HashiCorp Vault Associate (003) Question 238
Single answer9a Describe the Vault AgentA team is deploying a legacy web application to virtual machines. The application cannot authenticate directly to Vault and the developers do not want to modify the app to renew tokens or call Vault APIs. The security team also wants secrets written to a local file that the application can read, and they want Vault-issued credentials to be refreshed automatically when they change. Which solution best meets these requirements?
- A
Run Vault Agent on each VM with Auto-Auth and a template stanza so it can authenticate to Vault, manage the token lifecycle, and render secrets to a local file for the application
- B
Use the Vault UI to generate a long-lived token manually for each VM and store the token with the application so it can reuse it after restarts
- C
Configure Vault Agent only as a network proxy because it cannot write secrets to disk or handle authentication on behalf of applications
- D
Use the Vault CLI in a cron job to run vault kv get every hour and overwrite the application's configuration file with the latest secret values
Show answer and explanation
Correct answer: A
Explanation
Vault Agent helps applications consume secrets without directly implementing Vault API calls. Key capabilities relevant to the Vault Associate exam include Auto-Auth for automatic authentication, token caching and lifecycle management, and template rendering for writing secrets into local files. This makes it especially useful for legacy applications that cannot natively integrate with Vault. In HashiCorp documentation and recommended usage patterns, Vault Agent is commonly used to authenticate locally, keep credentials fresh, and render files for applications to consume, reducing the need to distribute static tokens or build custom renewal logic.
- A. Correct.
Correct. Vault Agent is designed for exactly this kind of scenario. With Auto-Auth, the agent can authenticate to Vault using a supported auth method and cache/manage the resulting token so the application does not need to handle authentication or token renewal itself. With the template feature, Vault Agent can render secret data from Vault into local files for applications that expect file-based configuration. When leased or dynamic secrets change, the agent can re-render templates, which is a common pattern for legacy applications and sidecar-style deployments.
- B. Incorrect.
Incorrect. Manually distributing long-lived tokens is not a best practice and increases operational and security risk. It bypasses the main advantages of Vault Agent, such as automatic authentication, token renewal, and secret rendering. Static token placement also creates rotation and revocation challenges and leaves the application responsible for token handling indirectly.
- C. Incorrect.
Incorrect. This reflects a common misconception. Vault Agent can do more than proxy traffic. In addition to optional listener/proxy behavior, it supports Auto-Auth, token caching, and template rendering to local files. Saying it cannot write secrets to disk or authenticate on behalf of applications is factually wrong.
- D. Incorrect.
Incorrect. A cron-based CLI approach is a brittle workaround, not the best solution. It requires external scheduling, usually stores credentials or tokens somewhere for the CLI to use, and does not provide the built-in lifecycle management and event-driven rendering that Vault Agent offers. It may also leave windows where rotated secrets are stale until the next scheduled run.