HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 221:

  Terraform plan updates your state file.

  A. True

  B. False

  Correct Answer: B

  The terraform plan command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure. The plan command alone will not actually carry out the proposed changes, and so you can use this command to check whether the proposed changes match what you expected before you apply the changes or share your changes with your team for broader review. Source: https://www.terraform.io/cli/commands/plan

• Question 222:

  Changing the Terraform backend from the default "local" backend to a different one after doing your first terraform apply is:

  A. Mandatory

  B. Optional

  C. Impossible

  D. Discouraged

  Correct Answer: B

• Question 223:

  Terraform will sync all resources in state by default for every plan and apply, hence for larger infrastructures this can slow down terraform plan and terraform apply commands?

  A. False

  B. True

  Correct Answer: B

  For small infrastructures, Terraform can query your providers and sync the latest attributes from all your resources. This is the default behavior of Terraform: for every plan and apply, Terraform will sync all resources in your state. For larger infrastructures, querying every resource is too slow. Many cloud providers do not provide APIs to query multiple resources at once, and the round trip time for each resource is hundreds of milliseconds. On top of this, cloud providers almost always have API rate limiting so Terraform can only request a certain number of resources in a period of time. Larger users of Terraform make heavy use of the-refresh=false flag as well as the-target flag in order to work around this. In these scenarios, the cached state is treated as the record of truth. https://www.terraform.io/docs/state/purpose.html

• Question 224:

  When multiple engineers start deploying infrastructure using the same state file, what is a feature of remote state storage that is critical to ensure the state doesn't become corrupt?

  A. Object Storage

  B. State Locking

  C. WorkSpaces

  D. Encryption

  Correct Answer: B

  If supported by your backend, Terraform will lock your state for all operations that could write state. This prevents others from acquiring the lock and potentially corrupting your state. State locking happens automatically on all operations that could write state. You won't see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the-lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn't output a message, state locking is still occurring if your backend supports it. Not all backends support locking. Please view the list of backend types for details on whether a backend supports locking or not.

  https://www.terraform.io/docs/state/locking.html

• Question 225:

  A data block requests that Terraform read from a given data source and export the result under the given local name.

  A. False

  B. True

  Correct Answer: B

• Question 226:

  In regards to Terraform state file, select all the statements below which are correct?

  A. When using local state, the state file is stored in plain-text.

  B. The state file is always encrypted at rest.

  C. Storing state remotely can provide better security.

  D. Using the mask feature, you can instruct Terraform to mask sensitive data in the state file.

  E. The Terraform state can contain sensitive data, therefore the state file should be protected from unauthorized access.

  F. Terraform Cloud always encrypts state at rest.

  Correct Answer: ACEF

  Terraform state can contain sensitive data, depending on the resources in use and your definition of "sensitive." The state contains resource IDs and all resource attributes. For resources such as databases, this may contain initial passwords.

  When using local state, state is stored in plain-text JSON files. When using remote state, state is only ever held in memory when used by Terraform. It may be encrypted at rest, but this depends on the specific remote state backend. Storing

  Terraform state remotely can provide better security. As of Terraform 0.9, Terraform does not persist state to the local disk when remote state is in use, and some backends can be configured to encrypt the state data at rest.

  Recommendations

  If you manage any sensitive data with Terraform (like database passwords, user passwords, or private keys), treat the state itself as sensitive data. Storing state remotely can provide better security. As of Terraform 0.9, Terraform does not

  persist state to the local disk when remote state is in use, and some backends can be configured to encrypt the state data at rest.

  For example:

  *

  Terraform Cloud always encrypts state at rest and protects it with TLS in transit. Terraform Cloud also knows the identity of the user requesting state and maintains a history of state changes. This can be used to control access and track activity. Terraform Enterprise also supports detailed audit logging.

  *

  The S3 backend supports encryption at rest when the encrypt option is enabled. IAM policies and logging can be used to identify any invalid access. Requests for the state go over a TLS connection.

• Question 227:

  Ric wants to enable detail logging and he wants highest verbosity of logs. Which of the following environment variable settings is correct option for him to select.

  A. Set TF_LOG = DEBUG

  B. Set VAR_TF = TRACE

  C. Set TF_LOG = TRACE

  D. Set VAR_TF_LOG = TRACE

  Correct Answer: C

  https://www.terraform.io/docs/internals/debugging.html

• Question 228:

  Refer below code where pessimistic constraint operator has been used to specify a version of a provider.

  terraform { required_providers { aws = "~> 1.1.0" }}

  Which of the following options are valid provider versions that satisfy the above constraint? (select two)

  A. 1.1.1

  B. 1.2.9

  C. 1.1.8

  D. 1.2.0

  Correct Answer: AC

  Pessimistic constraint operator, constraining both the oldest and newest version allowed. For example, ~> 0.9 is equivalent to >= 0.9, < 1.0, and ~> 0.8.4, is equivalent to >= 0.8.4, < 0.9

• Question 229:

  You are reviewing Terraform configurations for a big project in your company. You noticed that there are several identical sets of resources that appear in multiple configurations. What feature of Terraform would you recommend to use to reduce the amount of cloned configuration between the different configurations?

  A. Packages

  B. Backends

  C. Provisioners

  D. Modules

  Correct Answer: D

  Modules are reusable configuration packages that Terraform can share through a variety of sources including Terraform Registries, GitHub, and Amazon S3 buckets. A module is a container for multiple resources that are used together.

  Modules can be used to create lightweight abstractions, so that you can describe your infrastructure in terms of its architecture, rather than directly in terms of physical objects. Modules are reusable configuration packages that Terraform can

  share through a variety of sources including Terraform Registries, GitHub, and Amazon S3 buckets.

  https://www.terraform.io/docs/modules/index.html

• Question 230:

  Every region in AWS has a different AMI ID for Linux and these are keep on changing. What is the best approach to create the EC2 instances that can deal with different AMI IDs based on regions?

  A. Use data source aws_ami.

  B. Create a map of region to ami id.

  C. Create different configuration file for different region.

  D. None of the above

  Correct Answer: A

  https://www.terraform.io/docs/configuration/data-sources.html