Quiz HashiCorp Certified: Terraform Associate (003)

True

False Option D is correct. Running terraform fmt without any flags in a directory with Terraform configuration files will not check the formatting of those files without changing their contents, but will actually rewrite them to a canonical format and style. If you want to check the formatting without making changes, you need to use the - check flag. You ate making changes to existing Terraform code to add some new infrastructure. When is the best time to run terraform validate? A. After you run terraform apply so you can validate your infrastructure B. Before you run terraform apply so you can validate your provider credentials

Before you run terraform plan so you can validate your code syntax

After you run terraform plan so you can validate that your state file is consistent with your infrastructure Option C is correct. This is the best time to run terraform validate, as it will check your code for syntax errors, typos, and missing arguments before you attempt to create a plan. The other options are either incorrect or unnecessary. What value does the Terraform Cloud private registry provide over the public Terraform Module Registry? A. The ability to share modules publicly with any user of Terraform B. The ability to restrict modules to members of Terraform Cloud or Enterprise organizations C. The ability to tag modules by version or release D. The ability to share modules with public Terraform users and members of Terraform Cloud Organizations Option B is correct. The Terraform Cloud private registry provides the ability to restrict modules to members of Terraform Cloud or Enterprise organizations. This allows you to share modules within your organization without exposing them to the public. The private registry also supports importing modules from your private VCS repositories. The public Terraform Module Registry, on the other hand, publishes modules from public Git repositories and makes them available to any user of Terraform. References = : Private Registry - Terraform Cloud : Terraform Registry - Provider Documentation Terraform providers are part of the Terraform core binary. A. True B. False Option B is correct. Terraform providers are not part of the Terraform core binary. Providers are distributed separately from Terraform itself and have their own release cadence and version numbers. Providers are plugins that Terraform uses to interact with various APIs, such as cloud providers, SaaS providers, and other services. You can find and install providers from the Terraform Registry, which hosts providers for most major infrastructure platforms. You can also load providers from a local mirror or cache, or develop your own custom providers. To use a provider in your Terraform configuration, you need to declare it in the provider requirements block and optionally configure its settings in the provider block. References = : Providers - Configuration Language | Terraform : Terraform Registry - Providers Overview | Terraform Module version is required to reference a module on the Terraform Module Registry. A. True B. False Option B is correct. Module version is optional to reference a module on the Terraform Module Registry. If you omit the version constraint, Terraform will automatically use the latest available version of the module You have deployed a new webapp with a public IP address on a cloud provider. However, you did not create any outputs for your code. What is the best method to quickly find the IP address of the resource you deployed? A. In a new folder, use the terraform_remote_state data source to load in the state file, then write an output for each resource that you find the state file B. Run terraform state list to find the name of the resource, then terraform state show to find the attributes including public IP address C. Run terraform output ip_address to view the result D. Run terraform destroy then terraform apply and look for the IP address in stdout Option B is correct. This is a quick way to inspect the state file and find the information you need without modifying anything5. The other options are either incorrect or inefficient. Select the command that doesn’t cause Terraform to refresh its state. A. Terraform destroy B. Terraform apply C. Terraform plan D. Terraform state list Option D is correct. This is the command that does not cause Terraform to refresh its state, as it only lists the resources that are currently managed by Terraform in the state file. The other commands will refresh the state file before performing their operations, unless you use the -refresh=false flag. Your security team scanned some Terraform workspaces and found secrets stored in plaintext in state files. How can you protect that data? A. Edit your state file to scrub out the sensitive data B. Always store your secrets in a secrets.tfvars file C. Delete the state file every time you run Terraform D. Store the state in an encrypted backend Option D is correct. This is a secure way to protect sensitive data in the state file, as it will be encrypted at rest and in transit2. The other options are not recommended, as they could lead to data loss, errors, or security breaches. Which of the following command would be use to access all of the attributes and details of a resource managed by Terraform? A. Terraform state show ‘ provider_type_name B. Terraform state list C. Terraform get provider_type_name D. Terraform state list provider_type_name Option A is correct. This is the command that you would use to access all of the attributes and details of a resource managed by Terraform, by providing the resource address as an argument. For example, terraform state show 'aws_instance.example' will show you all the information about the AWS instance named example. You add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The existing and new resources use the same provider. The working contains a .terraform.lock, hc1 file. How will Terraform choose which version of the provider to use? A. Terraform will use the version recorded in your lock file B. Terraform will use the latest version of the provider for the new resource and the version recorded in the lock file to manage existing resources C. Terraform will check your state file to determine the provider version to use D. Terraform will use the latest version of the provider available at the time you provision your new resource Option A is correct. This is how Terraform chooses which version of the provider to use, when you add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The lock file records the exact version of each provider that was installed in your working directory, and ensures that Terraform will always use the same provider versions until you run terraform init -upgrade to update them. What is the name of the default file where Terraform stores the state? Type your answer in the field provided. The text field is not case-sensitive and all variations of the correct answer are accepted. Option T,e,r,r,a,f,o,r,m,.,t,f,s,t,a,t are correct. The name of the default file where Terraform stores the state is terraform.tfstate. This file contains a JSON representation of the current state of the infrastructure managed by Terraform. Terraform uses this file to track the metadata and attributes of the resources, and to plan and apply changes. By default, Terraform stores the state file locally in the same directory as the configuration files, but it can also be configured to store the state remotely in a backend. References = [Terraform State], [State File Format] As a member of an operations team that uses infrastructure as code (lac) practices, you are tasked with making a change to an infrastructure stack running in a public cloud. Which pattern would follow laC best practices for making a change? A. Make the change via the public cloud API endpoint B. Clone the repository containing your infrastructure code and then run the code C. Use the public cloud console to make the change after a database record has been approved D. Make the change programmatically via the public cloud CLI

