Enable and Configure Authentication Methods VAULT-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An administrator enables LDAP auth at the default path. Users can authenticate successfully, but all LDAP users receive the same token policy. The administrator wants users in the 'vault-admins' LDAP group to get the 'admin' policy, while others get the 'default' policy. What is the correct configuration?

   • ASet `vault write auth/ldap/config policies=admin`.
   • BModify the LDAP server to add a 'vault-admins' attribute to each user.
   • CCreate a user mapping: `vault write auth/ldap/users/vault-admins policies=admin`.
   • DCreate an LDAP group mapping: `vault write auth/ldap/groups/vault-admins policies=admin`.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevOps team wants to enable the userpass auth method for a legacy application that already references the path 'login' in its configuration. The team runs `vault auth enable userpass` but the command fails. What is the most likely cause and correct fix?

   • AThe auth method is disabled by default; set `VAULT_AUTH_ENABLE=1` as an environment variable first.
   • BThe auth method requires a plugin binary; download and register the userpass plugin first.
   • CThe command must be run as root; use `sudo vault auth enable userpass`.
   • DThe path 'userpass' is already in use; run `vault auth enable -path=login userpass`.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   An organization uses TLS certificate auth. The CA certificate is uploaded to `auth/cert/certs/ca`. A role 'web' is created with `allowed_common_names=web.internal.example.com`. Clients present certificates signed by the CA with the common name 'web.internal.example.com'. Authentication fails. The administrator checks the CA and confirms it is correct. What is the most likely cause?

   • AThe role 'web' is not associated with the CA; create a role that references the CA or set `allowed_common_names` on the CA entry.
   • BThe `allowed_common_names` must be a wildcard, e.g., `*.internal.example.com`.
   • CThe auth method must be enabled with `-path=cert` instead of the default.
   • DThe client certificate is not signed by the uploaded CA.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which CLI command enables the userpass authentication method at the default path?

   • Avault login -method=userpass
   • Bvault auth tune userpass
   • Cvault auth enable userpass
   • Dvault secrets enable userpass
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   An organization uses LDAP auth. The LDAP server has a group 'vault-users' that contains all users. The administrator wants to grant the 'read-only' policy to all users in 'vault-users', but only if they are also in the 'vault-admins' group should they get 'admin'. The administrator creates `auth/ldap/groups/vault-users` with `policies=read-only` and `auth/ldap/groups/vault-admins` with `policies=admin`. A user 'bob' is in both groups. What policy will Bob receive?

   • AOnly 'admin', because it is the more specific group.
   • BOnly 'read-only', because it is the first group configured.
   • CNo policies, because group membership is ambiguous.
   • DBoth 'read-only' and 'admin' policies.
   Reveal Solution Discussion Select an answer first