VAULT-ASSOCIATE-002 · Question #3
Which of the following statements describe the CLI command below? $ vault login -method=ldap username=mitchellh
The correct answer is B. You will be prompted to enter the password. When performing an LDAP login via the Vault CLI using only the username, the command will prompt the user to securely enter their password to complete the authentication process.
Question
Options
- AGenerates a token which is response wrapped
- BYou will be prompted to enter the password
- CBy default, the generated token is valid for 24 hours
- DFails because the password is not provided
How the community answered
(34 responses)- A3% (1)
- B94% (32)
- D3% (1)
Why each option
When performing an LDAP login via the Vault CLI using only the username, the command will prompt the user to securely enter their password to complete the authentication process.
This command does not inherently generate a response-wrapped token; response wrapping needs to be explicitly requested via flags like `-wrap-ttl`.
When `vault login -method=ldap username=mitchellh` is executed without providing a password explicitly (e.g., via `-password` flag or standard input), the Vault CLI defaults to an interactive prompt for the user's password. This is a security measure to prevent passwords from being exposed in shell history or plaintext.
The default validity (TTL) of a generated token depends on the authentication method's mount configuration, the role configuration, and system-wide defaults, not a fixed 24-hour period.
The command does not fail immediately because the password is not provided inline; instead, the CLI is designed to prompt for the password interactively to maintain security.
Concept tested: Vault CLI login process and password handling
Source: https://www.vaultproject.io/docs/commands/login
Topics
Community Discussion
No community discussion yet for this question.