HashiCorp Vault Associate (003) Question 237
Single answer9a Describe the Vault AgentA platform team is deploying a legacy application on virtual machines. The application cannot authenticate directly to Vault and cannot renew its own tokens. The team wants the application to read database credentials from a local file on disk, and they also want authentication to Vault and token renewal to happen automatically without changing the application code. Which Vault feature best fits this requirement?
- A
Use Vault Agent with auto-auth and template rendering to authenticate to Vault, manage the token lifecycle, and write secrets to a local file for the application
- B
Use the Vault CLI in a startup script to log in once and write a long-lived root token to disk for the application to reuse
- C
Use Vault Agent only as a TCP load balancer in front of Vault, because it does not handle authentication or secret rendering
- D
Use Vault Agent to replace the Vault server on the VM, since Vault Agent can issue dynamic secrets directly without contacting Vault
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Vault Agent with auto-auth and template rendering. Vault Agent is commonly used when an application cannot natively integrate with Vault. In this scenario, the app needs secrets in a local file and cannot manage authentication or token renewal itself. Vault Agent addresses that by authenticating automatically, maintaining token validity through renewal or re-authentication, and rendering secrets into files via templates. This aligns with HashiCorp guidance on using Vault Agent to simplify application integration, especially for legacy workloads. By contrast, storing a root token on disk is insecure and bypasses best practices for least privilege and token lifecycle management. Vault Agent also does not replace the Vault server; it complements it as a local process that interacts with Vault on behalf of applications.
- A. Correct.
Correct. Vault Agent is designed to help applications that cannot interact with Vault directly. With auto-auth, the agent can authenticate to Vault using a supported auth method and obtain a token. It can then manage token renewal or re-authentication as needed. Using the template functionality, Vault Agent can render secrets retrieved from Vault to local files, which is a common pattern for legacy apps that only know how to read configuration or credentials from disk.
- B. Incorrect.
Incorrect. Writing a long-lived root token to disk is a major security anti-pattern and not a recommended operational approach. While a startup script and Vault CLI could retrieve a token once, this does not provide the automatic renewal and safer token handling that Vault Agent is intended to provide. Root tokens should be tightly controlled and generally not used by applications.
- C. Incorrect.
Incorrect. This describes a capability Vault Agent does not provide. Vault Agent is not simply a TCP load balancer. A common misconception is to think of it only as a network proxy, but its core value includes auto-auth, caching in some use cases, API proxying, and template rendering. It absolutely can handle authentication workflows for clients.
- D. Incorrect.
Incorrect. Vault Agent is not a replacement for the Vault server. It is a client-side helper process that works with Vault. Dynamic secrets are still issued by Vault itself. Vault Agent can request and render those secrets, but it cannot generate them independently without communicating with a Vault server.