HashiCorp Vault Associate (003) Question 228
Single answer8e Differentiate between self-managed and HashiCorp-managed Vault clustersA security team is deciding whether to run Vault themselves on virtual machines or use a HashiCorp-managed Vault cluster through HCP. They want to reduce the operational burden of maintaining Vault infrastructure, including cluster provisioning and routine platform upkeep, while still being able to configure secrets engines, auth methods, policies, and namespaces for their applications. Which option best meets these requirements?
- A
Use a self-managed Vault cluster, because only self-managed deployments allow configuration of auth methods and secrets engines.
- B
Use a HashiCorp-managed Vault cluster on HCP, because HashiCorp manages the Vault cluster infrastructure and lifecycle while customers still manage Vault configuration inside the cluster.
- C
Use a self-managed Vault cluster, because HashiCorp-managed Vault clusters do not support enterprise features such as namespaces.
- D
Use a HashiCorp-managed Vault cluster on HCP, because HashiCorp also takes over application-specific policy design and secret onboarding for the customer.
Show answer and explanation
Correct answer: B
Explanation
The key distinction is operational responsibility. In a self-managed Vault deployment, the customer is responsible for standing up and operating the Vault cluster and its supporting infrastructure. That includes tasks such as deployment architecture, upgrades, availability design, storage/backend choices as applicable, monitoring, and routine maintenance. In a HashiCorp-managed Vault cluster on HCP, HashiCorp operates the cluster service, reducing the customer's infrastructure burden. However, customers still manage their Vault configuration and usage inside the cluster, such as auth methods, secrets engines, policies, tokens, and namespaces. This is a common exam theme: managed Vault reduces platform operations, but it does not remove the customer's responsibility for access design and secrets management practices. See HashiCorp documentation for HCP Vault and Vault Enterprise guidance on operational responsibilities and features such as namespaces.
- A. Incorrect.
Incorrect. Self-managed Vault does let an organization configure auth methods, secrets engines, policies, and other Vault features, but that is not unique to self-managed deployments. In a HashiCorp-managed Vault cluster, customers still administer their Vault usage and configuration within the cluster. The misconception is that managed service means losing control of Vault configuration, which is not true.
- B. Correct.
Correct. A HashiCorp-managed Vault cluster in HCP is designed to reduce operational responsibility for the underlying Vault cluster. HashiCorp handles service-side tasks such as provisioning and managing the cluster platform, while the customer remains responsible for how Vault is used: enabling auth methods, configuring secrets engines, writing ACL policies, and organizing access for applications and teams. This directly matches the scenario's goal of lowering infrastructure operations without giving up Vault administration.
- C. Incorrect.
Incorrect. HashiCorp-managed Vault clusters are available with Vault Enterprise capabilities, including namespaces. The misconception here is that managed offerings are feature-limited compared with self-managed deployments. In practice, HCP Vault Dedicated is intended to provide managed Vault while still exposing Vault functionality appropriate to the service tier.
- D. Incorrect.
Incorrect. HashiCorp-managed means HashiCorp manages the service infrastructure and cluster operations, not the customer's security design or application onboarding work. Customers are still responsible for defining policies, choosing auth methods, enabling and configuring secrets engines, and integrating applications. This option confuses platform management with day-to-day Vault administration.