HashiCorp Vault Associate (003) Question 225
Single answer8e Differentiate between self-managed and HashiCorp-managed Vault clustersA security team is deciding between running Vault themselves on virtual machines and using a HashiCorp-managed Vault cluster through HCP Vault Dedicated. They want to reduce operational overhead for cluster lifecycle tasks, but they still need to configure secrets engines, auth methods, policies, and leases for their applications. Which statement best describes the practical difference between a self-managed Vault cluster and a HashiCorp-managed Vault cluster in this scenario?
- A
With a HashiCorp-managed Vault cluster, HashiCorp operates the Vault infrastructure and cluster lifecycle, while the customer still manages Vault configuration and usage such as auth methods, secrets engines, policies, and application access.
- B
With a HashiCorp-managed Vault cluster, HashiCorp manages all Vault policies, secrets engines, and authentication configuration, so the customer only submits secret requests through an API.
- C
With a self-managed Vault cluster, HashiCorp is responsible for patching, upgrades, storage backend maintenance, and high availability, while the customer only manages tokens and policies.
- D
There is no operational difference between self-managed and HashiCorp-managed Vault clusters; the only distinction is the licensing model.
Show answer and explanation
Correct answer: A
Explanation
The exam objective here is to distinguish operational responsibility from logical Vault administration. In self-managed Vault, the organization is responsible for deploying, maintaining, upgrading, monitoring, and recovering the Vault cluster and its supporting infrastructure. In a HashiCorp-managed cluster such as HCP Vault Dedicated, HashiCorp assumes responsibility for operating the service infrastructure and cluster lifecycle. However, the customer still configures Vault for their use cases, including auth methods, policies, secrets engines, roles, and application access patterns. This aligns with HashiCorp documentation for HCP Vault Dedicated, which positions it as a managed Vault service rather than a fully outsourced security-administration model. A practical rule: managed service reduces platform operations, but it does not remove the customer's responsibility for Vault's logical security configuration and day-to-day usage.
- A. Correct.
Correct. This is the key distinction candidates should understand. In a HashiCorp-managed offering such as HCP Vault Dedicated, HashiCorp manages the underlying Vault cluster operations and platform responsibilities, such as provisioning and much of the day-to-day infrastructure management. However, customers still administer how Vault is used: enabling and configuring auth methods, secrets engines, policies, namespaces if applicable, roles, and application integrations. Managed does not mean HashiCorp designs or operates the customer's security model inside Vault.
- B. Incorrect.
Incorrect. This reflects a common misconception that 'managed service' means HashiCorp takes over tenant-specific security administration. In reality, customers remain responsible for their own Vault data model and access design, including policies, auth methods, secret paths, and integrations. HashiCorp does not define application-level secret governance for the customer.
- C. Incorrect.
Incorrect. This reverses the responsibility model. In a self-managed Vault deployment, the customer is responsible for operating the cluster, including installation, upgrades, patching, availability architecture, and backend/storage choices supported by their deployment. HashiCorp does not run those customer-owned environments for them.
- D. Incorrect.
Incorrect. There is a significant operational difference. Self-managed Vault requires the customer to operate and maintain the Vault cluster and supporting infrastructure. HashiCorp-managed Vault reduces that operational burden by having HashiCorp run the service. The distinction is not merely contractual or licensing-related.