A team is integrating Terraform into a CI/CD pipeline and needs to pass a database password to the configuration. The password is stored in the CI system's secret store. The team wants to avoid hardcoding the password in the repository or in the Terraform configuration. What is the recommended way to inject this secret into the Terraform run?

Set the password as an environment variable `TF_VAR_db_password` in the pipeline job.

Store the password in a `terraform.tfvars` file and commit it to the repository.

Use a `variable` block with a default value containing the password.

Pass the password as a command-line argument using `-var 'db_password=...'`.

In an automated pipeline, how can you pass environment-specific values (e.g., instance size for dev vs. prod) to Terraform without modifying the configuration files?

Using the `-var-file` flag with a fixed file path

Using `terraform import` to set values

Hardcoding values in the configuration

Using environment variables with the `TF_VAR_` prefix

A company uses a CI/CD pipeline to deploy infrastructure with Terraform. The pipeline runs `terraform init` in a job, but the job fails because it cannot download the required provider plugins. The team wants to ensure that the pipeline is resilient to transient network issues. What should they do?

Use a Terraform provider mirror or cache the provider plugins in a shared location accessible to the pipeline.

Set `TF_LOG=TRACE` to get more detailed logs.

Run `terraform init` with `-upgrade=true` to force re-downloading providers.

Use `terraform init -lock=false` to skip locking.

A Terraform pipeline applies changes to a production environment. The pipeline uses remote state with locking. If `terraform apply` fails due to a transient error, the pipeline retries the apply. However, the retry fails because the state is locked by the previous run. What is the best way to handle this?

Ensure that the pipeline releases the lock before retrying, either by using `terraform force-unlock` or by ensuring the previous run releases the lock on failure.

Use `-lock=false` on the retry to bypass the lock.

Use a separate state file for retries.

Wait for the lock to expire automatically.

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 3Objective 3

3c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Part of the Develop collaborative Terraform workflows domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

Questions 6–10

6application · medium
A team is integrating Terraform into a CI/CD pipeline and needs to pass a database password to the configuration. The password is stored in the CI system's secret store. The team wants to avoid hardcoding the password in the repository or in the Terraform configuration. What is the recommended way to inject this secret into the Terraform run?
Select an answer first
7foundation · easy
In an automated Terraform workflow, which command-line flag is commonly used with `terraform apply` to run it without requiring interactive confirmation?
Select an answer first
8foundation · easy
In an automated pipeline, how can you pass environment-specific values (e.g., instance size for dev vs. prod) to Terraform without modifying the configuration files?
Select an answer first
9application · medium
A company uses a CI/CD pipeline to deploy infrastructure with Terraform. The pipeline runs `terraform init` in a job, but the job fails because it cannot download the required provider plugins. The team wants to ensure that the pipeline is resilient to transient network issues. What should they do?
Select an answer first
10expert · hard
A Terraform pipeline applies changes to a production environment. The pipeline uses remote state with locking. If `terraform apply` fails due to a transient error, the pipeline retries the apply. However, the retry fails because the state is locked by the previous run. What is the best way to handle this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

3c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

In an automated Terraform workflow, which command-line flag is commonly used with `terraform apply` to run it without requiring interactive confirmation?

In an automated pipeline, how can you pass environment-specific values (e.g., instance size for dev vs. prod) to Terraform without modifying the configuration files?

A company uses a CI/CD pipeline to deploy infrastructure with Terraform. The pipeline runs `terraform init` in a job, but the job fails because it cannot download the required provider plugins. The team wants to ensure that the pipeline is resilient to transient network issues. What should they do?

Keep studying — Develop collaborative Terraform workflows