4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A company must comply with a regulation that requires encryption of sensitive data at rest and in transit. They use Terraform with Vault to manage secrets. What should they verify to ensure compliance?

   • AVault is accessible over HTTP for simplicity.
   • BVault is configured with TLS for transit and encryption for storage, and the Terraform state backend is encrypted.
   • CVault tokens are stored in the Terraform configuration for easy access.
   • DTerraform state is stored in plain text for easier debugging.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A Terraform configuration uses a Vault data source to fetch a secret and then includes that secret in an alert webhook payload. What is a best practice to follow?

   • AMark the output as sensitive and ensure the alert payload does not contain the raw secret value.
   • BUse the secret value directly in the alert payload and rely on the webhook's encryption.
   • CAvoid using Vault data sources and hardcode the secret in the alert payload for reliability.
   • DStore the secret in a plain text output variable and reference it in the alert payload.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A Terraform configuration defines a variable that holds a database password. The password is provided at runtime, but the team has noticed that the value appears in the output of terraform plan and in the apply logs. Which declaration change would prevent the value from being displayed in plan/apply output and logs?

   • AUse the `description` argument to note the variable contains a secret.
   • BAdd the `sensitive = true` argument to the variable declaration.
   • CAssign the variable a default value of `null`.
   • DSet the variable's `type` to `string`.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   How can you use a Vault secret in a provisioner without exposing it in logs?

   • APrint the secret to stdout for debugging
   • BPass the secret as an environment variable to the provisioner
   • CUse the secret in a shell script that is committed to version control
   • DHardcode the secret in the provisioner command
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In a HashiCorp Vault policy, what is the primary purpose of the `path` block and its associated capabilities?

   • ATo define which secrets a token can read, write, or delete at specific paths
   • BTo set the expiration time for secrets stored at that path
   • CTo define the physical storage backend for secrets at that path
   • DTo specify the encryption algorithm used for secrets stored at that path
   Reveal Solution Discussion Select an answer first