Submit a pull request and wait for an approved merge of the proposed changes

True

False Option C is correct. Variables declared within a module are only accessible within that module, unless they are explicitly exposed as output values1. What is the Terraform style convention for indenting a nesting level compared to the one above it? A. With a tab B. With two spaces

With four spaces

With three spaces

True

False Option B is correct. Outside of the required_providers block, Terraform configurations can refer to providers by either their local names or their source addresses. The local name is a short name that can be used throughout the configuration, while the source address is a global identifier for the provider in the format registry.terraform.io/namespace/type. For example, you can use either aws or registry.terraform.io/hashicorp/aws to refer to the AWS provider. You're building a CI/CD (continuous integration/continuous delivery) pipeline and need to inject sensitive variables into your Terraform run. How can you do this safely? A. Copy the sensitive variables into your Terraform code B. Store the sensitive variables in a secure_varS.tf file

Store the sensitive variables as plain text in a source code repository

Pass variables to Terraform with a -var flag Option D is correct. This is a secure way to inject sensitive variables into your Terraform run, as they will not be stored in any file or source code repository. You can also use environment variables or variable files with encryption to pass sensitive variables to Terraform. What kind of configuration block will create an infrastructure object with settings specified within the block? A. provider B. state C. data D. resource Option D is correct. This is the kind of configuration block that will create an infrastructure object with settings specified within the block. The other options are not used for creating infrastructure objects, but for configuring providers, accessing state data, or querying data sources. You are working on some new application features and you want to spin up a copy of your production deployment to perform some quick tests. In order to avoid having to configure a new state backend, what open source Terraform feature would allow you create multiple states but still be associated with your current code? A. Terraform data sources B. Terraform local values C. Terraform modules D. Terraform workspaces

