HashiCorp Vault Associate (003) Question 32
Single answer1f Configure authentication methods using the API, CLI, and UIA security engineer is preparing a new Vault cluster for developers who will authenticate with GitHub. The engineer must enable the GitHub auth method at a custom path named "dev-github" and confirm it was configured correctly. Which command achieves this from the Vault CLI?
- A
vault auth enable -path=dev-github github
- B
vault enable auth/github path=dev-github
- C
vault write sys/auth/dev-github type=github
- D
vault auth tune -path=dev-github github
Show answer and explanation
Correct answer: A
Explanation
To configure authentication methods in Vault, you can use the UI, API, or CLI. From the CLI, the standard command to enable an auth method is "vault auth enable". If you want a non-default mount path, use the "-path" flag, for example: "vault auth enable -path=dev-github github". After enabling it, you can verify the mount with commands such as "vault auth list". Through the API, the equivalent operation is a POST request to "/v1/sys/auth/
- A. Correct.
Correct. The Vault CLI command to enable an auth method is "vault auth enable". Using "-path=dev-github github" enables the GitHub auth method and mounts it at the custom path "dev-github/" instead of the default "github/". This is the standard CLI approach for configuring auth methods.
- B. Incorrect.
Incorrect. This is not valid Vault CLI syntax. Vault uses the pattern "vault auth enable" rather than "vault enable auth/...". Someone might choose this because it resembles a generic command structure, but it is not how Vault enables auth methods.
- C. Incorrect.
Incorrect. While Vault's API does support enabling auth methods under the sys/auth endpoint, this option is not the correct CLI command requested in the scenario. Also, using "vault write" here is an API-style operation exposed through the CLI, but the expected and documented CLI workflow for enabling auth methods is "vault auth enable". On the exam, you should recognize the purpose-built CLI command.
- D. Incorrect.
Incorrect. "vault auth tune" is used to modify mount tuning parameters for an already enabled auth method, such as token TTL settings or audit behavior. It does not enable a new auth method. This distractor targets the common confusion between enabling a mount and tuning an existing one.