4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A Terraform configuration needs to read a database password from Vault and use it in a resource argument. What is the recommended way to handle the password in the configuration?

   • AUse the Vault provider's data source to retrieve the secret and reference it in the resource argument
   • BStore the password in a terraform.tfvars file and reference it with var.db_password
   • CHardcode the password in the main.tf file as a literal string
   • DUse a local-exec provisioner to run a shell command that exports the password as an environment variable
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Terraform configuration deploys monitoring agents that need credentials to access a metrics API. To avoid storing those credentials in plain text in the configuration or state, which HashiCorp tool is designed to securely store and provide the credentials at runtime?

   • APacker
   • BHashiCorp Vault
   • CConsul
   • DTerraform Cloud
   Reveal Solution Discussion Select an answer first
4. 8foundation · medium

   What is a common use case for retrieving Vault secrets and assigning them to Terraform variables?

   • ATo use the secrets in resource configurations without hardcoding them
   • BTo make secrets available to all users
   • CTo store secrets in the state file
   • DTo encrypt the secrets in transit
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   A team wants to store database credentials used by Terraform so that they are not visible in plaintext in configuration files or state. Which HashiCorp product is designed to securely store and control access to such secrets?

   • ATerraform Cloud
   • BHashiCorp Vault
   • CHashiCorp Consul
   • DHashiCorp Nomad
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A monitoring application needs a database password. The password is stored in HashiCorp Vault. What is the recommended way for the application to retrieve this password without exposing it in logs or configuration files?

   • ACopy the password from Vault and paste it into the application's startup script.
   • BStore the password in a Terraform variable and reference it in the application configuration.
   • CHard-code the password in the application's source code.
   • DUse the Vault API to request the secret at runtime and inject it into the application's environment.
   Reveal Solution Discussion Select an answer first