A team is designing a Terraform configuration that provisions AWS resources. They need to pass an API token to a Lambda function. The token is stored in HashiCorp Vault. The team has the following constraints: (1) the token must not appear in the Terraform state file, and (2) the token must be retrievable at apply time. Which approach satisfies both constraints?

Set the token as an environment variable TF_VAR_api_token and reference it as var.api_token.

Use the vault_approle_auth_backend_login resource to authenticate and then reference the client token in the Lambda resource.

Store the token in a terraform.tfvars file and reference it as a variable in the Lambda resource.

Use a vault_generic_secret data source to read the token and reference it in the Lambda resource.

A small team manages a Terraform configuration that needs to reference a database password. They currently store the password in a local environment variable and reference it as var.db_password. The team wants to improve security but does not want to introduce a new infrastructure component. Which approach best addresses their concern?

Keep using the environment variable but mark the variable as sensitive in the configuration.

Use a Vault provider data source to read the password from a Vault server.

Use an external secret store such as AWS Secrets Manager and reference it with a data source.

Store the password in a terraform.tfvars file and use the -var-file flag.

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 2Objective 6

2f TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Develop and troubleshoot dynamic configuration domain, which makes up ~20% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 3–5 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

5concepts

Questions 16–18

16foundation · easy
Which Terraform provider is used to read secrets from HashiCorp Vault?
Select an answer first
17expert · hard
A team is designing a Terraform configuration that provisions AWS resources. They need to pass an API token to a Lambda function. The token is stored in HashiCorp Vault. The team has the following constraints: (1) the token must not appear in the Terraform state file, and (2) the token must be retrievable at apply time. Which approach satisfies both constraints?
Select an answer first
18application · medium
A small team manages a Terraform configuration that needs to reference a database password. They currently store the password in a local environment variable and reference it as var.db_password. The team wants to improve security but does not want to introduce a new infrastructure component. Which approach best addresses their concern?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

2f TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–18

Which Terraform provider is used to read secrets from HashiCorp Vault?

Keep studying — Develop and troubleshoot dynamic configuration