HashiCorp Vault Associate (003) Question 34
Single answer1f Configure authentication methods using the API, CLI, and UIA security engineer is onboarding a new team to HashiCorp Vault and wants team members to authenticate with GitHub usernames and personal access tokens. The engineer must enable the auth method at a custom path named "github-dev" and confirm it works before sharing the login instructions. Which action correctly configures this authentication method using Vault tooling?
- A
Run
vault auth enable -path=github-dev github, then configure the organization mapping underauth/github-dev/configorauth/github-dev/map/teams/..., and test login withvault login -method=github -path=github-dev token=<GitHub_PAT>. - B
Run
vault secrets enable -path=github-dev github, then configure the GitHub organization undersecret/github-dev/config, and test access withvault token create -method=github token=<GitHub_PAT>. - C
Use the UI to create a new secrets engine named "github-dev", add the GitHub token under the engine configuration, and ask users to sign in with their Vault token plus GitHub username.
- D
Call
POST /v1/auth/github-dev/loginbefore enabling any auth method, because Vault automatically creates the auth mount on first login attempt when the path does not exist.
Show answer and explanation
Correct answer: A
Explanation
This question tests the distinction between Vault auth methods and secrets engines, plus how custom auth mount paths work across the CLI, API, and UI. To configure GitHub authentication correctly, an administrator enables the auth method at the desired path, for example with vault auth enable -path=github-dev github or via the API at /v1/sys/auth/github-dev. Configuration is then written under that auth mount, such as /v1/auth/github-dev/config and related mapping endpoints. Users authenticate against the mounted path, which in the CLI is expressed with vault login -method=github -path=github-dev .... A common exam trap is confusing vault auth enable with vault secrets enable, or assuming auth methods are created automatically on first use. HashiCorp Vault documentation on auth method enablement, mount paths, and GitHub auth configuration supports this workflow.
- A. Correct.
Correct. GitHub is an auth method, so it must be enabled with
vault auth enable, not as a secrets engine. Using-path=github-dev githubmounts the GitHub auth method at the custom pathauth/github-dev/. After enabling it, administrators configure it through the auth path, such asauth/github-dev/configand team/user mappings. Users can then authenticate with the CLI usingvault login -method=github -path=github-dev token=<GitHub_PAT>. This matches how Vault auth methods are enabled and used via CLI and API. - B. Incorrect.
Incorrect. This confuses an auth method with a secrets engine.
vault secrets enableis used for secret engines like KV or PKI, not for login methods. GitHub authentication must be mounted underauth/, notsecret/. Also,vault token createdoes not authenticate a user through GitHub; it creates a Vault token when you are already authenticated and authorized to do so. - C. Incorrect.
Incorrect. In the UI, GitHub would be configured as an authentication method, not a secrets engine. Users also do not log in with both a Vault token and a GitHub username in this flow. For GitHub auth, users present a GitHub personal access token to Vault, and Vault exchanges that for a Vault token if the configuration and mappings allow access.
- D. Incorrect.
Incorrect. Vault does not auto-create auth mounts on login. An administrator must explicitly enable the auth method first, whether through the CLI, API, or UI. A login request to an unmounted path returns an error such as no handler for route or unsupported path, depending on context.