HashiCorp Vault Associate (003) Question 196
Single answer7c Configure environment variablesAn operations engineer is automating a script that runs Vault CLI commands from a CI runner. The runner cannot use interactive login, and the engineer wants the script to avoid repeating the Vault server address on every command. The engineer has already obtained a short-lived token for the job. Which environment variable configuration best allows the script to authenticate and target the correct Vault server for commands such as vault kv get secret/app?
- A
Set
VAULT_ADDRto the Vault server URL andVAULT_TOKENto the job's token before running the CLI commands. - B
Set
VAULT_NAMESPACEto the Vault server URL andVAULT_TOKENto the job's token before running the CLI commands. - C
Set
VAULT_ADDRto the job's token andVAULT_AUTHTOKENto the Vault server URL before running the CLI commands. - D
Set
VAULT_CACERTto the Vault server URL andVAULT_TOKEN_FILEto the job's token string before running the CLI commands.
Show answer and explanation
Correct answer: A
Explanation
For Vault CLI automation, the most common environment variables are VAULT_ADDR and VAULT_TOKEN. VAULT_ADDR defines the HTTP or HTTPS address of the Vault server, and VAULT_TOKEN provides the authentication token for CLI requests. This is a best-practice approach for scripts and CI jobs that already have a short-lived token and need to avoid interactive authentication. Other environment variables exist for specialized use cases, such as VAULT_NAMESPACE for Enterprise namespaces, VAULT_CACERT for TLS trust configuration, and VAULT_TOKEN_FILE when reading a token from a file path. HashiCorp Vault documentation for the CLI environment variables and authentication behavior consistently describes VAULT_ADDR and VAULT_TOKEN as the primary variables for this scenario.
- A. Correct.
Correct.
VAULT_ADDRtells the Vault CLI which Vault server to contact, andVAULT_TOKENsupplies the token for authentication. This is the standard, practical setup for non-interactive automation when a token has already been issued. With these environment variables set, commands likevault kv get secret/appcan run without repeatedly passing the server address or logging in interactively. - B. Incorrect.
Incorrect.
VAULT_NAMESPACEis used for Vault Enterprise namespaces, not for specifying the Vault server address. A candidate might choose this if they confuse logical scoping within Vault with the network endpoint used by the CLI. - C. Incorrect.
Incorrect. This reverses the purpose of the variables and uses a nonstandard variable name.
VAULT_ADDRmust contain the Vault server URL, not a token, andVAULT_AUTHTOKENis not the standard CLI environment variable for supplying a token. The correct variable isVAULT_TOKEN. - D. Incorrect.
Incorrect.
VAULT_CACERTis used to point to a CA certificate file for TLS validation, not to specify the Vault server URL. Also,VAULT_TOKEN_FILEis for a file path containing the token, not the raw token string itself. Someone might choose this if they know token files and TLS variables exist but do not remember their exact purpose.