HashiCorp Vault Associate Vault Identity and Entities 3

Question 1

How are policies inherited through group membership in Vault's Identity system?

Accepted Answer

Policies on a group are inherited by all member entities and transitively by members of nested sub-groups

Answer

Only direct group members inherit policies; sub-group members do not

Answer

Group policies only apply when the entity authenticates using a specific auth method

Answer

Inheritance requires explicit policy binding on each entity; groups do not propagate policies

Question 2

What is the purpose of a 'group alias' in Vault's Identity system?

Accepted Answer

To map an external group (e.g., an LDAP group) to a Vault internal group for automatic membership syncing

Answer

To give a group an alternate name for CLI convenience

Answer

To allow a group's policies to be referenced by their alias in policy documents

Answer

To create a read-only snapshot of a group's membership at a specific point in time

Question 3

Which Vault CLI command would you use to read the details of a specific entity by its name?

Accepted Answer

vault read identity/entity/name/<name>

Answer

vault read sys/entity/name/<name>

Answer

vault get auth/entity/<name>

Answer

vault identity show entity <name>

Question 4

In a Vault namespace, how does identity work relative to the root namespace?

Accepted Answer

Each namespace has its own isolated identity store with separate entities and groups

Answer

All namespaces share a single identity store located in the root namespace

Answer

Entities are created in the root namespace but can be referenced from child namespaces

Answer

Identity is disabled in namespaces below the root by default

Question 5

What entity-related information is included in a Vault audit log entry when a client authenticates?

Accepted Answer

The entity ID and entity name, if the authenticating identity is mapped to an entity

Answer

Only the token accessor; entity data is never written to audit logs for security reasons

Answer

The full list of entity policies in plaintext

Answer

Only the group IDs the entity belongs to, not the entity itself

Question 6

What is the effect of disabling an entity in Vault?

Accepted Answer

Any token linked to that entity is denied access to Vault, even if the token itself is still valid

Answer

The entity's aliases are deleted and cannot be recreated

Answer

The entity is moved to a quarantine namespace until re-enabled

Answer

Disabling an entity only prevents new logins; existing tokens continue to work normally

Question 7

Which of the following best describes how Vault uses entity IDs in its PKI and secrets engine workflows?

Accepted Answer

Entity IDs can be embedded in secret lease metadata to track which identity created or renewed a secret

Answer

Entity IDs are used as the Common Name (CN) in PKI certificates by default

Answer

Entity IDs are used as encryption keys for wrapping responses

Answer

Entity IDs replace token accessors as the primary audit identifier in all secrets engines