6c TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security incident requires you to rotate the AWS credentials used by HCP Terraform immediately. The old credentials have been deactivated in AWS. You have updated the credentials in the variable set. However, a scheduled run starts before you can verify the new credentials. What is the most likely outcome?

   • AThe run will be paused until the new credentials are verified.
   • BThe run will use the new credentials because the variable set is updated in real-time.
   • CThe run will succeed because the variable update is applied immediately to all runs.
   • DThe run will fail with an authentication error because the old credentials are deactivated.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In HCP Terraform, how are provider credentials such as AWS access keys or Azure client secrets stored to keep them secure?

   • AAs environment variables defined only in the local shell before running terraform apply
   • BAs unencrypted variables stored in the workspace's state file
   • CAs sensitive variables that are encrypted and hidden from run logs and UI displays
   • DAs plain text variables in the workspace's Terraform configuration files
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When configuring provider credentials in HCP Terraform, what is the correct way to define an AWS access key as a sensitive variable?

   • ACreate a variable named 'aws_access_key' and set its value to the key, then mark it as sensitive
   • BUse the HCP Terraform API to inject the key into the state file directly
   • CAdd the access key directly to the main.tf file using the provider block
   • DStore the access key in a local terraform.tfvars file and commit it to the repository
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   Your team is migrating from a self-hosted Terraform setup to HCP Terraform. In the old setup, provider credentials were stored in environment variables on the runner. You need to replicate this in HCP Terraform for multiple workspaces that use the same AWS account. What is the most efficient way to achieve this?

   • ACreate workspace variables for each workspace with the AWS credentials.
   • BStore the credentials in the Terraform configuration and use them in the provider block.
   • CUse the HCP Terraform API to set the credentials as variables in each workspace.
   • DCreate a variable set with the AWS credentials as environment variables and apply it to all relevant workspaces.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   Your organization has multiple HCP Terraform workspaces that deploy to different AWS accounts. You need to manage the AWS credentials centrally, but some workspaces should use a read-only credential while others use a full-access credential. You want to minimize duplication and administrative overhead. What is the best approach?

   • ACreate two variable sets: one with read-only credentials and one with full-access credentials. Apply each to the appropriate workspaces.
   • BDefine the credentials in each workspace's variables, using different values for read-only and full-access.
   • CCreate a single variable set with full-access credentials and apply it to all workspaces.
   • DUse a single variable set with a variable that determines the access level based on the workspace.
   Reveal Solution Discussion Select an answer first