HashiCorp Vault Associate (003) Question 7
Single answer1a Define the purpose of authentication methodsA company is deploying HashiCorp Vault for both human operators and application workloads. The security team wants engineers to sign in with the company's existing identity provider, while applications running in Kubernetes should authenticate without sharing long-lived credentials. During a design review, a junior engineer says, "Authentication methods are where we define what data users can read and write." Which statement best describes the purpose of Vault authentication methods in this scenario?
- A
Authentication methods verify the identity of a user or machine and return a Vault token; access to data is then controlled by policies attached to that token.
- B
Authentication methods are used to encrypt and decrypt secrets before they are written to the storage backend, and policies are optional.
- C
Authentication methods define which secret engines a client can mount and configure, while tokens are only used for audit logging.
- D
Authentication methods replicate identities from external systems into Vault storage so Vault can authorize requests without tokens.
Show answer and explanation
Correct answer: A
Explanation
The correct answer is that authentication methods in Vault are used to verify identity and issue a token. This is a foundational concept for the Vault Associate exam. In practice, different auth methods exist for different client types and trust models: OIDC or LDAP for human users, and methods such as Kubernetes, AppRole, AWS, or cert auth for machines and workloads. Once authenticated, Vault returns a token, and that token's policies determine authorization to secret paths and operations. This separation between authentication and authorization is a key Vault design principle. HashiCorp documentation describes auth methods as components that authenticate users or machines and assign them policies through the resulting token. Best practice is to choose auth methods that match the environment and avoid sharing static credentials, especially for workloads.
- A. Correct.
Correct. In Vault, auth methods are the mechanisms clients use to prove identity, such as OIDC for human users or Kubernetes auth for pods. After successful authentication, Vault issues a token that represents the authenticated identity. Policies associated with that token determine what paths and capabilities the client has. This is the core separation in Vault: authentication establishes who the client is, and authorization determines what the client can do.
- B. Incorrect.
Incorrect. Encryption of secrets at rest is handled by Vault's storage and barrier encryption model, not by authentication methods. Auth methods do not perform the role of encrypting or decrypting secrets for storage. Policies are not optional for authorization; they are central to controlling access after authentication succeeds.
- C. Incorrect.
Incorrect. Secret engines are enabled and managed by Vault administrators with appropriate privileges, not defined by auth methods. Tokens are much more than audit identifiers; they are the primary credential used by Vault after authentication and carry policies, TTLs, and other metadata that control access.
- D. Incorrect.
Incorrect. Vault auth methods can integrate with external identity systems, but their purpose is not to copy all identities into Vault storage for later authorization without tokens. Vault still issues and relies on tokens after authentication. Some auth methods may create or map aliases and entities in the identity system, but that is not the primary purpose of auth methods.