4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 11)

Questions 51–55

1. 51foundation · medium

   What is the primary purpose of using HashiCorp Vault as a secrets backend in a Terraform workflow?

   • ATo generate random passwords for resources and store them in the Terraform state file.
   • BTo store secrets in a centralized, audited, and access-controlled system that Terraform can retrieve dynamically.
   • CTo replace the need for remote state backends by storing all infrastructure configuration in Vault.
   • DTo encrypt the Terraform state file automatically after every apply.
   Reveal Solution Discussion Select an answer first
2. 52foundation · medium

   Why should Vault secrets not be committed to version control?

   • ABecause version control systems are not encrypted
   • BBecause secrets are too large for version control
   • CBecause version control systems cannot store secrets
   • DBecause they can be exposed to anyone with access to the repository
   Reveal Solution Discussion Select an answer first
4. 53foundation · medium

   What is a benefit of using Vault dynamic secrets in Terraform?

   • AThey are available to all users
   • BThey are stored in the state file in plain text
   • CThey provide short-lived credentials that reduce exposure
   • DThey are automatically rotated without any action
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   When using Vault with Terraform, what is the purpose of a Vault token in the context of access control?

   • AIt provides a static IP address for the Vault server
   • BIt encrypts the secrets stored in Vault
   • CIt authenticates the Terraform client and carries policies that determine which secrets it can access
   • DIt stores the secret values in memory for faster retrieval
   Reveal Solution Discussion Select an answer first
6. 55foundation · medium

   What is a best practice for using Vault secrets in CI/CD pipelines?

   • AUse long-lived tokens for convenience
   • BUse the root token for all operations
   • CUse short-lived tokens for authentication
   • DStore tokens in the pipeline's source code
   Reveal Solution Discussion Select an answer first