Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 19
A developer team requests integration of their legacy application with Vault to encrypt and decrypt data for a backend database. They cannot modify the application for Vault authentication.
What is the best way to achieve this integration?
-
A
Have the app team call the Vault API to encrypt and decrypt the required data
-
B
Enable the Transit secrets engine and configure the secrets engine to send data directly to the legacy app
-
C
Run the Vault Agent on the application server(s) and use the Auto Auth feature to manage the tokens
-
D
Enable and configure the Kubernetes auth method to allow the application to authenticate to Vault using a JWT
Reveal correct answer
Correct answer: C
Explanation
Legacy applications often suffer from the ability to integrate with modern platforms such as Vault. To assist with this, you can use the Vault Agent to authenticate and manage a Vault token automatically. The token is written to a sink (local file) that the application can pick up and use. The application can then use this token to make the requests to Vault for encrypting/decrypting data. The Vault Agent Auto Auth feature will manage the lifecycle of the token to ensure there is always a valid token that the application can use.
Here is the basic workflow of how Vault Agent Auth Auth works:
A. Having the app team call the Vault API directly to encrypt and decrypt data may not be the best approach as it requires manual handling of authentication and token management, which can be complex and error-prone. Utilizing the Vault Agent with Auto Auth feature provides a more streamlined and automated solution.
B. Enabling the Transit secrets engine and sending data directly to the legacy app may not be the most secure or efficient method for integrating Vault with the legacy application. The Transit secrets engine is primarily used for encryption and decryption operations within Vault, and directly sending data to the legacy app may bypass necessary security measures.
C. Running the Vault Agent on the application server(s) and utilizing the Auto Auth feature is the best way to integrate Vault with the legacy application without modifying the application for Vault authentication. The Vault Agent can handle token management and provide seamless authentication to Vault for encryption and decryption operations.
D. Enabling and configuring the Kubernetes auth method to allow the application to authenticate to Vault using a JWT may not be suitable for the scenario where the application cannot be modified for Vault authentication. This method requires changes to the application to support JWT authentication, which goes against the constraint provided in the question. Using the Vault Agent with Auto Auth feature is a more suitable solution in this case.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
