HashiCorp Vault Associate Vault Identity and Entities

Question 1

What is a Vault entity in the context of the Identity secrets engine?

Accepted Answer

A logical representation of a client that can have multiple aliases across different auth methods

Answer

A storage object used to hold static secrets in Vault

Answer

A replication unit used to synchronize data between Vault clusters

Answer

A configuration block that defines audit log destinations

Question 2

What is an alias in the Vault Identity system?

Accepted Answer

A mapping that ties an entity to a specific auth method's local identifier

Answer

An alternate name for a Vault mount path

Answer

A token accessor that can be used in place of the token itself

Answer

A policy shortcut that references a group of ACL rules

Question 3

When a client authenticates to Vault and no existing entity alias matches, what does Vault do?

Accepted Answer

Automatically creates a new entity and a corresponding alias for that auth method

Answer

Returns an authentication error and requires manual entity creation

Answer

Reuses the most recently created entity regardless of auth method

Answer

Prompts an operator to confirm the new identity before issuing a token

Question 4

What is the primary benefit of attaching policies directly to a Vault entity rather than relying solely on auth method policies?

Accepted Answer

Policies on an entity are applied regardless of which auth method was used to authenticate

Answer

Entity policies replace the need for token policies entirely

Answer

Entity policies bypass namespace restrictions for cross-cluster access

Answer

Auth method policies are deprecated and entities are the only supported policy attachment point

Question 5

What is an Identity group in Vault?

Accepted Answer

A collection of entities (or other groups) that can share a common set of policies and metadata

Answer

A cluster of Vault nodes configured for high availability

Answer

A special token type that grants access to all secrets engines

Answer

A replication group used to manage performance replica clusters

Question 6

What distinguishes an internal group from an external group in Vault's Identity system?

Accepted Answer

Internal groups are defined within Vault itself, while external groups are automatically populated from an external identity provider via group aliases

Answer

Internal groups have higher privilege than external groups by default

Answer

External groups can only be used with the AppRole auth method

Answer

Internal groups are replicated across clusters, while external groups are local to a single node

Question 7

Where are policies attached to an entity visible when a client authenticates using that entity?

Accepted Answer

As additional policies in the token returned after authentication

Answer

Only in the Vault audit log, not in the token itself

Answer

They are stored separately and never merged into the token's policy list

Answer

In the entity's metadata field only