A Terraform pipeline for a production environment must automatically apply changes, but the team wants to ensure that no destructive changes are applied without manual approval. The pipeline currently runs `terraform plan` and `terraform apply -auto-approve` in the same job. What is the best way to add an approval gate for destructive changes?

Use `terraform plan -destroy` to generate a plan and then apply it only after manual approval.

Use `terraform apply -target=...` to apply only non-destructive resources.

Split the pipeline into two stages: one that runs `terraform plan -out=tfplan` and another that runs `terraform apply tfplan` only if the plan output does not contain ' - destroy'.

Use `terraform apply -auto-approve` and rely on the CI system's approval mechanism for the entire job.

A team is integrating Terraform with a CI/CD pipeline. They need to pass a secret API key to the Terraform configuration. The secret is stored in the CI system's secret store. What is the recommended way to inject this secret into the Terraform run without exposing it in logs?

Use a `variable` block with a default value containing the secret.

Pass the secret as a command-line argument using `-var 'api_key=...'`.

Set the secret as an environment variable `TF_VAR_api_key` in the pipeline job, and ensure the CI system masks the variable in logs.

Store the secret in a `terraform.tfvars` file and commit it to the repository.

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 3Objective 3

3c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Part of the Develop collaborative Terraform workflows domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

8concepts

Questions 26–29

26expert · hard
A Terraform pipeline for a production environment must automatically apply changes, but the team wants to ensure that no destructive changes are applied without manual approval. The pipeline currently runs `terraform plan` and `terraform apply -auto-approve` in the same job. What is the best way to add an approval gate for destructive changes?
Select an answer first
27application · medium
A team is integrating Terraform with a CI/CD pipeline. They need to pass a secret API key to the Terraform configuration. The secret is stored in the CI system's secret store. What is the recommended way to inject this secret into the Terraform run without exposing it in logs?
Select an answer first
28foundation · easy
Which Terraform command is used to initialize a working directory and download the necessary provider plugins and modules before running other commands in an automated pipeline?
Select an answer first
29foundation · easy
Which Terraform feature is commonly used to parameterize configurations for different environments (e.g., dev, staging, prod) in automated workflows?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

3c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 6)

Questions 26–29

A team is integrating Terraform with a CI/CD pipeline. They need to pass a secret API key to the Terraform configuration. The secret is stored in the CI system's secret store. What is the recommended way to inject this secret into the Terraform run without exposing it in logs?

Which Terraform command is used to initialize a working directory and download the necessary provider plugins and modules before running other commands in an automated pipeline?

Which Terraform feature is commonly used to parameterize configurations for different environments (e.g., dev, staging, prod) in automated workflows?

Keep studying — Develop collaborative Terraform workflows