2f TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a recommended approach to avoid storing secrets in Terraform state?

   • AUse Vault-backed storage for secrets and reference them dynamically
   • BUse .tfvars files with secrets and restrict access
   • CUse output variables to print secrets after apply
   • DUse environment variables to pass secrets to Terraform
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A Terraform state file is stored in an S3 backend with server-side encryption enabled. A security audit finds that a database password is stored in plaintext in the state file. The team wants to prevent this from happening in the future. They are considering two options: (1) using a Vault provider data source, and (2) using a terraform.tfvars file with the sensitive flag. Which option fully addresses the audit finding?

   • AOption 1, because Vault data sources prevent the password from being written to the state file.
   • BBoth options, because both prevent the password from being written to the state file.
   • COption 2, because the sensitive flag prevents the password from being written to the state file.
   • DNeither option, because server-side encryption is sufficient to protect the password in the state file.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a common way to use the Vault provider to consume a secret without exposing it in configuration?

   • AStore the secret in a local variable
   • BReference the secret value directly in a resource attribute
   • COutput the secret to the console for verification
   • DUse the vault_generic_secret data source and reference its data
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Terraform configuration for a web application includes a database connection string. The team wants to ensure the connection string is not exposed in the configuration files or in the state file. They already use a remote backend with encryption at rest. Which additional measure should they implement?

   • AUse a Vault provider data source to read the connection string and reference it in the resource configuration.
   • BUse environment variables and reference them with var.connection_string.
   • CStore the connection string in a terraform.tfvars file and use the -var-file flag.
   • DMark the variable as sensitive in the variable definition.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How does Terraform typically authenticate to Vault when retrieving secrets?

   • AUsing the Terraform state file to store Vault credentials
   • BUsing the same credentials as the Terraform cloud account
   • CUsing a token or authentication method configured in the Vault provider
   • DUsing the cloud provider's identity service automatically
   Reveal Solution Discussion Select an answer first