A team enables userpass auth and creates a user 'alice' with the password 'password123'. Alice can log in, but she cannot read any secrets. The administrator wants Alice to have read access to 'secret/data/team'. What should the administrator do?

Run `vault write secret/data/team value=...` to grant access.

Write a policy granting read access and assign it to Alice: `vault policy write team-read -` and `vault write auth/userpass/users/alice policies=team-read`.

Enable the userpass method with `-default-policy=team-read`.

Set `vault write auth/userpass/users/alice token_policies=default`.

An administrator wants to enable the token auth method at a custom path 'custom-token' so that applications can authenticate with pre-existing tokens. What is the correct command?

`vault auth enable -path=custom-token token`

`vault auth enable token -path=custom-token`

`vault write sys/auth/custom-token type=token`

`vault mount -path=custom-token token`

What happens to tokens issued by an authentication method when that method is disabled?

They are converted to orphan tokens

They are preserved but cannot be renewed

They continue to work until their TTL expires

An administrator disables the userpass auth method at the default path with `vault auth disable userpass/`. What is the immediate impact on existing tokens that were issued via userpass?

Existing tokens remain valid until their TTL expires, but new logins are rejected.

Existing tokens are invalidated only if they are root tokens.

Existing tokens are converted to orphan tokens and remain valid indefinitely.

All existing tokens are immediately revoked and cannot be used.

HashiCorp Certified:Vault Operations Professional

Domain 1Objective 5

Enable and Configure Authentication Methods VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Part of the Create a working Vault server configuration given a scenario domain, which makes up ~31% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 4–6 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

16concepts

16 Concepts in This Objective

Authentication method overview
Enable authentication methods
Configure authentication method parameters
Tune authentication method settings
Disable authentication methods
List and inspect authentication methods
Authentication method path management
Token-based authentication configuration
Userpass authentication configuration
AppRole authentication configuration
LDAP authentication configuration
Kubernetes authentication configuration
JWT/OIDC authentication configuration
TLS certificate authentication configuration
Authentication method policy association
Authentication method troubleshooting

Questions 1–5

1application · medium
A team enables userpass auth and creates a user 'alice' with the password 'password123'. Alice can log in, but she cannot read any secrets. The administrator wants Alice to have read access to 'secret/data/team'. What should the administrator do?
Select an answer first
2application · easy
An administrator wants to enable the token auth method at a custom path 'custom-token' so that applications can authenticate with pre-existing tokens. What is the correct command?
Select an answer first
3foundation · easy
What happens to tokens issued by an authentication method when that method is disabled?
Select an answer first
4foundation · easy
What does Vault issue to a caller after a successful authentication method login?
Select an answer first
5application · medium
An administrator disables the userpass auth method at the default path with `vault auth disable userpass/`. What is the immediate impact on existing tokens that were issued via userpass?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to VAULT-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “VAULT-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.