HashiCorp Vault Associate (003) Question 227
Single answer8e Differentiate between self-managed and HashiCorp-managed Vault clustersA company is evaluating whether to run Vault themselves or use HashiCorp Cloud Platform (HCP) Vault Dedicated. The security team wants HashiCorp to operate the Vault cluster infrastructure, including cluster provisioning, patching, and routine operational maintenance, while the company retains responsibility for configuring auth methods, policies, secrets engines, and access controls inside Vault. Which option best matches these requirements?
- A
Deploy a self-managed Vault cluster, because only self-managed Vault lets the customer control auth methods and policies while HashiCorp maintains the servers
- B
Use HCP Vault Dedicated, because HashiCorp manages the Vault cluster infrastructure and operations, while the customer still administers Vault configuration and data access
- C
Use HCP Vault Dedicated, because HashiCorp manages both the cluster operations and all Vault security configuration such as policies, auth methods, and secret rotation rules
- D
Deploy a self-managed Vault cluster, because HashiCorp-managed Vault does not allow customers to configure secrets engines or auth methods
Show answer and explanation
Correct answer: B
Explanation
This question tests the practical distinction between self-managed Vault and HashiCorp-managed Vault clusters. In a self-managed model, the organization operates the Vault cluster itself, including deployment, scaling, upgrades, patching, monitoring, and recovery planning. In a HashiCorp-managed model such as HCP Vault Dedicated, HashiCorp operates the Vault service infrastructure and routine cluster maintenance. However, customers still administer how Vault is used: they configure auth methods, policies, secrets engines, and client access. This is a key exam concept: managed Vault changes who runs the platform, not who defines the organization's security policies and secret workflows. This aligns with HashiCorp guidance distinguishing operational responsibility for the cluster from administrative responsibility for Vault configuration and usage.
- A. Incorrect.
Incorrect. In a self-managed deployment, the customer is responsible for operating the Vault cluster infrastructure themselves. That includes installation, upgrades, patching, storage backend decisions, availability design, monitoring, and day-to-day operations. While customers do control auth methods and policies in self-managed Vault, HashiCorp does not maintain the servers in that model.
- B. Correct.
Correct. HCP Vault Dedicated is a HashiCorp-managed Vault offering. HashiCorp operates the cluster infrastructure and handles operational tasks such as provisioning and maintenance of the managed service. The customer still configures and uses Vault itself: enabling auth methods and secrets engines, writing policies, managing namespaces if applicable, and controlling how applications and users access secrets.
- C. Incorrect.
Incorrect. This overstates what HashiCorp manages in a HashiCorp-managed cluster. Even with HCP Vault Dedicated, the customer remains responsible for logical Vault administration inside the cluster, such as policies, auth methods, secrets engines, and access patterns. HashiCorp manages the service infrastructure and platform operations, not the customer's security model or business-specific Vault configuration.
- D. Incorrect.
Incorrect. HashiCorp-managed Vault does allow customers to configure Vault features such as auth methods and secrets engines. A common misconception is that managed service means the customer loses administrative control over Vault configuration. In reality, the operational responsibility for the cluster is delegated to HashiCorp, while Vault usage and configuration remain the customer's responsibility.