4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   A DevOps engineer is configuring Terraform to read a database password from HashiCorp Vault. The Vault server requires TLS client authentication, and the engineer wants to ensure that only the Terraform service account can read the secret. The engineer has already created a Vault token for Terraform. Which configuration approach should the engineer use?

   • AConfigure the Vault provider with the token and set the address to the Vault server URL, then use the vault_generic_secret data source to read the password.
   • BUse the vault_auth_backend data source to authenticate Terraform with the Vault server before reading the secret.
   • CSet the Vault token as a Terraform variable and reference it in the resource block where the password is needed.
   • DStore the Vault token in the Terraform configuration file and use the vault_mount data source to read the secret.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   In a Terraform configuration, which Vault secret engine is used to generate short-lived credentials for a database, reducing the risk of long-lived static passwords?

   • AThe identity secrets engine
   • BThe database secrets engine
   • CThe KV (Key-Value) secrets engine
   • DThe transit secrets engine
   Reveal Solution Discussion Select an answer first
4. 58expert · medium

   A Terraform configuration fails to apply because a Vault data source cannot read a secret. The team needs to troubleshoot the issue. They have enabled TF_LOG=TRACE to capture logs. What should they do to troubleshoot without exposing the secret values?

   • AUse TF_LOG=TRACE and commit the logs to the repository for reference.
   • BReview the logs locally and redact any sensitive values before sharing them.
   • CShare the logs directly with the Vault administrator for analysis.
   • DDisable TF_LOG and rely on the error message only.
   Reveal Solution Discussion Select an answer first
5. 59expert · medium

   A team wants to test a Terraform configuration that uses Vault secrets in a CI/CD pipeline. They want to avoid using production secrets in tests. What is the best approach?

   • ASkip testing configurations that use Vault secrets.
   • BUse a separate Vault namespace or path with test-specific secrets for the test environment.
   • CHardcode test secrets in the configuration for simplicity.
   • DUse the production secrets in tests to ensure accuracy.
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   A team is writing documentation for a Terraform module that uses Vault secrets. What is the best practice for documenting the configuration without exposing secrets?

   • AUse placeholder values like <secret> in examples and explain how to reference Vault secrets.
   • BUse the Vault token in the documentation to show authentication.
   • CReference the secret values from the state file in the documentation.
   • DInclude the actual Vault secret values in the documentation for clarity.
   Reveal Solution Discussion Select an answer first