Why should secrets not be hardcoded in Terraform configuration files?

It risks exposing secrets in version control and logs

It increases the cost of running Terraform

It makes the configuration slower to parse

It prevents Terraform from applying changes

What does Terraform display for a sensitive variable in plan output?

An encrypted version of the value

The actual value of the variable

How can you ensure Vault secrets are not displayed in Terraform plan output?

Use a provisioner to fetch the secret

Mark the variables that hold the secrets as sensitive

Use a local value to store the secret

Remove the data source from the configuration

A CI/CD pipeline runs terraform apply to deploy infrastructure. The pipeline needs to authenticate to Vault to retrieve secrets. What is the recommended way to authenticate Terraform to Vault in the pipeline?

Use a Vault token stored as a secret in the CI/CD system and set it as the VAULT_TOKEN environment variable.

Use the Vault root token for simplicity.

Store the Vault token in a terraform.tfvars file in the repository.

Hardcode the Vault token in the Terraform configuration.

How should you document Terraform configurations that use Vault secrets?

Store documentation in a public repository

Use placeholders and describe how to obtain the secrets

Include the actual secret values for clarity

Avoid documenting any part of the configuration

HashiCorp Certified:Terraform Associate

Domain 4Objective 8

4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 10)

Part of the Terraform configuration domain, which makes up ~22% of our current practice bank. HashiCorp does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 76 practice questions to prepare you well beyond it. (estimate)

76questions here

16free pages

36concepts

36 Concepts in This Objective

Sensitive data in Terraform
Terraform state and sensitive data
Marking outputs as sensitive
Sensitive variables
Avoiding secrets in plain text
Using environment variables for secrets
Terraform Vault provider
Vault secrets as data sources
Vault secrets as variables
Vault secrets in state
Vault secrets in outputs
Vault secrets in provisioners
Vault secrets in modules
Vault secrets in CI/CD
Vault secrets rotation
Vault secrets with dynamic credentials
Vault secrets with sensitive data in plan
Vault secrets with sensitive data in logs
Vault secrets with sensitive data in state file
Vault secrets with sensitive data in remote state
Vault secrets with sensitive data in version control
Vault secrets with sensitive data in documentation
Vault secrets with sensitive data in collaboration
Vault secrets with sensitive data in troubleshooting
Vault secrets with sensitive data in testing
Vault secrets with sensitive data in compliance
Vault secrets with sensitive data in audit
Vault secrets with sensitive data in access control
Vault secrets with sensitive data in encryption
Vault secrets with sensitive data in backup
Vault secrets with sensitive data in disaster recovery
Vault secrets with sensitive data in monitoring
Vault secrets with sensitive data in alerting
Vault secrets with sensitive data in incident response
Vault secrets with sensitive data in security policies
Vault secrets with sensitive data in governance

Questions 46–50

46foundation · medium
Why should secrets not be hardcoded in Terraform configuration files?
Select an answer first
47foundation · medium
What does Terraform display for a sensitive variable in plan output?
Select an answer first
48foundation · medium
How can you ensure Vault secrets are not displayed in Terraform plan output?
Select an answer first
49application · medium
A CI/CD pipeline runs terraform apply to deploy infrastructure. The pipeline needs to authenticate to Vault to retrieve secrets. What is the recommended way to authenticate Terraform to Vault in the pipeline?
Select an answer first
50foundation · medium
How should you document Terraform configurations that use Vault secrets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-ASSOCIATE-004

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-ASSOCIATE-004” is a trademark of its owner, used for identification only.