Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 18
You are using the Vault API to test authentication before modifying your CI/CD pipeline to properly authenticate to Vault. You manually authenticate to Vault and receive the response below. Based on the provided options, which of the following are true? (select four)
- $ curl \
- --request POST \
- --data @payload.json \
- https://vault.krausen.com:8200/v1/auth/userpass/login/bryan.krausen | jq
- *******************************************************************************
- ******* RESPONSE BELOW ********************************************************
- *******************************************************************************
- {
- "request_id": "f758e8da-11b6-8341-d404-56f0c370a7fa",
- "lease_id": "",
- "renewable": false,
- "lease_duration": 0,
- "data": null,
- "wrap_info": null,
- "warnings": null,
- "auth": {
- "client_token": "hvs.CbzCNJCVWt63jyzyaJakgDwz",
- "accessor": "rffwXzKFcxvaQi6Vgo8tY4Lt",
- "policies": [
- "training",
- "default"
- ],
- "token_policies": [
- "training",
- "default"
- ],
- "metadata": {
- "username": "bryan.krausen"
- },
- "lease_duration": 84600,
- "renewable": true,
- "entity_id": "f1795f6a-c576-d619-b2d5-74c0aee08edb",
- "token_type": "service",
- "orphan": true
- }
- }
-
A
the user is using the
userpassauth method -
B
the user's password is stored in a file named
payload.json -
C
the token required to retrieve a secret is
hvs.CbzCNJCVWt63jyzyaJakgDwz -
D
the returned token is a batch token
-
E
the user needs to retrieve
.auth.client_tokenin order to perform other actions -
F
the accessor will be used to authenticate to Vault to retrieve secrets
Reveal correct answers
Correct answers: A, B, C, E
Explanation
When executing an authentication request to Vault, you will need to provide the credentials that will be used for authentication. Once successfully authenticated, Vault will return a bunch of information. The primary value that you need to retrieve from this response is the client_token, which can be queried from a JSON parsing tool (such as jq) by grabbing the value of .auth.client_token.
In this example, the user is authenticating with the userpass auth method. You can tell by looking at the API endpoint being called, which is v1/auth/userpass/login/bryan.krausen.
You can also see from the API request that the request is pulling data from a file named payload.json. This file would contain the password for our user. Oftentimes, this payload.json file (you can call it whatever you want, by the way) would contain different information based on what you are trying to do. If you are using AppRole to authenticating, for example, the payload.json file would contain the role-id and the secret-id in JSON format. Keep in mind the payload doesn't always contain sensitive information, it could just refer to a namespace or other data depending on what API endpoint you are using.
More information about the basics of using the API to interact with Vault can be found here.
A.
The API endpoing indicates that the user is using the userpass authentication method to authenticate to Vault. This method allows users to authenticate using a username and password.
B.
The user's password is stored in a file named payload.json, as indicated in the curl command used to authenticate to Vault. Storing sensitive information like passwords in files should be done securely to prevent unauthorized access.
C.
The token required to retrieve a secret from Vault is hvs.CbzCNJCVWt63jyzyaJakgDwz, as indicated in the response. This token is necessary for authenticating and authorizing access to specific secrets within Vault.
D.
The returned token (hvs.CbzCNJCVWt63jyzyaJakgDwz) is not a batch token, as there is no indication in the response that it is intended for batch operations. Instead, it is a service token used for interacting with Vault's API on behalf of the authenticated user.
E.
In order to perform other actions in Vault, the user needs to retrieve the .auth.client_token provided in the response. This token is essential for subsequent interactions with Vault to access and manage secrets.
F.
The accessor value provided in the response (rffwXzKFcxvaQi6Vgo8tY4Lt) is not typically used for direct authentication to Vault to retrieve secrets. Accessors are more commonly used for specific operations within Vault, such as token revocation or renewal.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
