4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 14)

Questions 66–70

1. 66foundation · medium

   How can you protect Vault secrets stored in the Terraform state file?

   • AStore the state file in a public bucket
   • BDelete the state file after each run
   • CUse a remote backend with encryption at rest
   • DUse a local state file with no access controls
   Reveal Solution Discussion Select an answer first
2. 67foundation · medium

   What is a recommended access control for the Terraform state file?

   • AMake the state file publicly readable
   • BStore the state file in a shared drive
   • CAllow all users in the organization to read and write
   • DRestrict access to only those who need it
   Reveal Solution Discussion Select an answer first
4. 68foundation · medium

   When storing Terraform state files in a version control system or backup, which practice is most appropriate for sensitive values such as database passwords?

   • AAvoid storing sensitive values in state by using Vault for secrets and treating state as containing only non-sensitive resource metadata.
   • BStore the state file in a remote backend that supports encryption at rest, such as an encrypted S3 bucket.
   • CStore the state file as-is, but restrict access to the repository.
   • DUse Vault to generate and manage the sensitive values, and store only references in the state.
   Reveal Solution Discussion Select an answer first
5. 69foundation · medium

   How does Terraform handle secret rotation when using Vault data sources?

   • AIt automatically re-reads the secret on every plan and apply
   • BIt caches the secret value until the state is refreshed
   • CIt requires manual intervention to update secrets
   • DIt stores the secret in state and never updates it
   Reveal Solution Discussion Select an answer first
6. 70foundation · easy

   What is the primary benefit of using Vault for managing sensitive data in Terraform configurations during a disaster recovery scenario?

   • AIt stores secrets in plaintext within the Vault database for faster access during recovery.
   • BIt encrypts secrets in transit and at rest, and provides a centralized audit trail.
   • CIt automatically replicates Terraform configuration files to a secondary region.
   • DIt eliminates the need for any backup strategy for Terraform state files.
   Reveal Solution Discussion Select an answer first