Skip to content
Cheat sheets

003 · Domain 7: Vault architecture fundamentals · 8% of the exam

Task 7.3: Configure environment variables

VAULT_ADDR, VAULT_TOKEN, VAULT_NAMESPACE, VAULT_CACERT, VAULT_SKIP_VERIFY, VAULT_FORMAT and others, their defaults, and how flags override them.

Study it

  • CLI environment variables

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A user sets VAULT_ADDR=https://vault.internal:8200, and vault status fails with x509: certificate signed by unknown authority. The server's certificate comes from the company's private CA, saved as ca.pem. TLS verification must stay on. What should the user set?

  1. AVAULT_SKIP_VERIFY to 1
  2. BVAULT_CLIENT_CERT to the path of ca.pem
  3. CVAULT_CACERT to the path of ca.pem
  4. DVAULT_TLS_SERVER_NAME to vault.internal
Show the answer and why

  • AVAULT_SKIP_VERIFY to 1

    Incorrect

    That turns verification off, which the requirement forbids and which HashiCorp says not to use in production.

  • BVAULT_CLIENT_CERT to the path of ca.pem

    Incorrect

    VAULT_CLIENT_CERT supplies a client certificate for mutual TLS; it does not add a trusted CA.

  • CVAULT_CACERT to the path of ca.pem

    Correct

    VAULT_CACERT names a PEM CA certificate the CLI uses to verify the server's certificate.

  • DVAULT_TLS_SERVER_NAME to vault.internal

    Incorrect

    This sets the SNI name for the handshake; it does not make the private CA trusted.

Trust a private CA with VAULT_CACERT; keep VAULT_SKIP_VERIFY for throwaway labs only.

HashiCorp documentation

Task 7.3Report a problem with this question

Question 2 · choose 1

A user runs vault status without setting VAULT_ADDR or -address. Which address does the CLI contact?

  1. Ahttp://127.0.0.1:8200
  2. Bhttps://vault.service.consul:8200
  3. Chttps://127.0.0.1:8200
  4. DThe address of the last server it reached
Show the answer and why

  • Ahttp://127.0.0.1:8200

    Incorrect

    The default scheme is https.

  • Bhttps://vault.service.consul:8200

    Incorrect

    Service discovery is not the default.

  • Chttps://127.0.0.1:8200

    Correct

    The default address is https://127.0.0.1:8200.

  • DThe address of the last server it reached

    Incorrect

    The CLI keeps no record of earlier servers; it falls back to its default.

Set VAULT_ADDR in the shell profile when working with a remote server.

HashiCorp documentation

Task 7.3Report a problem with this question

Question 3 · choose 1

VAULT_ADDR points at production. A user runs vault status -address=https://vault-staging:8200. Which server answers?

  1. AProduction, since environment variables take precedence
  2. BBoth, since the CLI queries each address
  3. CNeither; conflicting settings make the CLI exit
  4. DStaging, because the flag overrides the variable
Show the answer and why

  • AProduction, since environment variables take precedence

    Incorrect

    The flag wins for that command.

  • BBoth, since the CLI queries each address

    Incorrect

    The CLI talks to one address.

  • CNeither; conflicting settings make the CLI exit

    Incorrect

    There is no conflict error; the flag is used.

  • DStaging, because the flag overrides the variable

    Correct

    Environment variables configure the CLI globally, and a flag overrides them for one command.

Most variables have a matching flag, such as -address for VAULT_ADDR.

HashiCorp documentation

Task 7.3Report a problem with this question

Question 4 · choose 1

An engineer works in the admin namespace of an HCP Vault Dedicated cluster and is tired of adding -namespace=admin to every command. Which variable helps?

  1. AVAULT_NAMESPACE=admin
  2. BVAULT_ADDR=https://<cluster>/admin
  3. CVAULT_TOKEN=admin
  4. DVAULT_FORMAT=admin
Show the answer and why

  • AVAULT_NAMESPACE=admin

    Correct

    VAULT_NAMESPACE sets the namespace for CLI commands, allowing paths relative to it.

  • BVAULT_ADDR=https://<cluster>/admin

    Incorrect

    The namespace is not part of the address path.

  • CVAULT_TOKEN=admin

    Incorrect

    That would set a token value, not a namespace.

  • DVAULT_FORMAT=admin

    Incorrect

    That variable does not set a namespace.

HCP Vault Dedicated clusters use admin as their top-level namespace.

HashiCorp documentation

Task 7.3Report a problem with this question

Question 5 · choose 1

A script wants every Vault command's output in JSON without adding -format=json each time. Which variable does that?

  1. AVAULT_CLI_FORMAT=json
  2. BVAULT_FORMAT=json
  3. CVAULT_CLI_NO_COLOR=json
  4. DVAULT_OUTPUT=json
Show the answer and why

  • AVAULT_CLI_FORMAT=json

    Incorrect

    There is no such variable.

  • BVAULT_FORMAT=json

    Correct

    VAULT_FORMAT sets the CLI output format.

  • CVAULT_CLI_NO_COLOR=json

    Incorrect

    That toggles color codes.

  • DVAULT_OUTPUT=json

    Incorrect

    The CLI reads no variable by that name.

table is the default; json and yaml suit scripts.

HashiCorp documentation

Task 7.3Report a problem with this question

Practice domain 7 →Practice all domains →