A security auditor requires that all changes to Sentinel policies be reviewed and approved by the security team before they take effect. The organization uses a GitHub repository for policy code. Which approach best satisfies this requirement while maintaining a clear audit trail?

Use HCP Terraform's built-in policy editor to make changes directly in the UI.

Create a run task that calls an external API to validate policy changes before they are applied.

Use GitHub branch protection with required reviews on the policy repository, and connect HCP Terraform to that repository.

Use a Sentinel policy to enforce that all policy changes are reviewed.

A large enterprise has multiple HCP Terraform organizations, each managed by a different business unit. The central security team wants to enforce a common baseline policy across all organizations, but they do not want to give the business units the ability to modify or disable the policy. What is the most effective way to achieve this?

Use a run task in each organization that calls a central API to enforce the policy.

Create the policy set in each organization and grant the central security team owner permissions to manage it.

This is not possible with HCP Terraform; policy enforcement is scoped to a single organization.

Use the HCP Terraform API to programmatically create and attach the policy set to all workspaces in all organizations.

A compliance officer needs to prove that a specific Sentinel policy was enforced on a particular run last month. They also want to verify that no one changed the policy set's attachment to the workspace during that time. Which two HCP Terraform features should the administrator use to gather this evidence?

The policy set's version history and the plan output

Audit logs and the run's policy check output

The organization's activity feed and the state version list

Run tasks and the workspace's current settings

A Sentinel policy is written to check that all AWS resources have a specific tag. The policy is attached to a policy set with hard-mandatory enforcement. A run fails the policy. The developer fixes the code and pushes a new commit. The new run passes the policy and proceeds to apply. However, the apply fails due to an infrastructure error. What is the state of the policy check for the failed apply?

The policy check is skipped for the re-run because the previous run already passed.

The policy check passed for the run; the apply failure is unrelated to the policy.

The policy check is marked as failed because the apply did not complete successfully.

The policy check is re-run after the apply failure to ensure the infrastructure is still compliant.

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 6Objective 4

6d TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Part of the Collaborate on infrastructure as code using HCP Terraform domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 1–5

1expert · hard
A security auditor requires that all changes to Sentinel policies be reviewed and approved by the security team before they take effect. The organization uses a GitHub repository for policy code. Which approach best satisfies this requirement while maintaining a clear audit trail?
Select an answer first
2expert · hard
A large enterprise has multiple HCP Terraform organizations, each managed by a different business unit. The central security team wants to enforce a common baseline policy across all organizations, but they do not want to give the business units the ability to modify or disable the policy. What is the most effective way to achieve this?
Select an answer first
3foundation · easy
Which of the following is a governance feature provided by HCP Terraform?
Select an answer first
4application · medium
A compliance officer needs to prove that a specific Sentinel policy was enforced on a particular run last month. They also want to verify that no one changed the policy set's attachment to the workspace during that time. Which two HCP Terraform features should the administrator use to gather this evidence?
Select an answer first
5expert · hard
A Sentinel policy is written to check that all AWS resources have a specific tag. The policy is attached to a policy set with hard-mandatory enforcement. A run fails the policy. The developer fixes the code and pushes a new commit. The new run passes the policy and proceeds to apply. However, the apply fails due to an infrastructure error. What is the state of the policy check for the failed apply?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.

6d TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 1)

Questions 1–5

A security auditor requires that all changes to Sentinel policies be reviewed and approved by the security team before they take effect. The organization uses a GitHub repository for policy code. Which approach best satisfies this requirement while maintaining a clear audit trail?

Which of the following is a governance feature provided by HCP Terraform?

Keep studying — Collaborate on infrastructure as code using HCP Terraform