HashiCorp Vault Associate (003) Question 26
Select 21e Authenticate to Vault using the API, CLI, and UIA platform engineer needs to verify that a new Vault deployment is reachable and that users can authenticate through different interfaces. The security team has enabled the userpass auth method and created a user named "ana". When testing, the engineer wants to authenticate without exposing the password in shell history, confirm API-based login behavior, and understand what the UI does after login. Which TWO statements are correct?
- A
Using the CLI, the engineer can run
vault login -method=userpass username=anaand Vault will securely prompt for the password instead of requiring it on the command line. - B
Using the API, the engineer can authenticate by sending a POST request to
/v1/auth/userpass/login/anawith the password in the request body, and Vault returns an auth token on success. - C
Using the UI, after a successful userpass login, Vault stores the user's password so it can transparently re-authenticate when the token expires.
- D
Using the CLI, the engineer must first run
vault auth enable userpasson their workstation beforevault login -method=userpass username=anawill work. - E
Using the API, the engineer should send a GET request to
/v1/login/userpass/ana?password=<password>because Vault login endpoints accept credentials as query parameters by default.
Show answer and explanation
Correct answers: A, B
Explanation
This question tests practical authentication behavior across Vault's three common interfaces: CLI, API, and UI. For the CLI, vault login -method=userpass username=<name> is the standard pattern, and prompting for the password is safer than including it directly in the command. For the API, the correct userpass login endpoint is POST /v1/auth/userpass/login/:username with the password in the body; a successful response includes an auth object with a client token. In the UI, users authenticate through an enabled auth method and then operate with the issued token; the UI does not retain the original password for silent re-login. These behaviors align with Vault documentation for auth methods, the CLI vault login command, and the HTTP API authentication endpoints.
- A. Correct.
Correct. The Vault CLI supports method-based login flows such as
vault login -method=userpass username=ana. For userpass, if the password is not supplied as an argument, the CLI prompts interactively. This is a common and safer practice because it avoids placing the password directly in shell history or process arguments. - B. Correct.
Correct. The userpass login API endpoint is
POST /v1/auth/userpass/login/:username. The password is provided in the JSON request body, and on success Vault returns an authentication response containing a client token and related auth metadata. This reflects the standard Vault API pattern for authenticating with auth methods. - C. Incorrect.
Incorrect. The UI does not keep the user's password for automatic re-authentication after token expiration. Vault authentication results in a token; the UI uses the token for subsequent requests. If the token expires and cannot be renewed, the user must authenticate again. Assuming the UI stores primary credentials is a security misconception.
- D. Incorrect.
Incorrect. Enabling an auth method is an administrative action performed against the Vault server, not on a local workstation. If
userpassis already enabled on the Vault server, a user can authenticate withvault login -method=userpass ...as long as they can reach Vault and have valid credentials. Runningvault auth enable userpasslocally is neither required nor meaningful as a client-side prerequisite. - E. Incorrect.
Incorrect. Vault login endpoints for auth methods use HTTP POST, and credentials are typically sent in the request body, not as URL query parameters. Using GET with credentials in the URL is both inaccurate for Vault's API and a poor security practice because URLs may be logged or cached.