4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 13)

Questions 61–65

1. 61application · medium

   A team wants to use Vault dynamic secrets to generate short-lived database credentials for a Terraform-managed application. What is a key benefit of using dynamic secrets in this scenario?

   • AThe credentials can be used indefinitely without rotation.
   • BThe credentials do not appear in the state file at all.
   • CThe credentials are stored in the state file in encrypted form.
   • DThe credentials are automatically rotated and have a limited lifetime, reducing the risk of exposure.
   Reveal Solution Discussion Select an answer first
2. 62foundation · easy

   A team stores database credentials in a Terraform configuration file that is committed to a shared Git repository. Which practice best addresses the risk of exposing these secrets to collaborators?

   • AStore the credentials in a .tfvars file and add it to .gitignore
   • BSet the credentials as environment variables on each collaborator's machine
   • CEncrypt the credentials with a local KMS key and reference the ciphertext in the configuration
   • DUse a Vault provider to fetch the credentials at plan/apply time
   Reveal Solution Discussion Select an answer first
4. 63foundation · easy

   A Terraform configuration references a Vault secret to retrieve a database password. To follow best practices for managing sensitive data, where should the Vault token used by Terraform be provided?

   • AIn an environment variable such as VAULT_TOKEN
   • BIn the Terraform configuration file as a variable default
   • CIn the Terraform state file as an output value
   • DIn a terraform.tfvars file that is committed to the repository
   Reveal Solution Discussion Select an answer first
5. 64application · medium

   A team uses Vault to store a database password that is rotated every 30 days. The Terraform configuration references the password from Vault. When the password is rotated, what must the team do to update the resources that use the password?

   • ADelete the state file and re-apply the configuration.
   • BManually update the password in the Terraform configuration file.
   • CRe-run terraform plan and terraform apply to detect the new value and update resources.
   • DRestart the Vault server to force Terraform to re-read the secret.
   Reveal Solution Discussion Select an answer first
6. 65application · medium

   A team is troubleshooting a Terraform configuration that uses Vault secrets. They enable verbose logging with TF_LOG=TRACE to debug an issue. What should they be aware of regarding the Vault secrets?

   • AVerbose logs only contain the Vault token, not the secret values.
   • BVerbose logs may contain the Vault secret values, so logs should be handled securely.
   • CVerbose logs are stored in memory and are not written to disk.
   • DVerbose logs never contain secret values because Terraform automatically redacts them.
   Reveal Solution Discussion Select an answer first