secrets engine and group/entity concepts describes this model: use entities to consolidate identities and groups to apply shared policies consistently across authentication sources.
- A. Correct.
Correct. Vault Identity is designed to unify entities across multiple auth methods and apply policies consistently. An identity group lets administrators manage team-based access centrally. Users who authenticate through different auth methods can be linked through entities and group aliases so the same policies are applied no matter whether the user came from GitHub or LDAP. This is the primary purpose of identities and groups in Vault.
- B. Incorrect.
Incorrect. Policies are not assigned to an auth method mount in a way that solves team-based access across different user populations. Auth methods authenticate users, but team authorization should be managed through Identity entities and groups when the goal is centralized access control across multiple auth sources. This option reflects the common misconception that auth methods are the right place to model organizational teams.
- C. Incorrect.
Incorrect. Token roles may be useful in specific workflows, but they are not the feature intended to unify users across multiple authentication methods. Vault Identity exists specifically so a person or machine can be represented consistently regardless of how it authenticates. Saying identity information does not persist across auth methods is the misconception here.
- D. Incorrect.
Incorrect. Namespaces are an enterprise feature used for isolation and multi-tenancy, not for grouping users from different auth methods into a shared authorization model. They do not replace Identity entities and groups. This option confuses administrative isolation with identity-based access management.