In Terraform, what is the precedence order for provider authentication when multiple methods are configured?

Environment variables override static credentials in the provider block, and shared configuration files override environment variables.

Environment variables override shared configuration files, and static credentials in the provider block override environment variables.

The authentication method is chosen randomly if multiple are configured.

Shared configuration files override environment variables, and environment variables override static credentials in the provider block.

An organization uses Terraform to manage resources in separate development and production Azure subscriptions. They want to use the same Terraform configuration for both environments, but authenticate with different service principals. They also want to avoid maintaining separate copies of the configuration. What is the recommended approach?

Use Terraform workspaces and set the service principal credentials inside each workspace's state

Use a single service principal with contributor access to both subscriptions

Use environment variables to set the ARM_SUBSCRIPTION_ID and ARM_CLIENT_ID differently for each environment

Create two separate Terraform configurations, one for each environment

An organization is adopting Terraform for multi-cloud deployments. They want to ensure that provider credentials are never stored in plaintext in configuration files or shell history. They also need to support temporary credentials that expire. Which solution best meets these requirements?

Use Terraform's `sensitive` parameter on variables

Use a shared credentials file with restricted permissions

Use a secret management tool like HashiCorp Vault to generate dynamic credentials for each run

Store static credentials in environment variables

A Terraform configuration uses the Azure provider. The developer has set the `ARM_CLIENT_ID` and `ARM_CLIENT_SECRET` environment variables. They also have a `provider` block with `client_id` and `client_secret` arguments. Which credentials will be used?

The environment variables only if the provider block arguments are empty

The environment variables, because they are set globally

Terraform will error because both are set

The provider block arguments, because explicit configuration takes precedence

A security team requires that all Terraform runs use ephemeral credentials that are automatically rotated and have a short lifetime. They also want to ensure that credentials are not accessible to developers after the run. Which approach should they use?

Use environment variables that are set by the CI/CD system

Use AWS IAM roles and have Terraform assume the role for each run

Use HashiCorp Vault to generate dynamic credentials for each Terraform run

Use static credentials stored in a secure vault and retrieved at runtime

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 5Objective 3

5c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Part of the Configure and use Terraform providers domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

Questions 1–5

1foundation · easy
In Terraform, what is the precedence order for provider authentication when multiple methods are configured?
Select an answer first
2application · medium
An organization uses Terraform to manage resources in separate development and production Azure subscriptions. They want to use the same Terraform configuration for both environments, but authenticate with different service principals. They also want to avoid maintaining separate copies of the configuration. What is the recommended approach?
Select an answer first
3application · medium
An organization is adopting Terraform for multi-cloud deployments. They want to ensure that provider credentials are never stored in plaintext in configuration files or shell history. They also need to support temporary credentials that expire. Which solution best meets these requirements?
Select an answer first
4application · medium
A Terraform configuration uses the Azure provider. The developer has set the `ARM_CLIENT_ID` and `ARM_CLIENT_SECRET` environment variables. They also have a `provider` block with `client_id` and `client_secret` arguments. Which credentials will be used?
Select an answer first
5expert · hard
A security team requires that all Terraform runs use ephemeral credentials that are automatically rotated and have a short lifetime. They also want to ensure that credentials are not accessible to developers after the run. Which approach should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.