VA-003 Utilize Vault CLI and API Practice Question
You are a Vault administrator for a large organization. Your team uses a centralized Vault cluster with multiple auth methods enabled, including userpass, LDAP, and approle. Recently, a developer reported that they are unable to authenticate using their userpass credentials, receiving the error 'permission denied'. The developer confirms the username and password are correct. Other developers using userpass can authenticate successfully. The Vault audit logs show that the authentication request for this developer is reaching Vault but failing with 'invalid password'. You have verified that the password is correct by resetting it via the Vault CLI. The developer's userpass entry exists and is not disabled. Which of the following is the most likely cause and correct course of action?
⚠ Common exam trap
HashiCorp often tests the misconception that 'invalid password' always means the password is wrong, when in fact it can also indicate an account lockout, especially when the user confirms the password is correct and other users authenticate successfully.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users/<username>/unlock'.
Vault's userpass auth method supports account locking after a configurable number of failed login attempts (default is 0, meaning no lockout, but if set to a positive integer via `max_attempts`, the account becomes locked). The audit log shows 'invalid password' despite the password being verified as correct, and other users can authenticate, which points to a lockout rather than a password or user entry issue. The admin can unlock the account using `vault write auth/userpass/users/<username>/unlock` to restore access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The developer's user entry is disabled. The admin should enable it using 'vault write auth/userpass/users/<username>/enable'.
Why it's wrong here
Incorrect; the user entry is not disabled as per the scenario.
- ✗
The developer's password has expired. The admin should update the password with a new one.
Why it's wrong here
Incorrect; userpass passwords do not have an expiration by default.
- ✗
The developer's password hash is corrupted. The admin should delete and recreate the user entry.
Why it's wrong here
Incorrect; password reset worked, so hash is not corrupted.
- ✓
The developer's account is locked due to too many failed login attempts. The admin should unlock the account using 'vault write auth/userpass/users/<username>/unlock'.
Why this is correct
Correct; account lockout is a common cause of authentication failures after repeated failed attempts.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.