A team uses an S3 backend for Terraform state. They retrieve secrets from Vault and use them in their configuration. What additional security measure should they implement on the S3 bucket?

Disable S3 bucket encryption to improve performance.

Store the state file in a different region from the resources.

Enable S3 bucket versioning and MFA delete.

Make the S3 bucket public for easy access.

What is a key consideration when using remote state backends with Vault secrets?

The backend must be publicly accessible

The backend must encrypt state at rest

The backend must use a database

The backend must be on-premises

What is a risk of enabling verbose logging (TF_LOG=TRACE) in Terraform when using Vault secrets?

It may expose secret values in the logs

How can you prevent Vault secrets from appearing in Terraform logs?

Use `terraform apply -no-color`

Avoid printing secret values in configuration and use sensitive marking

Set the environment variable `TF_LOG` to `TRACE`

Store secrets in a separate file

How can CI/CD pipelines integrate Vault secrets for Terraform runs?

By using Vault agent to inject secrets into the pipeline environment

By storing secrets in the pipeline's source code

By hardcoding secrets in the pipeline configuration

HashiCorp Certified:Terraform Associate

Domain 4Objective 8

4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 6)

Part of the Terraform configuration domain, which makes up ~22% of our current practice bank. HashiCorp does not publish an official question count, but from its 60-minute exam (~25–40 total, ~6–9 in this domain), expect 1–1 from this objective — we provide 76 practice questions to prepare you well beyond it. (estimate)

76questions here

16free pages

36concepts

36 Concepts in This Objective

Sensitive data in Terraform
Terraform state and sensitive data
Marking outputs as sensitive
Sensitive variables
Avoiding secrets in plain text
Using environment variables for secrets
Terraform Vault provider
Vault secrets as data sources
Vault secrets as variables
Vault secrets in state
Vault secrets in outputs
Vault secrets in provisioners
Vault secrets in modules
Vault secrets in CI/CD
Vault secrets rotation
Vault secrets with dynamic credentials
Vault secrets with sensitive data in plan
Vault secrets with sensitive data in logs
Vault secrets with sensitive data in state file
Vault secrets with sensitive data in remote state
Vault secrets with sensitive data in version control
Vault secrets with sensitive data in documentation
Vault secrets with sensitive data in collaboration
Vault secrets with sensitive data in troubleshooting
Vault secrets with sensitive data in testing
Vault secrets with sensitive data in compliance
Vault secrets with sensitive data in audit
Vault secrets with sensitive data in access control
Vault secrets with sensitive data in encryption
Vault secrets with sensitive data in backup
Vault secrets with sensitive data in disaster recovery
Vault secrets with sensitive data in monitoring
Vault secrets with sensitive data in alerting
Vault secrets with sensitive data in incident response
Vault secrets with sensitive data in security policies
Vault secrets with sensitive data in governance

Questions 26–30

26application · medium
A team uses an S3 backend for Terraform state. They retrieve secrets from Vault and use them in their configuration. What additional security measure should they implement on the S3 bucket?
Select an answer first
27foundation · medium
What is a key consideration when using remote state backends with Vault secrets?
Select an answer first
28foundation · medium
What is a risk of enabling verbose logging (TF_LOG=TRACE) in Terraform when using Vault secrets?
Select an answer first
29foundation · medium
How can you prevent Vault secrets from appearing in Terraform logs?
Select an answer first
30foundation · medium
How can CI/CD pipelines integrate Vault secrets for Terraform runs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-ASSOCIATE-004

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-ASSOCIATE-004” is a trademark of its owner, used for identification only.