HashiCorp Vault Associate (003) Question 31
Single answer1f Configure authentication methods using the API, CLI, and UIA security engineer needs to enable the GitHub authentication method at a non-default path named github-prod in an existing Vault cluster. They first run vault auth enable github from the CLI and then realize the path is wrong. They must reconfigure it so users authenticate at auth/github-prod/login, and they want to understand which action correctly achieves this using Vault-supported interfaces and behavior. Which option is the best answer?
- A
Disable the auth method at the default path and re-enable it at the desired path, for example
vault auth disable githubfollowed byvault auth enable -path=github-prod github. - B
Use
vault auth tune -path=github -description=github-prodto rename the mount path without interrupting the auth method. - C
Send a POST request to
/v1/sys/auth/github-prodwith the body{ "type": "github" }because the API only supports creating auth methods at custom paths, not the CLI or UI. - D
In the UI, edit the existing GitHub auth method and change only the Accessor value to github-prod so the login endpoint becomes
auth/github-prod/login.
Show answer and explanation
Correct answer: A
Explanation
In Vault, authentication methods are mounted under auth/ at a specific path, and that path determines the login endpoint, such as auth/github-prod/login. To configure an auth method at a custom path, you can use the CLI (vault auth enable -path=github-prod github), the API (enable by writing to /sys/auth/github-prod with type=github), or the UI (enable auth method and specify the path). If the method was enabled at the wrong path initially, the practical correction is to disable and re-enable it at the correct path. Tuning commands adjust mount settings but do not rename the mount path. This aligns with Vault documentation on enabling auth methods and managing auth mounts through /sys/auth.
- A. Correct.
Correct. Authentication methods are enabled at mount paths. If the auth method was enabled at the wrong path, the standard fix is to disable it and re-enable it at the intended path, such as
vault auth enable -path=github-prod github. The same concept applies through the API by writing to/sys/auth/<path>with the desired type, and through the UI by enabling the auth method at the chosen path. The login endpoint is derived from the auth mount path, so mounting atgithub-prodresults inauth/github-prod/login. - B. Incorrect.
Incorrect.
vault auth tunechanges mount tuning parameters such as description, default/max lease TTL, audit settings, and similar operational settings. It does not rename an auth mount path. A common misconception is that changing the description changes the path users log in against, but the description is only metadata shown to operators. - C. Incorrect.
Incorrect. The API does support enabling auth methods at custom paths by writing to
/v1/sys/auth/<path>, but it is not true that only the API can do this. The CLI supportsvault auth enable -path=<path> <type>, and the UI also allows specifying a path when enabling an auth method. This option mixes a partly correct API detail with an incorrect limitation. - D. Incorrect.
Incorrect. The Accessor is an internal identifier for the auth mount and is not used to define the public login path. Operators cannot change the login endpoint by editing the accessor. The mount path determines the endpoint, and changing the accessor would not be the correct or supported way to move an auth method.