HashiCorp Vault Associate Vault Identity and Entities 2

Question 1

Can a single Vault entity have more than one alias?

Accepted Answer

Yes, an entity can have one alias per auth method mount, allowing a single identity across multiple login methods

Answer

A Vault entity can have multiple aliases, one per auth method mount, representing the same person logging in through different authentication providers.

Question 2

What API path is used to create or manage Vault entities via the HTTP API?

Accepted Answer

identity/entity

Answer

The Identity secrets engine is accessed at the 'identity/' path prefix, so entity management operations are performed at 'identity/entity'.

Question 3

What happens to an entity's aliases when the auth method mount they belong to is disabled?

Accepted Answer

The aliases are deleted, but the entity itself remains intact

Answer

Disabling an auth method mount removes the aliases tied to that mount, but the entity persists with any remaining aliases and its attached policies.

Question 4

How can an operator manually merge two Vault entities that represent the same real user?

Accepted Answer

By sending a POST request to 'identity/entity/merge' specifying the source and destination entity IDs

Answer

Vault exposes the 'identity/entity/merge' API endpoint that accepts source entity IDs and a destination entity ID to combine duplicate identity records.

Question 5

Which field on a Vault entity is most useful for storing human-readable metadata like department or team?

Accepted Answer

entity.metadata

Answer

Vault entities support a 'metadata' key-value map that operators can populate with arbitrary data like department, team, or cost center for policy templating or audit purposes.

HashiCorp Vault Practice Test

HashiCorp Vault Practice Test

HashiCorp Vault Associate Vault Identity and Entities 2