4h Understand Best Practices for Managing Sensitive Data, Including Secrets Management with Vault TERRAFORM-ASSOCIATE-004 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · medium

   How do Vault-sourced secrets appear in the Terraform state file?

   • AThey are stored as references to Vault paths
   • BThey are stored in plain text, just like other values
   • CThey are encrypted by Vault before being stored
   • DThey are redacted in the state file
   Reveal Solution Discussion Select an answer first
2. 37foundation · medium

   In Terraform, when a secret value is stored in a state file, what is the recommended approach to protect that value at rest?

   • AUse the terraform state rm command to remove the secret from the state file after apply.
   • BUse a remote backend that supports encryption at rest and restrict access to the state file.
   • CMark the variable as sensitive and commit the state file to version control for backup.
   • DStore the secret in plain text in the configuration and rely on the backend's default access controls.
   Reveal Solution Discussion Select an answer first
4. 38foundation · medium

   Why do sensitive values in Terraform configurations require special handling?

   • AThey increase the cost of infrastructure
   • BThey can be accidentally exposed in state files and logs
   • CThey are difficult to type correctly
   • DThey are not supported by Terraform
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   When using Vault for secrets management in Terraform, what is a recommended practice for disaster recovery?

   • AAvoid using Vault in disaster recovery because it introduces too much complexity.
   • BStore Vault unseal keys and root tokens in the same location as the Vault data.
   • CUse a single Vault instance and rely on periodic manual backups of the storage backend.
   • DEnable Vault replication and store unseal keys and root tokens in a secure, separate location.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A Terraform configuration retrieves a secret from Vault and uses it in a resource. The team wants to ensure the secret value is not displayed in the plan output. What should be done?

   • ASet the Vault data source to sensitive = true.
   • BUse the -no-color flag when running terraform plan.
   • CMark the variable that receives the secret as sensitive = true.
   • DUse the -refresh=false flag when running terraform plan.
   Reveal Solution Discussion Select an answer first