HashiCorp Vault Associate (003) Question 198
Single answer7c Configure environment variablesA platform engineer is troubleshooting why a deployment script can authenticate to Vault interactively from their laptop, but fails in a CI runner with TLS and address-related errors. The script uses the Vault CLI without passing flags on each command. The CI environment must connect to a Vault server at https://vault.example.com:8200, authenticate using a token already issued to the job, and trust an internal CA certificate stored at /etc/ssl/certs/internal-ca.pem. The team wants the CLI configuration to be provided through environment variables so the script can run non-interactively. Which environment variable set should the engineer configure in the CI job?
- A
Set VAULT_ADDR=https://vault.example.com:8200, VAULT_TOKEN=
, and VAULT_CACERT=/etc/ssl/certs/internal-ca.pem - B
Set VAULT_HOST=vault.example.com, VAULT_PORT=8200, VAULT_AUTH_TOKEN=
, and VAULT_CA_PATH=/etc/ssl/certs/internal-ca.pem - C
Set VAULT_ADDR=vault.example.com:8200, VAULT_CLIENT_TOKEN=
, and VAULT_SKIP_VERIFY=true - D
Set VAULT_SERVER=https://vault.example.com:8200, VAULT_TOKEN=
, and SSL_CERT_FILE=/etc/ssl/certs/internal-ca.pem
Show answer and explanation
Correct answer: A
Explanation
For Vault CLI automation, the most common environment variables are VAULT_ADDR for the server URL and VAULT_TOKEN for token-based authentication. When Vault uses TLS signed by a private or internal CA, VAULT_CACERT is the appropriate variable to point the CLI to the CA certificate file. This lets scripts run without repeatedly supplying -address, -token, or TLS flags. Using VAULT_SKIP_VERIFY may appear to solve certificate errors, but it disables certificate validation and is not a best practice except in limited testing scenarios. HashiCorp Vault documentation for the CLI environment variables and TLS configuration covers these settings, including VAULT_ADDR, VAULT_TOKEN, VAULT_CACERT, and related variables such as VAULT_CAPATH.
- A. Correct.
Correct. These are the standard Vault CLI environment variables for this scenario. VAULT_ADDR provides the full Vault server address including scheme and port, VAULT_TOKEN supplies the token for CLI authentication, and VAULT_CACERT points Vault to the CA certificate file needed to validate the server's TLS certificate. This is the recommended approach when the CLI must run non-interactively in automation.
- B. Incorrect.
Incorrect. Vault CLI does not use VAULT_HOST, VAULT_PORT, or VAULT_AUTH_TOKEN as standard environment variables for connection and authentication. The CA-related variable is also wrong here: the common Vault variable is VAULT_CACERT for a CA certificate file, while VAULT_CAPATH is used for a directory of certificates, not VAULT_CA_PATH. This option reflects a common assumption that Vault splits host/port like some other tools.
- C. Incorrect.
Incorrect. VAULT_ADDR should include the URL scheme, such as https://, not just host:port. VAULT_CLIENT_TOKEN is not the standard environment variable the Vault CLI expects; VAULT_TOKEN is. Although VAULT_SKIP_VERIFY exists, using it disables TLS certificate verification and is not appropriate when the requirement is to trust a specific internal CA certificate. Choosing this option would trade a proper TLS setup for an insecure workaround.
- D. Incorrect.
Incorrect. VAULT_SERVER is not a standard Vault CLI environment variable. While SSL_CERT_FILE may affect some TLS libraries in general environments, the Vault CLI specifically documents VAULT_CACERT for providing a CA certificate file. This option is plausible because some command-line tools honor generic SSL variables, but it is not the correct Vault-specific configuration set.