HashiCorp Vault Associate (003) Question 27
Select 21e Authenticate to Vault using the API, CLI, and UIA security engineer enabled the userpass auth method on a Vault dev server and created a user named "ana". She now needs to verify that authentication works from different interfaces before onboarding her team. Which TWO of the following actions will successfully authenticate and return a Vault token for user "ana" using supported Vault interfaces?
- A
Run
vault login -method=userpass username=ana password=<password>in the CLI. - B
Send a POST request to
/v1/auth/userpass/login/anawith a JSON body containing{ "password": "<password>" }. - C
Open the Vault UI and enter the username and password in the token login form.
- D
Send a GET request to
/v1/auth/login/userpass/ana?password=<password>because login endpoints accept query-string credentials. - E
Run
vault auth enable userpasseach time before logging in, because the auth method must be re-enabled per session.
Show answer and explanation
Correct answers: A, B
Explanation
This scenario tests practical authentication knowledge across Vault interfaces. For the CLI, vault login -method=userpass username=<user> password=<password> is the standard approach. For the API, userpass authentication is performed with POST /auth/userpass/login/:username and the password in the JSON body. In the UI, users can authenticate through the selected auth method's login screen, but the token form is only for entering an existing token, not credentials for methods like userpass. HashiCorp Vault documentation for auth methods and CLI login behavior emphasizes that enabling an auth method is a server-side configuration action, while authentication uses the method's specific login endpoint or UI flow.
- A. Correct.
Correct. In the Vault CLI,
vault login -method=userpassis the supported way to authenticate with the userpass auth method. Supplyingusernameandpasswordas parameters causes the CLI to call the appropriate auth endpoint and, on success, receive and store the returned client token for the session. - B. Correct.
Correct. The userpass login API endpoint is
POST /v1/auth/userpass/login/:username, and the password is provided in the request body. On successful authentication, Vault returns an auth block containing a client token and related metadata. This is the correct API-based login flow for userpass. - C. Incorrect.
Incorrect. The token login form in the UI is for pasting an already issued Vault token, not for submitting username/password credentials. To authenticate with username/password in the UI, the user must select the userpass auth method (or the enabled method's login screen), not the token form. This distractor targets confusion between token-based login and auth-method-based login.
- D. Incorrect.
Incorrect. Vault's userpass login endpoint does not use this path structure or HTTP method. The correct pattern is a POST to
/v1/auth/userpass/login/:usernamewith the password in the request body. Passing credentials in the query string is also not the documented login pattern and is a common mistake when trying to test endpoints quickly. - E. Incorrect.
Incorrect.
vault auth enable userpassenables the auth method on the Vault server; it is an administrative configuration step, not part of each user's login workflow. Once enabled, users authenticate against that method until it is disabled. This distractor reflects the misconception that auth methods are client-side or session-scoped.