4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   What is a primary risk of exposing a Terraform state file that contains sensitive data?

   • AThe state file will be automatically deleted
   • BUnauthorized users could read secret values
   • CTerraform will refuse to run
   • DThe state file becomes corrupted
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   How can you prevent Vault secrets from being displayed in Terraform outputs?

   • ARemove the output block
   • BUse a local value instead of an output
   • CEncrypt the output value
   • DMark the output as sensitive
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During an incident response, a Terraform operator needs to quickly revoke access to a set of database credentials that were stored as secrets in Vault. Which Vault feature is specifically designed for this purpose?

   • ADynamic secrets with short-lived leases
   • BVault's built-in key-value store with versioning
   • CStatic secrets with a long TTL
   • DEncryption as a service with a key
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   What does the `sensitive = true` argument do in a Terraform output block?

   • AIt removes the output from the state file
   • BIt prevents the output value from being shown in CLI output
   • CIt encrypts the output value in the state file
   • DIt makes the output value available only to administrators
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   When using Terraform to provision monitoring infrastructure, what is a best practice for handling the secrets that the monitoring agents will use?

   • AStore the secrets in a Terraform variable file and mark it as sensitive.
   • BUse environment variables in the Terraform process to pass secrets.
   • CUse HashiCorp Vault to generate or store the secrets and have Terraform retrieve them via the Vault provider.
   • DEmbed the secrets directly in the Terraform configuration using a locals block.
   Reveal Solution Discussion Select an answer first