2f TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a limitation of using environment variables to manage sensitive data in Terraform?

   • AThey cannot be used with Terraform providers
   • BThey are only available on Linux systems
   • CThey are visible in process listings and shell history
   • DThey are automatically encrypted by Terraform
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A team is deciding how to manage a database password used in their Terraform configuration. They currently use environment variables. They are considering moving to HashiCorp Vault. What is the primary advantage of using Vault over environment variables?

   • AVault automatically encrypts the Terraform state file, while environment variables do not.
   • BVault eliminates the need for a remote backend, while environment variables require one.
   • CVault is easier to set up than environment variables.
   • DVault provides dynamic secrets that can be rotated and revoked, while environment variables are static.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which practice is recommended for handling sensitive data in Terraform configuration files?

   • AReference secrets from a secrets management system instead of hardcoding them
   • BEncrypt the entire Terraform configuration directory with a local tool
   • CStore secrets in plaintext in .tfvars files and restrict file permissions
   • DUse default values in variables to avoid specifying secrets explicitly
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team requires that no secrets appear in the Terraform state file. They currently use a remote backend with encryption at rest. They are evaluating two approaches: (1) using a Vault provider data source to read secrets, and (2) using environment variables with the sensitive flag. Which approach fully satisfies the requirement?

   • ABoth approaches, because both prevent secrets from being written to the state file.
   • BApproach 1 only, because Vault data sources prevent secrets from being written to the state file.
   • CNeither approach, because encryption at rest is sufficient to protect secrets in the state file.
   • DApproach 2 only, because the sensitive flag prevents secrets from being written to the state file.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a key principle for managing sensitive data in Terraform?

   • ASecrets should be stored in the state file for easy reference during operations
   • BSecrets should be passed as command-line arguments to Terraform commands
   • CSecrets should be kept out of configuration files and state files
   • DSecrets should be embedded in module source code for reuse
   Reveal Solution Discussion Select an answer first