HashiCorp Vault Associate (003) Question 230
Single answer9 Access management architectureA platform team uses Vault to provide database credentials to applications in three environments: dev, qa, and prod. They want to let application teams manage their own secrets within their environment, but they do not want any team to be able to create broad policies, change auth methods, or view other environments' secrets. The team is considering using Vault namespaces and delegated administration. Which approach best meets these requirements?
- A
Create a separate namespace for each environment and grant namespace-scoped administrative policies within each namespace to the appropriate application team.
- B
Keep all secrets in the root namespace and give each application team sudo capabilities on their environment paths so they can administer access safely.
- C
Create one shared namespace for all environments and rely on identity groups to prevent cross-environment visibility, while allowing teams to manage auth methods.
- D
Run a separate Vault cluster for each environment because Vault cannot delegate administration safely within a single deployment.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use namespaces as administrative and isolation boundaries. In Vault Enterprise, namespaces allow organizations to partition a single Vault deployment so that teams can manage their own auth methods, secrets engines, policies, and secrets within a confined scope. This is a common access management architecture pattern for multi-team or multi-environment deployments. Using the root namespace for all teams with broad capabilities like sudo violates least-privilege principles. Identity groups are useful for mapping external identities to policies, but they are not a substitute for namespace isolation. HashiCorp documentation describes namespaces as a way to support multi-tenancy and delegated administration, which aligns directly with this scenario.
- A. Correct.
Correct. Namespaces are designed to provide isolation and delegated administration boundaries within Vault Enterprise. By creating separate namespaces for dev, qa, and prod, the platform team can isolate secrets, auth methods, policies, and administrative control for each environment. Granting namespace-scoped administrative permissions lets application teams manage resources inside their own namespace without affecting other namespaces or the root namespace.
- B. Incorrect.
Incorrect. Keeping everything in the root namespace weakens isolation and giving sudo is far too broad for this requirement. sudo permits privileged actions on matching paths and is not the right mechanism for safe delegated administration across teams and environments. This approach increases the risk of misconfiguration and over-privilege.
- C. Incorrect.
Incorrect. A single shared namespace reduces the administrative boundary the scenario requires. Identity groups help map users and policies, but they do not replace namespace-level isolation for administration. Allowing teams to manage auth methods in a shared namespace would create unnecessary risk and could impact other environments.
- D. Incorrect.
Incorrect. Separate clusters can provide strong isolation, but the statement that Vault cannot safely delegate administration within a single deployment is false. Vault Enterprise namespaces are specifically intended to support multi-tenancy and delegated administration without requiring a separate cluster per tenant or environment in many use cases.