4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · medium

   What is a common challenge when rotating secrets that are used in Terraform resources?

   • AResources may need to be recreated to apply the new secret
   • BState files cannot be updated with new secrets
   • CTerraform cannot read new secret values
   • DVault does not support secret rotation
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When using HashiCorp Vault to manage secrets that may appear in alerting, which practice is recommended to minimize the risk of secret exposure?

   • AUse Vault's dynamic secrets so that credentials are short-lived and rotated frequently.
   • BAvoid using Vault and instead embed secrets in the Terraform configuration for simplicity.
   • CStore static secrets in Vault and reference them directly in alert messages for convenience.
   • DUse Vault only for infrastructure credentials, not for application secrets used in alerts.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Terraform, which statement correctly describes a best practice for handling sensitive data when using HashiCorp Vault?

   • AStore secrets in Vault and reference them in Terraform using the vault provider's data sources.
   • BUse Vault only for storing Terraform state, not for secrets.
   • CHardcode secrets in Terraform variables and mark them as sensitive to prevent them from appearing in logs.
   • DAvoid using Vault because it requires storing secrets in Terraform state.
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   Why should Vault secrets be passed as variables rather than hardcoded in modules?

   • ATo avoid using data sources
   • BTo make the module run faster
   • CTo reduce the number of resources
   • DTo keep secrets out of the module's source code
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   What is the recommended way to pass Vault secrets through module interfaces?

   • AHardcode them in the module's resources
   • BStore them in a local file within the module
   • CUse output values from the module
   • DPass them as variables to the module
   Reveal Solution Discussion Select an answer first