HashiCorp Vault Associate (003) Question 24
Single answer1d Define the purpose of identities and groupsA company uses Vault with both the LDAP auth method for employees and the GitHub auth method for contractors. The security team wants members of the Platform Engineering team to receive the same policies regardless of which auth method they use, and they want access to follow the user rather than depend on a specific token. Which Vault approach best meets this requirement?
- A
Create an identity group for Platform Engineering, attach the required policies to that group, and map the LDAP and GitHub external groups or aliases to it
- B
Attach the required policies directly to each token issued by LDAP and GitHub so access is identical across logins
- C
Create one auth method role named platform-engineering and reuse that same role across LDAP and GitHub to share policies
- D
Enable a separate secrets engine for Platform Engineering and grant access based on the mount path instead of identities
Show answer and explanation
Correct answer: A
Explanation
The key purpose of Vault Identity is to provide a consistent representation of a user or machine across multiple auth methods. An entity represents the authenticated principal, and groups allow common policies to be assigned once and reused. In real environments, the same person may authenticate through LDAP, OIDC, GitHub, or another auth method at different times. Without Identity, administrators would need to duplicate policy mappings in each auth method or rely on token-specific assignments. Best practice is to use entities and identity groups so authorization follows the identity, not the specific token or backend used to log in. HashiCorp Vault documentation on the Identity secrets engine and identity groups describes this pattern: entities unify aliases from different auth methods, and groups aggregate policies for shared access control.
- A. Correct.
Correct. Vault Identity is designed to unify entities across auth methods and apply policy consistently to the user or group identity rather than to a single login event. By creating an identity group and associating external groups or aliases from LDAP and GitHub, Vault can grant the same policies to users who authenticate through different methods. This is the practical purpose of identities and groups: consolidating who a user is and what access they should have across multiple authentication backends.
- B. Incorrect.
Incorrect. Policies attached to tokens can grant access, but this does not solve the identity unification problem well. Tokens are individual authentication results, not a persistent representation of the user across auth methods. Managing access by attaching policies to each token is operationally harder and does not use Vault Identity and groups for centralized authorization.
- C. Incorrect.
Incorrect. Auth methods have their own configuration concepts, but there is no general mechanism where a single shared role across unrelated auth methods becomes the identity layer for all users. Roles or mappings inside an auth method do not replace Vault entities and groups, which are the feature intended to unify identity and policy assignment across authentication sources.
- D. Incorrect.
Incorrect. Secrets engines store and serve secrets; they do not define who a user is across auth methods. Access to a mount path is still controlled by policies, and the requirement here is to make policy assignment consistent for the same team regardless of login source. Identity groups, not separate secrets engines, address that need.