HashiCorp Vault Associate (003) Question 33
Single answer1f Configure authentication methods using the API, CLI, and UIA platform engineer needs to enable GitHub authentication in Vault at a custom path named "gh" so developers can log in without changing the default auth mounts already used by other teams. The engineer first runs vault auth enable -path=gh github. Next, they need to configure the organization name for that auth method so users in the acme-apps GitHub organization can authenticate. Which command correctly completes this task?
- A
vault write auth/gh/config organization=acme-apps
- B
vault write github/config organization=acme-apps
- C
vault auth tune -organization=acme-apps gh/
- D
vault write auth/github/gh/config organization=acme-apps
Show answer and explanation
Correct answer: A
Explanation
When configuring Vault authentication methods, the key concept is that requests are sent to the mount path, not the auth type name, unless the method is mounted at its default path. In this scenario, vault auth enable -path=gh github mounts the GitHub auth method at auth/gh/. Therefore, its configuration endpoint becomes auth/gh/config, which is why vault write auth/gh/config organization=acme-apps is the correct command. The same logic applies through the HTTP API, where you would POST to /v1/auth/gh/config. In the UI, the administrator would also select the gh auth mount and configure its settings there. This reflects a core Vault best practice: distinguish between an auth method's type and its mount path, especially in environments with multiple auth mounts of the same type.
- A. Correct.
Correct. After enabling the GitHub auth method at the custom mount path
gh, its configuration endpoint is underauth/<mount-path>/config. The CLI commandvault write auth/gh/config organization=acme-appswrites the required configuration to that auth mount. This matches how auth methods are addressed through the API and CLI when mounted at non-default paths. - B. Incorrect.
Incorrect. This assumes the auth method is mounted at the default path
github, but in the scenario it was explicitly enabled at the custom pathgh. Writing togithub/configwould target the wrong path and fail or affect a different mount if one exists. - C. Incorrect.
Incorrect.
vault auth tuneis used to tune mount settings such as lease TTLs, audit settings, listing visibility, and token type behavior for an auth method mount. It is not used to set method-specific configuration like the GitHub organization name. - D. Incorrect.
Incorrect. This path is not valid for a GitHub auth mount enabled at
gh. Auth configuration endpoints follow the patternauth/<mount-path>/..., notauth/<type>/<mount-path>/.... This is a common mistake when confusing the auth method type with the mount path.