HashiCorp Vault Associate Vault Identity and Entities 1 — Questions and Answers
Question 1: What is a Vault entity in the context of the Identity secrets engine?
- A logical representation of a client that can have multiple aliases across different auth methods (Correct answer)
- A storage object used to hold static secrets in Vault
- A replication unit used to synchronize data between Vault clusters
- A configuration block that defines audit log destinations
Correct answer: A logical representation of a client that can have multiple aliases across different auth methods
A Vault entity is a logical abstraction representing a user or system that may authenticate via different auth methods, each mapped as an alias on that entity.
Question 2: What is an alias in the Vault Identity system?
- An alternate name for a Vault mount path
- A mapping that ties an entity to a specific auth method's local identifier (Correct answer)
- A token accessor that can be used in place of the token itself
- A policy shortcut that references a group of ACL rules
Correct answer: A mapping that ties an entity to a specific auth method's local identifier
An alias links a Vault entity to the identifier used by a particular auth method (e.g., a GitHub username or LDAP DN), allowing multiple auth identities to map to one entity.
Question 3: When a client authenticates to Vault and no existing entity alias matches, what does Vault do?
- Returns an authentication error and requires manual entity creation
- Automatically creates a new entity and a corresponding alias for that auth method (Correct answer)
- Reuses the most recently created entity regardless of auth method
- Prompts an operator to confirm the new identity before issuing a token
Correct answer: Automatically creates a new entity and a corresponding alias for that auth method
Vault automatically creates a new entity and alias the first time a client authenticates with a new auth method identity, enabling seamless identity tracking.
Question 4: What is the primary benefit of attaching policies directly to a Vault entity rather than relying solely on auth method policies?
- Entity policies replace the need for token policies entirely
- Policies on an entity are applied regardless of which auth method was used to authenticate (Correct answer)
- Entity policies bypass namespace restrictions for cross-cluster access
- Auth method policies are deprecated and entities are the only supported policy attachment point
Correct answer: Policies on an entity are applied regardless of which auth method was used to authenticate
Policies attached to an entity are included in the token's policy set no matter which auth method the client used, enabling consistent access control across login methods.
Question 5: What is an Identity group in Vault?
- A cluster of Vault nodes configured for high availability
- A collection of entities (or other groups) that can share a common set of policies and metadata (Correct answer)
- A special token type that grants access to all secrets engines
- A replication group used to manage performance replica clusters
Correct answer: A collection of entities (or other groups) that can share a common set of policies and metadata
An Identity group is a collection of entities and sub-groups that inherits shared policies and metadata, making it easy to manage access for a set of users collectively.
Question 6: What distinguishes an internal group from an external group in Vault's Identity system?
- Internal groups are defined within Vault itself, while external groups are automatically populated from an external identity provider via group aliases (Correct answer)
- Internal groups have higher privilege than external groups by default
- External groups can only be used with the AppRole auth method
- Internal groups are replicated across clusters, while external groups are local to a single node
Correct answer: Internal groups are defined within Vault itself, while external groups are automatically populated from an external identity provider via group aliases
Internal groups are manually managed within Vault, whereas external groups are populated automatically from an external provider (e.g., LDAP groups) using group aliases.
Question 7: Where are policies attached to an entity visible when a client authenticates using that entity?
- Only in the Vault audit log, not in the token itself
- As additional policies in the token returned after authentication (Correct answer)
- They are stored separately and never merged into the token's policy list
- In the entity's metadata field only
Correct answer: As additional policies in the token returned after authentication
Entity policies are merged into the token's effective policy set at authentication time, so they appear as part of the policies listed on the issued token.
HashiCorp Vault Associate Vault Identity and Entities 1
What is a Vault entity in the context of the Identity secrets engine?