HashiCorp Vault Associate (003) Question 8
Single answer1a Define the purpose of authentication methodsA security team is onboarding several internal applications to Vault. The applications already have different ways to prove their identity: one runs on Kubernetes, one runs on AWS EC2, and human administrators use a corporate identity provider. The team wants each client to log in using its existing trusted identity source and then receive a Vault token that is evaluated against Vault policies. Which statement best describes the purpose of Vault authentication methods in this design?
- A
Authentication methods verify a client's identity using an external or built-in identity source and, if successful, issue a Vault token tied to policies
- B
Authentication methods encrypt application secrets before they are stored in Vault so that tokens do not need policies
- C
Authentication methods replace authorization by directly granting access to secret paths without issuing tokens
- D
Authentication methods synchronize users and machines from external systems into Vault's storage so Vault no longer needs identity proofs at login
Show answer and explanation
Correct answer: A
Explanation
Vault separates authentication from authorization. Authentication answers, "Who are you?" and authorization answers, "What are you allowed to do?" Auth methods are enabled at specific paths and provide different ways for users, applications, and machines to prove identity based on their environment or existing identity provider. On success, Vault issues a token. That token is then evaluated against attached policies to allow or deny operations. This is why organizations often choose different auth methods for different client types, such as OIDC or LDAP for humans, Kubernetes for pods, AWS auth for workloads on AWS, and AppRole for certain machine workflows. This aligns with Vault documentation and best practice: use the auth method that best matches the client's existing trusted identity source, then use policies to control access.
- A. Correct.
Correct. In Vault, an auth method is the component a client uses to authenticate to Vault. It validates identity based on some mechanism such as Kubernetes service accounts, AWS IAM/EC2 identity, LDAP, OIDC, AppRole, userpass, and others. After successful authentication, Vault returns a token. That token carries or is associated with policies, and those policies determine what the client is authorized to do.
- B. Incorrect.
Incorrect. Encryption of secrets at rest is not the purpose of authentication methods. Vault handles storage security separately through its storage backend, barrier encryption, and seal mechanisms. Auth methods are about proving identity and obtaining a token, not replacing policy-based access control.
- C. Incorrect.
Incorrect. This confuses authentication with authorization. Vault auth methods do not bypass tokens or policies. Their job is to authenticate the client and issue a token or token-like credential that Vault can use for subsequent authorization decisions. Access to secret paths is still governed by policies.
- D. Incorrect.
Incorrect. Some auth methods integrate with external identity systems, but they do not exist primarily to copy identities into Vault storage or eliminate login-time proof. The key purpose is to let clients authenticate using a trusted identity source and receive a Vault token. Vault still requires a successful login process through the configured auth method.