4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 15)

Questions 71–75

1. 71application · medium

   A developer accidentally committed a Vault token to a Git repository. What should the team do immediately?

   • ADelete the file from the repository and commit the deletion.
   • BIgnore the issue because the token will expire soon.
   • CChange the token's permissions to read-only.
   • DRevoke the token in Vault and rotate it.
   Reveal Solution Discussion Select an answer first
2. 72foundation · medium

   When using the Vault provider in Terraform, how does Terraform typically retrieve a secret from Vault?

   • ABy storing the Vault token in the Terraform configuration file for authentication.
   • BBy using a data source that queries Vault during the plan and apply phases.
   • CBy reading the secret from a local file that was manually exported from Vault.
   • DBy using the terraform import command to bring the secret into the state file.
   Reveal Solution Discussion Select an answer first
4. 73foundation · medium

   A team backs up its Terraform state files to an object storage bucket. What is the primary security concern with these backups?

   • AThe state files cannot be restored if the backup is corrupted.
   • BThe state files are encrypted only if the bucket has encryption enabled.
   • CThe state files are too large to be backed up efficiently.
   • DThe state files may contain plaintext secret values.
   Reveal Solution Discussion Select an answer first
5. 74foundation · medium

   When using HashiCorp Vault with Terraform, how can you prevent database passwords from being written to the Terraform state file?

   • AUse Vault as the source of truth for the password and avoid storing it in Terraform configuration; use a data source to retrieve it at apply time.
   • BUse Vault to generate the password, and then use Terraform's provisioner to pass it directly to the resource without storing it in state.
   • CUse Vault's dynamic database credentials and configure the database provider to use those credentials only during the apply operation.
   • DUse the vault provider to read the password and assign it to a variable marked sensitive.
   Reveal Solution Discussion Select an answer first
6. 75foundation · medium

   What is the purpose of the `vault_generic_secret` data source in Terraform?

   • ATo list all secrets in Vault
   • BTo read a secret from Vault and use its values in configuration
   • CTo create a new secret in Vault
   • DTo delete a secret from Vault
   Reveal Solution Discussion Select an answer first