An organization wants to enforce a policy that all EC2 instances must have a specific tag. They use Terraform Cloud and want to automate this check before any apply. What should they use?

A Sentinel policy that checks for the required tag on `aws_instance` resources.

`terraform validate` to check for the tag in the configuration.

A `precondition` block in the `aws_instance` resource to check for the tag.

A `terraform plan` output review by a human.

A Terraform pipeline occasionally fails during `terraform apply` due to transient network errors when communicating with the cloud provider. The team wants to add resilience to the pipeline without masking real configuration errors. What is the best approach?

Run `terraform apply` in a separate job and manually re-run it if it fails.

Retry the `terraform apply` command a limited number of times with a backoff delay, but only for errors that are known to be transient.

Use `terraform apply -auto-approve` to skip confirmation and reduce failure points.

Always retry the `terraform apply` command indefinitely until it succeeds.

Which of the following is a secure way to inject sensitive credentials (e.g., API keys) into Terraform runs in a CI/CD pipeline?

Storing them in a plaintext `.tfvars` file in the repository

Hardcoding them in the Terraform configuration

Using the CI/CD system's secret management to set environment variables

Passing them as command-line arguments

In a CI/CD pipeline, what is the primary purpose of enabling state locking when running Terraform commands?

To encrypt the state file at rest

To prevent concurrent modifications to the same state

To store the state file in a remote location

To speed up the plan and apply operations

When a `terraform apply` fails in an automated pipeline, what is a recommended first step to diagnose the issue?

Re-run the pipeline without changes

Review the Terraform logs and error messages from the pipeline output

Immediately run `terraform destroy` to clean up

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 3Objective 3

3c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 5)

Part of the Develop collaborative Terraform workflows domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

Questions 21–25

21application · medium
An organization wants to enforce a policy that all EC2 instances must have a specific tag. They use Terraform Cloud and want to automate this check before any apply. What should they use?
Select an answer first
22application · medium
A Terraform pipeline occasionally fails during `terraform apply` due to transient network errors when communicating with the cloud provider. The team wants to add resilience to the pipeline without masking real configuration errors. What is the best approach?
Select an answer first
23foundation · easy
Which of the following is a secure way to inject sensitive credentials (e.g., API keys) into Terraform runs in a CI/CD pipeline?
Select an answer first
24foundation · easy
In a CI/CD pipeline, what is the primary purpose of enabling state locking when running Terraform commands?
Select an answer first
25foundation · easy
When a `terraform apply` fails in an automated pipeline, what is a recommended first step to diagnose the issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.