VAULT-ASSOCIATE-002 Question #96: Real Exam Question with Answer & Explanation

Question

You manage two Vault dusters: "vaultduster1.acme.corp" and "vaultduster2.acme.corp". You want to write a secret to the first Vaultcluster vaultcluster1.acme.corp and run vault kv put secret/foo value='bar'. The command times out and the error references the Vault cluster, "vaultcluster2.acme.corp". You run the command again with the following address flag: vault kv put -address='https://vaultcluster1.acme.corp' secret/foo value='bar' The command completes successfully. You find that the terminal session defines the environment variable VAULT_ADDR='https://vaultcluster2.acxe.corp:8200' Why was the second attempt successful?

Options

• AEnvironment variables take precedence over flags
• BVAULT_CLUSTER_ADDR needs to be provided
• CFlags take precedence over environment variables
• DVault listener is misconfigured

Explanation

The second attempt succeeded because command-line flags, specifically the -address flag, take precedence over environment variables like VAULT_ADDR when specifying the target Vault server.

Common mistakes.

• A. This statement is incorrect; command-line flags override environment variables, not the other way around, in the Vault CLI's order of precedence.
• B. VAULT_CLUSTER_ADDR is not a standard environment variable used by the Vault CLI for specifying the target Vault address; the correct variable is VAULT_ADDR.
• D. The Vault listener was likely correctly configured for vaultcluster1.acme.corp, but the initial command targeted the wrong cluster due to the VAULT_ADDR environment variable being overridden by the flag in the second attempt.

Concept tested. Vault CLI environment variables and flags precedence

Reference. https://developer.hashicorp.com/vault/docs/commands#environment-variables

No community discussion yet for this question.