HashiCorp Vault Associate (003) Question 29
Single answer1e Authenticate to Vault using the API, CLI, and UIA security engineer is validating that a newly enabled userpass auth method works consistently for operators who use the Vault CLI, the HTTP API, and the UI. The auth method is enabled at the path "userpass/", and a user named "alice" already exists. Which action will successfully authenticate with Vault using the HTTP API in this scenario?
- A
Send a POST request to /v1/auth/userpass/login/alice with a JSON body containing alice's password
- B
Send a GET request to /v1/auth/userpass/alice and include the password in the X-Vault-Token header
- C
Send a POST request to /v1/login/userpass/alice with a JSON body containing alice's password and Vault returns a wrapped token by default
- D
Send a PUT request to /v1/auth/token/login with alice's username and password in the JSON body
Show answer and explanation
Correct answer: A
Explanation
This question tests practical understanding of how Vault authentication differs across methods while focusing on API-based login. For userpass, the login pattern is specific: POST to /v1/auth/
- A. Correct.
Correct. For the userpass auth method, the HTTP API login endpoint is /v1/auth/:mount-path/login/:username. Because the auth method is mounted at userpass/, the correct endpoint is /v1/auth/userpass/login/alice. The request is typically a POST with a JSON payload containing the password, for example {"password":"..."}. On success, Vault returns an auth object with a client token and related metadata.
- B. Incorrect.
Incorrect. userpass login does not use a GET request to an endpoint like /v1/auth/userpass/alice. Also, the X-Vault-Token header is used after authentication to present an existing token, not to submit a password for userpass login. This option mixes token-based authenticated requests with username/password login.
- C. Incorrect.
Incorrect. The path is wrong. Vault does not use /v1/login/userpass/alice for userpass authentication; it uses /v1/auth/
/login/ . In addition, Vault does not return a response-wrapped token by default for normal login requests. Response wrapping must be explicitly requested, typically by setting the X-Vault-Wrap-TTL header. - D. Incorrect.
Incorrect. /v1/auth/token/login is not the endpoint for userpass username/password authentication. The token auth method is for working with tokens, not validating a username/password pair from the userpass auth backend. A common mistake is assuming all authentication methods share a generic login endpoint.