A security audit reveals that a Terraform state file stored in an S3 backend contains plaintext database passwords. The team wants to prevent this from happening in the future while keeping the ability to see the full configuration in code reviews. Which approach should they adopt?

Use the sensitive parameter in variable definitions and mark the password variables as sensitive.

Use a Vault provider data source to read the passwords and reference the data source in the resource configuration.

Move the state file to a local backend and restrict access to the file system.

Enable server-side encryption on the S3 bucket and use a KMS key for the state file.

What is the primary benefit of integrating HashiCorp Vault with Terraform?

It automatically encrypts all Terraform state files

It allows Terraform to dynamically retrieve secrets at plan and apply time

It eliminates the need for authentication in Terraform providers

It replaces the need for remote state storage

Which strategy helps prevent sensitive data from being stored in plaintext in Terraform state?

Use remote state storage with encryption at rest

Delete state files after each apply

Use .gitignore to prevent state files from being committed

Store state files locally with default permissions

Compared to environment variables, what advantage does an external secret store like Vault offer for Terraform?

It eliminates the need for provider authentication

Centralized management, audit logging, and dynamic secrets

Secrets are automatically encrypted in state files

Simpler configuration with no additional setup

A company uses Terraform to provision AWS resources. They need to pass an API token to a Lambda function configuration. The token is stored in HashiCorp Vault. The team wants to avoid hardcoding the token in the Terraform configuration and avoid it appearing in the state file. What is the recommended way to achieve this?

Use the Vault provider's vault_auth_backend resource to authenticate to Vault and then reference the token in the Lambda resource.

Set the token as an environment variable TF_VAR_api_token and reference it as var.api_token in the Lambda resource.

Store the token in a terraform.tfvars file and reference it as a variable in the Lambda resource.

Use the vault_generic_secret data source to read the token and reference it in the Lambda resource's environment variables.

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 2Objective 6

2f TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Develop and troubleshoot dynamic configuration domain, which makes up ~20% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 3–5 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

Questions 6–10

6application · medium
A security audit reveals that a Terraform state file stored in an S3 backend contains plaintext database passwords. The team wants to prevent this from happening in the future while keeping the ability to see the full configuration in code reviews. Which approach should they adopt?
Select an answer first
7foundation · easy
What is the primary benefit of integrating HashiCorp Vault with Terraform?
Select an answer first
8foundation · easy
Which strategy helps prevent sensitive data from being stored in plaintext in Terraform state?
Select an answer first
9foundation · easy
Compared to environment variables, what advantage does an external secret store like Vault offer for Terraform?
Select an answer first
10application · medium
A company uses Terraform to provision AWS resources. They need to pass an API token to a Lambda function configuration. The token is stored in HashiCorp Vault. The team wants to avoid hardcoding the token in the Terraform configuration and avoid it appearing in the state file. What is the recommended way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.