Which of the following is a best practice for securing provider credentials in Terraform?

Using the same credentials for all environments to simplify management

Using a secret management tool such as HashiCorp Vault to store and retrieve credentials

Committing credentials to version control for team access

Storing credentials in plaintext in the Terraform configuration files

A team uses Terraform Cloud for remote state and runs. They have separate workspaces for staging and production, each using the same AWS provider configuration. They want to use different AWS credentials for each workspace without storing them in the Terraform configuration. What is the recommended way to achieve this?

Use the same AWS credentials for both workspaces

Store the credentials in the Terraform configuration using variables with defaults

Use Terraform Cloud's VCS integration to inject credentials from the repository

Set the AWS credentials as environment variables in each Terraform Cloud workspace

A Terraform configuration uses the Azure provider. The developer has set the `ARM_CLIENT_SECRET` environment variable and also has a `provider` block with a `client_secret` argument. Which value will be used?

The provider block argument, because explicit configuration takes precedence over environment variables

The value from the environment variable only if the provider block argument is empty

Terraform will error due to conflicting credentials

The environment variable, because environment variables override provider block arguments

A large enterprise uses Terraform with the AWS provider. They have a requirement to use temporary credentials for all Terraform runs, and they want to avoid storing any long-lived credentials on developer machines. They also need to support multiple AWS accounts. Which solution should they implement?

Use AWS SSO and have developers run `aws sso login` before running Terraform

Use Terraform Cloud and store static credentials as workspace variables

Use a shared IAM role and have developers assume it via `aws sts assume-role`

Use IAM access keys for each developer and rotate them monthly

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 5Objective 3

5c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Configure and use Terraform providers domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

Questions 16–20

16foundation · easy
Which of the following is a best practice for securing provider credentials in Terraform?
Select an answer first
17foundation · easy
Which Terraform feature is specifically designed to help manage provider authentication across different environments without hardcoding secrets?
Select an answer first
18application · medium
A team uses Terraform Cloud for remote state and runs. They have separate workspaces for staging and production, each using the same AWS provider configuration. They want to use different AWS credentials for each workspace without storing them in the Terraform configuration. What is the recommended way to achieve this?
Select an answer first
19application · medium
A Terraform configuration uses the Azure provider. The developer has set the `ARM_CLIENT_SECRET` environment variable and also has a `provider` block with a `client_secret` argument. Which value will be used?
Select an answer first
20expert · hard
A large enterprise uses Terraform with the AWS provider. They have a requirement to use temporary credentials for all Terraform runs, and they want to avoid storing any long-lived credentials on developer machines. They also need to support multiple AWS accounts. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

5c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Questions 16–20

Which of the following is a best practice for securing provider credentials in Terraform?

Which Terraform feature is specifically designed to help manage provider authentication across different environments without hardcoding secrets?

A Terraform configuration uses the Azure provider. The developer has set the `ARM_CLIENT_SECRET` environment variable and also has a `provider` block with a `client_secret` argument. Which value will be used?

Keep studying — Configure and use Terraform providers