HashiCorp Vault Associate Vault Identity and Entities 2

Question 1

Can a single Vault entity have more than one alias?

Accepted Answer

Yes, an entity can have one alias per auth method mount, allowing a single identity across multiple login methods

Answer

No, each entity is limited to exactly one alias per Vault cluster

Answer

Yes, but only if the entity belongs to at least one internal group

Answer

No, multiple aliases require creating separate entities that are then merged

Question 2

What API path is used to create or manage Vault entities via the HTTP API?

Accepted Answer

identity/entity

Answer

sys/identity/entity

Answer

auth/identity/entity

Answer

secret/identity/entity

Question 3

What happens to an entity's aliases when the auth method mount they belong to is disabled?

Accepted Answer

The aliases are deleted, but the entity itself remains intact

Answer

The aliases are automatically transferred to the default auth mount

Answer

Both the entity and its aliases are permanently deleted

Answer

The aliases are preserved and reassigned to the nearest enabled auth mount

Question 4

How can an operator manually merge two Vault entities that represent the same real user?

Accepted Answer

By sending a POST request to 'identity/entity/merge' specifying the source and destination entity IDs

Answer

By using the 'vault operator merge-entity' CLI command

Answer

By deleting one entity and reassigning its aliases to the other via the auth method config

Answer

By editing the Vault storage backend directly to combine the entity records

Question 5

Which field on a Vault entity is most useful for storing human-readable metadata like department or team?

Accepted Answer

entity.metadata

Answer

entity.labels

Answer

entity.tags

Answer

entity.annotations

Question 6

How do entity aliases interact with policy templating in Vault?

Accepted Answer

Policy templates can reference entity metadata and alias name using double-curly-bracket syntax

Answer

Aliases cannot be referenced in policy templates; only group membership can be

Answer

Policy templating only works with tokens, not with identity entities

Answer

Aliases are hashed before use in templates to prevent information leakage

Question 7

When a token is created using the 'token create' command with no associated entity, how does Vault treat its identity?

Accepted Answer

The token has no associated entity and thus no entity policies apply

Answer

Vault automatically creates a new entity for every token regardless of how it was created

Answer

The token inherits the entity of the creating token automatically

Answer

Vault assigns the token to a built-in anonymous entity