HashiCorp Vault Associate (003) Question 25
Single answer1e Authenticate to Vault using the API, CLI, and UIA security engineer has enabled the userpass auth method in Vault and created a user named "ana". She can log in successfully in the Vault UI with her username and password. Now she needs to authenticate from a terminal on her workstation so that subsequent Vault CLI commands use her identity. Which command correctly logs her in with the CLI using the userpass auth method?
- A
vault login -method=userpass username=ana
- B
vault auth enable userpass username=ana password=
- C
vault token create -method=userpass username=ana password=
- D
vault write auth/userpass/login/ana password=
Show answer and explanation
Correct answer: A
Explanation
The key distinction is between authenticating to Vault and administering Vault. For CLI-based authentication, the standard and recommended workflow is vault login -method=userpass username=<user>, which exchanges the user's credentials for a Vault token and stores that token for later CLI use. By contrast, the UI presents a login form for the same auth method, and the API exposes the corresponding endpoint POST /v1/auth/userpass/login/:username. In practice, a user can authenticate through the API, CLI, or UI against the same auth mount, but the CLI command designed specifically for login is the best answer here because it handles token acquisition and local token storage automatically. This aligns with Vault authentication documentation and common usage patterns for auth methods, login endpoints, and CLI token helper behavior.
- A. Correct.
Correct. The Vault CLI supports authenticating with auth methods by using
vault login -method=<auth_method>and supplying the required parameters. For userpass,username=anais required, and the CLI will prompt securely for the password if it is not provided on the command line. On success, Vault returns a client token and the CLI stores it for subsequent commands. - B. Incorrect.
Incorrect.
vault auth enable userpassis an administrative command used to enable the auth method at a path in Vault. It does not authenticate a user. A common misconception is to confuse enabling an auth method for the server with logging in through that auth method as a client. - C. Incorrect.
Incorrect.
vault token createcreates a new token if the caller is already authenticated and authorized to do so. It is not used to authenticate with username/password credentials. This distractor reflects confusion between obtaining a token by logging in and minting a token through token management APIs. - D. Incorrect.
Incorrect. This uses the HTTP API path pattern through the
vault writecommand, and it can work to authenticate with userpass because the login endpoint isauth/userpass/login/<username>with the password in the request body. However, the question asks for the command that correctly logs her in with the CLI so subsequent CLI commands use her identity.vault login -method=userpassis the purpose-built CLI workflow for that behavior, including token handling in the local token helper. This option is plausible, but it is not the best answer in this context.