HashiCorp Vault Associate (003) Question 23
Single answer1d Define the purpose of identities and groupsA company uses Vault with multiple auth methods. Developers authenticate through GitHub, while some contractors authenticate through LDAP. Security wants everyone on the Payments team to receive the same Vault policies regardless of how they log in, and they want policy assignment to follow the person rather than depend on a specific auth mount. Which Vault approach best meets this requirement?
- A
Create an identity group for the Payments team, attach the required policies to the group, and map the appropriate GitHub and LDAP entities or aliases into that group.
- B
Create matching token policies on both the GitHub and LDAP auth methods so users get the same access based on the mount they use.
- C
Create a separate policy for each auth method and rely on token TTL settings so access remains consistent across logins.
- D
Store the Payments team membership in the KV secrets engine and have applications read it before requesting secrets.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Vault Identity entities, aliases, and groups. In Vault, an entity represents a client or user, and aliases link that entity to accounts from different auth methods such as LDAP, GitHub, AppRole, or userpass. Groups are used to collect entities and assign policies once, so authorization can be managed consistently even when users authenticate through different mounts. This is a core purpose of identities and groups in Vault: decoupling who the user is from how the user authenticated. HashiCorp documentation for the Identity secrets engine and group/entity concepts describes this pattern as the preferred way to unify identity across auth methods and apply policies centrally.
- A. Correct.
Correct. Vault Identity is designed to unify a user across different authentication methods. An entity represents the user, aliases connect that entity to identities from specific auth mounts, and groups let you assign policies to collections of entities. This allows Payments team members to receive the same policies whether they authenticate with GitHub or LDAP. This is the purpose of identities and groups: centralize identity-aware policy assignment independent of the auth method used.
- B. Incorrect.
Incorrect. While assigning similar policies on each auth method can produce comparable results, it ties authorization to the auth mount rather than to the person. This creates duplication and makes administration harder when users authenticate through multiple methods. It does not use Vault Identity to unify access across auth backends.
- C. Incorrect.
Incorrect. TTL settings control how long a token is valid, not how identity-based authorization is managed. Separate policies per auth method still duplicate administration and do not solve the requirement that policy assignment should follow the user across different login methods.
- D. Incorrect.
Incorrect. The KV secrets engine is for storing key-value data, not for implementing Vault's identity and policy model. Team membership used for access control should be handled through Vault Identity entities and groups, not by having applications interpret custom data from KV before requesting secrets.