6d TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of implementing policy as code in HCP Terraform?

   • ATo automatically fix configuration errors in Terraform code before deployment
   • BTo provide a graphical interface for managing Terraform state files
   • CTo replace the need for manual code reviews in the development lifecycle
   • DTo enforce governance rules on infrastructure configurations in a repeatable and versionable way
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How can you apply a policy set to a specific workspace in HCP Terraform?

   • ABy adding a policy block to the Terraform configuration
   • BBy using the Terraform CLI to link the policy set
   • CBy setting an environment variable in the workspace
   • DBy attaching the policy set to the workspace in the workspace settings
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A manager wants to ensure that all Terraform runs in the organization use a specific version of the AWS provider. They want this rule to be enforced centrally, without requiring each workspace to be individually configured. Which approach should they take?

   • AConfigure a required_version constraint in each workspace's Terraform configuration.
   • BUse a run task that calls an external API to validate the provider version.
   • CCreate a Sentinel policy that checks the provider version in the plan and attach it to a policy set applied to all projects.
   • DSet the provider version in the organization's variable set.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A team uses HCP Terraform with a VCS-driven workflow. They have a Sentinel policy set with a soft-mandatory policy that requires all resources to have a 'cost-center' tag. A developer pushes a change to a feature branch, and a run is triggered. The run fails the policy. The developer asks a senior engineer to override the policy so they can merge the pull request. The senior engineer overrides the policy, and the run proceeds to apply. Later, the compliance team discovers that the 'cost-center' tag is missing from the resource. Who is responsible for the missing tag, and what should have happened?

   • AThe compliance team is responsible because they did not catch the violation in the audit logs.
   • BThe developer is responsible because they wrote the code that violated the policy; the override is irrelevant.
   • CNo one is responsible because the override was authorized by the system.
   • DThe senior engineer is responsible because they overrode the policy; the override should have been logged and reviewed.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A platform team is rolling out a new Sentinel policy that restricts EC2 instance types to a pre-approved list. They want to observe how many existing workspaces would be affected before enforcing it, but they do not want to block any current runs. Which enforcement level should they configure for the policy set?

   • AHard-mandatory
   • BAdvisory
   • CDisabled
   • DSoft-mandatory
   Reveal Solution Discussion Select an answer first