Security of using sha(secret + rand) I have come across some security implementations in which party A will compute MD = sha256(secret + rand) and transmit MD and rand to a counterpart B. If the second party knows the secret, then when it computes sha256(secret + rand), it will match that from sender A and validate it. 

This may be a loaded question, but is this secure at all? Meaning, would it be very hard for an attacker to discover the secret given the resultant hash and the random number?

Part 2: Another potentially loaded question
Would it be more/less secure to instead use an hmac using the secret as the 'data'? So HMAC(rand, secret) ?

The goal of both security systems is to ensure that both A and B possess the same key K without transmitting it, but is either more secure? Are these implementations 'traditional' or more of a 'cluge'?
Using HMAC is more principled and flexible here, because HMAC with a random secret key is a pseudorandom function, while sha256(secret + nonsecret) isn't.  

In your case where the non-secret is a random value there might not be a security difference. But I mentioned also flexibility, because this sort of authentication scheme—when implemented with a proper pseudorandom function like HMAC—doesn't need a random value.  A counter or wall clock time will do.  In fact, if you've seen those two-factor authentication tokens or apps that display a six-digit code that changes every minute, those are based on the TOTP algorithm, which is basically hmac(secret, current_time / refresh_interval).