HashiCorp Vault Associate (003) Question 229
Single answer8e Differentiate between self-managed and HashiCorp-managed Vault clustersA security team is deciding whether to run Vault themselves on virtual machines or use a HashiCorp-managed Vault cluster in HCP. They want to reduce operational overhead for cluster infrastructure, but they still need to control Vault configuration such as auth methods, policies, secrets engines, and lease behavior. Which statement best describes the trade-off between self-managed and HashiCorp-managed Vault clusters in this scenario?
- A
With a HashiCorp-managed Vault cluster, HashiCorp operates the Vault cluster infrastructure, while the customer still manages Vault usage such as auth methods, policies, and secrets engines.
- B
With a HashiCorp-managed Vault cluster, HashiCorp manages both the cluster infrastructure and all Vault security configuration, including policies and enabled secrets engines.
- C
With a self-managed Vault cluster, HashiCorp is responsible for upgrades, storage backend operations, and availability, but the customer manages policies and tokens.
- D
With a self-managed Vault cluster, the customer can manage auth methods and policies, but cannot control seal configuration or storage choices.
Show answer and explanation
Correct answer: A
Explanation
This question tests the key distinction between self-managed and HashiCorp-managed Vault clusters: who operates the cluster infrastructure versus who administers Vault usage and security configuration. In self-managed Vault, the organization is responsible for deploying, upgrading, scaling, monitoring, and maintaining the cluster and its supporting infrastructure. In HashiCorp-managed Vault, HashiCorp operates the cluster platform, reducing operational overhead. However, customers still manage Vault-specific configuration such as auth methods, policies, secrets engines, and how applications use Vault. This aligns with HashiCorp guidance for HCP Vault, where the service provider manages the cluster service, but customers remain responsible for their secrets, access controls, and Vault configuration within the cluster.
- A. Correct.
Correct. In a HashiCorp-managed Vault offering such as HCP Vault Dedicated, HashiCorp is responsible for operating the underlying Vault cluster infrastructure and platform concerns, reducing operational burden for the customer. However, the customer still administers Vault itself from a security and usage perspective, including enabling auth methods, writing policies, configuring secrets engines, and managing how applications authenticate and consume secrets.
- B. Incorrect.
Incorrect. This confuses infrastructure management with tenant-level Vault administration. Even when HashiCorp manages the cluster, customers are still responsible for their Vault data model and security configuration inside their cluster, such as policies, namespaces where applicable, auth methods, and secret engine configuration. HashiCorp does not take over day-to-day policy design or application onboarding.
- C. Incorrect.
Incorrect. This reverses the responsibility model. In a self-managed Vault deployment, the customer is responsible for operating the platform: installation, upgrades, storage backend setup, availability architecture, monitoring, and related operational tasks. HashiCorp does not run those environments for the customer.
- D. Incorrect.
Incorrect. In a self-managed deployment, the customer has broad control over operational and Vault-level configuration, including storage choices and seal-related design decisions, subject to the edition and deployment architecture being used. This option incorrectly suggests self-managed Vault limits those infrastructure decisions.