4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · medium

   What is a recommended mitigation for the exposure of Vault-sourced secrets in state files?

   • AStore secrets in a separate state file
   • BDelete the state file after each apply
   • CUse a remote backend with encryption at rest
   • DUse `terraform state rm` to remove secrets
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A security team wants to monitor access to Vault secrets used by Terraform. They need to detect unauthorized access attempts. What should they enable?

   • AUse Terraform's built-in logging to monitor Vault access.
   • BRely on the Vault token's TTL to prevent unauthorized access.
   • CDisable Vault audit logging to reduce overhead.
   • DEnable Vault audit logging and configure alerts on suspicious access patterns.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A Terraform configuration provisions infrastructure and then sends an alert message that includes a database password. The password is stored in HashiCorp Vault. Which approach best aligns with Terraform best practices for managing sensitive data in alerting?

   • AUse a Vault data source to retrieve the password, but only include a reference or link to the secret in the alert message.
   • BStore the password in a local file and read it during the alert configuration to avoid using Vault.
   • CRetrieve the password from Vault using a data source and include it directly in the alert message.
   • DReference the password in the alert message using a variable that is defined in a terraform.tfvars file.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of using HashiCorp Vault in a Terraform workflow?

   • ATo automatically format Terraform code according to style guidelines.
   • BTo provide a centralized system for storing and accessing secrets securely.
   • CTo compile Terraform configurations into executable binaries.
   • DTo replace Terraform's state backend for storing infrastructure metadata.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a disaster recovery scenario, which approach best ensures that sensitive data referenced in Terraform configuration remains available and recoverable?

   • AUse environment variables to pass secrets to Terraform and document them in the runbook for recovery.
   • BStore all secrets in Terraform state and back up the state file to a secure remote backend.
   • CHardcode secrets in Terraform variables files and store them in a version control repository for easy recovery.
   • DUse Vault as the secrets backend and replicate the Vault cluster to a secondary site for high availability and disaster recovery.
   Reveal Solution Discussion Select an answer first