Comprehensive and Detailed in Depth

Token is enabled by default and cannot be disabled.

Userpass is explicitly enabled.

Total: 2 auth methods.

Overall Explanation from Vault Docs:

“Tokens are the default auth method… Additional methods like userpass increase the count.”

Reference: https://developer.hashicorp.com/vault/docs/concepts/tokens

Comprehensive and Detailed In-Depth

To ensure consistent access permissions for Sarah across multiple authentication methods (LDAP and

GitHub), the correct approach in Vault is to create an entity for Sarah and map both her LDAP and

GitHub identities as entity aliases to this single entity.

Entities and Aliases in Vault: Vault’s Identity secrets engine allows the creation of entities, which are

logical representations of users or machines. Each entity can have multiple aliases, where an alias

corresponds to an identity from a specific auth method. By mapping Sarah’s LDAP identity (e.g., her

LDAP username) and GitHub identity (e.g., her GitHub username) as aliases to a single entity, Vault

associates both identities with one set of policies. The documentation states: "Vault clients can be

mapped as entities and their corresponding accounts with authentication providers can be mapped

as aliases."

Why This Works: Assigning policies to the entity ensures that Sarah’s permissions remain consistent

regardless of whether she logs in via LDAP or GitHub. This centralizes policy management and

eliminates discrepancies.

Incorrect Options:

B. External Group Approach: Creating an external group and adding LDAP and GitHub providers as

members does not inherently synchronize permissions for a single user like Sarah. External groups

are better suited for mapping group memberships from external systems to Vault policies, not

individual identity unification.

C. Separate Policies: Managing separate policies per auth method is error-prone and inefficient.

Manual synchronization risks inconsistencies, undermining security and manageability.

D. Trust Relationship: Vault does not support configuring trust relationships between auth methods

like LDAP and GitHub to sync accounts. This is a misunderstanding of Vault’s architecture.

This entity-based approach leverages Vault’s identity system to unify Sarah’s access, simplifying

administration and ensuring consistency.

Reference: https://developer.hashicorp.com/vault/tutorials/auth-methods/identity

Comprehensive and Detailed in Depth

The statement is False. Setting the minimum decryption version does not remove older key versions.

The HashiCorp Vault documentation states: "Key versions that are earlier than a key’s specified

min_decryption_version get archived, and the rest of the key versions belong to the working set. In

an emergency, the min_decryption_version can be moved back to allow for legitimate decryption."

Older versions remain available for decryption if needed.

The docs add: "Archiving a key version does not delete it; it simply marks it as outside the active

working set, but Vault retains it for potential use." Thus, older versions are not removed, making B

correct.

Reference:

HashiCorp Vault Documentation - Transit Secrets Engine: Working Set Management

Comprehensive and Detailed in Depth

A: Incorrect. Transit doesn’t store ciphertext; it returns it to the client.

B: Correct. The Transit engine performs encryption/decryption without persisting data.

Overall Explanation from Vault Docs:

“The Vault Transit secrets engine does NOT store any data… Ciphertext is returned to the caller.”

Reference: https://developer.hashicorp.com/vault/docs/secrets/transit

Not all storage backends support high availability mode for Vault. Only the storage backends that

support locking can enable Vault to run in a multi-server mode where one server is active and the

others are standby. Some examples of storage backends that support high availability mode are

Consul, Integrated Storage, and ZooKeeper. Some examples of storage backends that do not support

high availability mode are Filesystem, MySQL, and PostgreSQL. Reference:

https://developer.hashicorp.com/vault/docs/concepts/ha1,

https://developer.hashicorp.com/vault/docs/configuration/storage2

Comprehensive and Detailed In-Depth

The policy’s path syntax determines access:

B. False: "This policy will NOT permit access to secrets stored under secrets/cloud/apps/jenkins." The

wildcard * applies to paths after jenkins/, e.g., secrets/cloud/apps/jenkins/config, but not the exact

path secrets/cloud/apps/jenkins. "Notice that in the policy, the wildcard (*) is AFTER the path

jenkins, and not AT the jenkins path."

Incorrect Option:

A. True: Incorrect; the policy requires an additional segment to match.

To permit secrets/cloud/apps/jenkins, the policy should be path "secrets/cloud/apps/jenkins" {} or

include a broader wildcard like secrets/cloud/apps/*.

Reference: https://developer.hashicorp.com/vault/docs/concepts/policies

Comprehensive and Detailed In-Depth

False. Vault supports multiple auth methods, not just platform-specific ones. The Vault

documentation states:

"Just because you are using a certain platform does not mean you need to use the related auth

method. Vault offers a variety of auth methods that can be used based on the organization’s needs

and existing infrastructure, allowing for flexibility and customization in authentication processes."

— Vault Auth Concepts

B: Correct. Options like AppRole, LDAP, or JWT can be used on GCP:

"GCP auth MIGHT be the best option, but it’s not the ONLY option that you can use."

— Vault Auth Concepts

A: Incorrect; Vault isn’t limited to GCP auth on GCP.

Reference:

Vault Auth Concepts

The statement is true. When an auth method is disabled, all users authenticated via that method

lose access. This is because the tokens issued by the auth method are automatically revoked when

the auth method is disabled. This prevents the users from performing any operation in Vault using

the revoked tokens. To regain access, the users have to authenticate again using a different auth

method that is enabled and has the appropriate policies attached. Reference: Auth Methods | Vault |

HashiCorp Developer, auth disable - Command | Vault | HashiCorp Developer

Comprehensive and Detailed In-Depth

AppRole’s flexibility allows human use:

A. True: "Although AppRole is primarily designed for machine-to-machine authentication, it can also

be used by humans to authenticate to Vault if needed." It uses a role_id and secret_id, which, while

less convenient for humans, are technically usable. "Yeah, absolutely. Although it’s not super friendly

for us humans to remember the values, you could use it if you wanted to."

Incorrect Option:

B. False: Incorrect; it’s not restricted to machines only.

This adaptability broadens AppRole’s applicability.

Reference: https://developer.hashicorp.com/vault/docs/auth/approle

Comprehensive and Detailed In-Depth

Dynamic secrets are managed actively:

A. True: "Once the lease for a dynamic secret has expired, Vault automatically revokes the credentials

on the backend platform for which they were created." This cleanup reduces technical debt.

Incorrect Option:

B. False: Incorrect; revocation is automatic.

"When a lease expires, Vault does indeed revoke the credentials on the platform."

Reference: https://developer.hashicorp.com/vault/docs/concepts/lease