HashiCorp Vault Associate (003) Question 195
Single answer7c Configure environment variablesA platform engineer is preparing a Linux jump host for operators who will use the Vault CLI throughout the day. The goal is to reduce mistakes by avoiding repeated command-line flags while also ensuring the CLI does not fail TLS verification when connecting to the production Vault cluster at https://vault.example.com:8200. The cluster uses a private CA certificate stored at /etc/pki/internal-root.pem. Which environment variable configuration best meets these requirements?
- A
Export VAULT_ADDR=https://vault.example.com:8200 and VAULT_CACERT=/etc/pki/internal-root.pem
- B
Export VAULT_ADDR=vault.example.com:8200 and VAULT_SKIP_VERIFY=true
- C
Export VAULT_TLS_SERVER_NAME=vault.example.com:8200 and VAULT_CLIENT_CERT=/etc/pki/internal-root.pem
- D
Export VAULT_ADDR=https://vault.example.com and VAULT_TOKEN=/etc/pki/internal-root.pem
Show answer and explanation
Correct answer: A
Explanation
For routine CLI use, setting VAULT_ADDR is a standard best practice because it establishes the default Vault endpoint and removes the need to pass -address repeatedly. When Vault uses a certificate signed by a private or internal CA, the secure way to prevent TLS validation errors is to provide that CA certificate via VAULT_CACERT (or use the equivalent CLI flag). Disabling verification with VAULT_SKIP_VERIFY is generally discouraged except for temporary testing because it weakens transport security. HashiCorp Vault documentation for the CLI and environment variables describes VAULT_ADDR for the server address and VAULT_CACERT for the CA certificate used to verify the server's TLS certificate.
- A. Correct.
Correct. VAULT_ADDR sets the default Vault server address for the CLI, which avoids repeatedly passing the -address flag. VAULT_CACERT points Vault to the CA certificate file used to validate the server's TLS certificate. This is the recommended approach when Vault uses a private CA, because it preserves TLS verification rather than disabling it.
- B. Incorrect.
Incorrect. VAULT_ADDR should include the scheme, such as https://, for a proper Vault address. More importantly, VAULT_SKIP_VERIFY disables TLS certificate verification, which may make testing easier but is not appropriate when the requirement is to avoid TLS verification failures securely. This option reflects a common but unsafe shortcut.
- C. Incorrect.
Incorrect. VAULT_TLS_SERVER_NAME is used to specify the expected TLS server name for SNI/hostname verification in certain cases, but it is not a substitute for the Vault address and should not include the port in this way. VAULT_CLIENT_CERT is for presenting a client certificate to Vault during mTLS authentication, not for trusting the server's CA certificate. Using the CA file here is a misunderstanding of server trust versus client authentication.
- D. Incorrect.
Incorrect. Although VAULT_ADDR can often default to port 8200 when omitted, this option misuses VAULT_TOKEN by assigning it a certificate path. VAULT_TOKEN must contain a Vault token string, not a filesystem path. This distractor targets confusion between authentication settings and TLS trust configuration.