HashiCorp Vault Associate (003) Question 3
Single answer1 Authentication methodsA company runs Vault for both human administrators and application workloads. The security team wants to reduce the risk of long-lived shared credentials being stored in CI/CD pipelines and on application hosts. They also want each application instance to authenticate using its own identity and receive short-lived Vault tokens automatically. Which authentication method is the best fit for this requirement in a cloud environment where workloads run on supported compute instances?
- A
Use the AppRole auth method with a shared RoleID and SecretID embedded in the deployment pipeline for all application instances
- B
Use a cloud instance identity auth method, such as AWS or GCP auth, so each workload can authenticate using the platform's instance identity
- C
Use the userpass auth method so each application instance logs in with a username and password managed by the operations team
- D
Use the token auth method and distribute a single periodic token to all application instances at deployment time
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use a cloud instance identity auth method such as AWS or GCP auth. For Vault Associate-level understanding, a key distinction among auth methods is whether they are intended for humans, machines, or platform-native identities. In this scenario, the company wants machine authentication without distributing long-lived shared secrets. Vault's cloud auth methods let workloads prove their identity using trusted metadata or signed identity documents from the cloud platform, after which Vault issues a token subject to Vault policies and TTLs. This improves security, auditability, and operational simplicity because each instance gets its own Vault identity and short-lived token. By contrast, userpass is for human login, token auth with a shared token creates a reusable shared secret, and AppRole implemented with a shared embedded SecretID undermines the goal of avoiding static credentials. This aligns with HashiCorp guidance to prefer trusted identity sources and short-lived credentials where possible.
- A. Incorrect.
Incorrect. AppRole is commonly used for machine authentication, but this option specifically describes embedding a shared SecretID in the deployment pipeline for all instances, which reintroduces the problem of distributing and storing long-lived shared credentials. While AppRole can be implemented more securely, this scenario asks for each instance to authenticate using its own identity without relying on shared static secrets.
- B. Correct.
Correct. Cloud auth methods such as AWS or GCP auth are designed for workloads running on supported cloud platforms. Vault can verify instance identity based on metadata or signed identity documents from the cloud provider, allowing each instance to authenticate as itself and receive short-lived Vault tokens. This aligns with the requirement to avoid long-lived shared credentials and to give each workload its own identity.
- C. Incorrect.
Incorrect. The userpass auth method is intended for human users, not application workloads. Managing usernames and passwords for individual application instances would be operationally difficult and less secure than using a workload identity-based auth method. It also does not match the requirement to avoid stored shared credentials in automation environments.
- D. Incorrect.
Incorrect. The token auth method can authenticate directly with a token, but distributing a single token to all application instances creates a shared credential and weakens auditability and isolation. If one host is compromised, the shared token can be reused elsewhere. This does not provide per-instance identity or the strongest fit for the stated requirements.