Task 1.3: Explain the difference between human vs. system authentication methods

• AThe userpass auth method with a dedicated account for the job and user lockout turned on

  Incorrect

  The audit entries would name the job, but a userpass login needs a password, which would still be stored on the instance.

• BThe approle auth method with a role for the job and bind_secret_id left at its default

  Incorrect

  By default a SecretID is required at login, and the job would have to keep it on the instance.

• CThe aws auth method with the iam type, bound to the IAM role attached to the EC2 machine

  Correct

  The iam type signs a request with the instance's own AWS credentials, so nothing is stored for Vault, and the login maps to the job's role rather than a person.

• DThe oidc auth method with an application registered for the job at the provider

  Incorrect

  OIDC roles complete the login in a user's browser, which an unattended job cannot do.

Human methods such as userpass, LDAP and OIDC identify people. Machine methods such as AWS, Kubernetes and AppRole identify workloads, and the platform-based ones use an identity the platform already provides instead of a stored secret.

• AIt calls the auth method's login endpoint through the HTTP API, often via a client library

  Correct

  API authentication is generally used for machines; each auth method has its own login endpoint.

• BIt runs vault login and reuses the token the CLI keeps for later commands

  Incorrect

  That convenience is meant for interactive CLI users; a service talks to the API itself.

• CIt reuses a developer's CLI token copied into its configuration

  Incorrect

  A copied human token ties the service to a person and their policies.

• DIt opens the Vault UI sign-in page in a headless browser

  Incorrect

  The UI is for people; services use the API.

People log in interactively through the CLI or UI; services call the login API of a machine-oriented method and handle the returned token in code.

• Auserpass, with passwords read from the team's existing password file

  Incorrect

  userpass cannot read usernames and passwords from an external source.

• Bapprole, with one role and SecretID for each engineer

  Incorrect

  AppRole is oriented to machines and is less useful for human operators.

• Cldap, pointed at the engineers' local system accounts

  Incorrect

  ldap needs an LDAP server, which the lab does not have.

• Duserpass, with each user's password stored by Vault on the method

  Correct

  userpass stores username and password pairs on the method itself, which suits a few people without a directory.

userpass is a human method whose credentials Vault itself holds; larger organizations usually delegate to a directory or identity provider instead.

• AThe userpass auth method combined with the TOTP secrets engine

  Incorrect

  A secrets engine does not add a login factor to userpass, and it sends no push.

• BThe okta auth method, with MFA set up for the users on the Okta side

  Correct

  The okta method supports Okta Verify Push and TOTP during login when MFA is configured in Okta.

• CThe approle auth method, with secret_id_num_uses set to 1

  Incorrect

  A single-use SecretID is a machine credential, not a push approval by a person.

• DThe cert auth method, with certificates issued by Okta

  Incorrect

  The cert method checks TLS client certificates and sends no push.

Human logins often need a second factor; the okta method integrates Okta's own MFA into the Vault login.

• AThe RoleID; the SecretID is a public value printed in logs

  Incorrect

  The SecretID is the secret part of the AppRole login.

• BNeither, because AppRole logins rely only on source CIDR checks

  Incorrect

  CIDR bindings are optional constraints; by default a SecretID is required.

• CThe SecretID; the RoleID selects the role against which it is checked

  Correct

  The SecretID is the credential and is meant to always be secret; the RoleID identifies the AppRole.

• DThe secret_id_accessor, which logs in when the SecretID is lost

  Incorrect

  An accessor references a SecretID for lookup or destruction; it cannot log in.

AppRole splits a machine credential into an identifier and a secret, so the two can travel separately to the machine.