None of the above Option D is correct. Terraform workspaces allow you to create multiple states but still be associated with your current code. Workspaces are like Ñ€łenvironmentsÑ€• (e.g. staging, production) for the same configuration. You can use workspaces to spin up a copy of your production deployment for testing purposes without having to configure a new state backend. Terraform data sources, local values, and modules are not features that allow you to create multiple states.± References± =± Workspaces± and± How to Use Terraform Workspaces You cannot install third party plugins using terraform init. A. True B. False Option B is correct. You can install third party plugins using terraform init, as long as you specify the plugin directory in your configuration or as a command-line argument. You can also use the terraform providers mirror command to create a local mirror of providers from any source. Which of the following is not a valid Terraform variable type? A. list B. array C. nap D. string Option B is correct. This is not a valid Terraform variable type. The other options are valid variable types that can store different kinds of values2. You have never used Terraform before and would like to test it out using a shared team account for a cloud provider. The shared team account already contains 15 virtual machines (VM). You develop a Terraform configuration containing one VM. perform terraform apply, and see that your VM was created successfully. What should you do to delete the newly-created VM with Terraform? A. The Terraform state file contains all 16 VMs in the team account. Execute terraform destroy and select the newly-created VM. B. Delete the Terraform state file and execute terraform apply. C. The Terraform state file only contains the one new VM. Execute terraform destroy. D. Delete the VM using the cloud provider console and terraform apply to apply the changes to the Terraform state file. Option C is correct. This is the best way to delete the newly-created VM with Terraform, as it will only affect the resource that was created by your configuration and state file. The other options are either incorrect or inefficient. Which are forbidden actions when the terraform state file is locked? Choose three correct answers. A. Terraform state list B. Terraform destroy C. Terraform validate D. Terraform validate E. Terraform for

Terraform apply

Terraform will remove the virtual machine from the state file, but the resource will still exist

Nothing

Terraform will error

Terraform will destroy the virtual machine

Set verbose for each provider in your Terraform configuration

Set the environment variable TF_LOG_TRACE

Set the environment variable TF_LOG_PATH

Set the environment variable TF_log_TRACE Option B is correct. This will enable additional logging messages to find out from which paths Terraform is loading providers referenced in your Terraform configuration files, as it will set the log level to TRACE, which is the most verbose and detailed level. You decide to move a Terraform state file to Amazon S3 from another location. You write the code below into a file called backend.tf. Which command will migrate your current state file to the new S3 remote backend? A. terraform state B. terraform init C. terraform push D. terraform refresh Option B is correct. This command will initialize the new backend and prompt you to migrate the existing state file to the new location3. The other commands are not relevant for this task. You have to initialize a Terraform backend before it can be configured. A. Tru B. False Option B is correct. You can configure a backend in your Terraform code before initializing it. Initializing a backend will store the state file remotely and enable features like locking and workspaces. References = [Terraform Backends] Which Terraform collection type should you use to store key/value pairs? A. Set B. Map C. Tuple D. list Option B is correct. The Terraform collection type that should be used to store key/value pairs is map. A map is a collection of values that are accessed by arbitrary labels, called keys. The keys and values can be of any type, but the keys must be unique within a map. For example, var = { key1 = "value1", key2 = "value2" } is a map with two key/value pairs. Maps are useful for grouping related values together, such as configuration options or metadata. References = [Collection Types], [Map Type Constraints] What are some benefits of using Sentinel with Terraform Cloud/Terra form Cloud? Choose three correct answers. A. You can enforce a list of approved AWS AMIs B. Policy-as-code can enforce security best practices C. You can check out and check in cloud access keys D. You can restrict specific resource configurations, such as disallowing the use of CIDR=0.0.0.0/0.

Sentinel Policies can be written in HashiCorp Configuration Language (HCL)

Terraform will prompt you to pick which resource you want to destroy

Terraform will destroy the application server because it is listed first in the code

Terraform will prompt you to confirm that you want to destroy all the infrastructure

Terraform will destroy the main, tf file

Terraform will immediately destroy all the infrastructure

Option A

Option B

Option C

Option A

Option B

Option C

Option D Terraform providers are part of the Terraform core binary. A. True B. False