HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 281:

  Which of the below options is a valid interpolation syntax for retrieving a data source?

  A. ${google_storage_bucket.backend}

  B. ${azurerm_resource_group.test.data}

  C. ${aws_instance.web.id.data}

  D. ${data.google_dns_keys.foo_dns_keys.key_signing_keys[0].ds_record}

  Correct Answer: D

  Data source attributes are interpolated with the general syntax data.TYPE.NAME.ATTRIBUTE. The interpolation for a resource is the same but without the data. prefix (TYPE.NAME.ATTRIBUTE). https://www.terraform.io/docs/configuration-0-11/interpolation.html#attributes-of-a-data-source

• Question 282:

  You cannot publish your own modules on the Terraform Registry.

  A. False

  B. True

  Correct Answer: A

  https://www.terraform.io/docs/registry/modules/publish.html

• Question 283:

  The Security Operations team of ABC Enterprise wants to mandate that all the Terraform configuration that creates an S3 bucket must have encryption feature enabled. What is the best way to achieve it?

  A. Use Sentinel Policies.

  B. Use S3 bucket policy.

  C. Create a script that checks the encryption parameter is enabled on every git commit.

  D. Shared a SOP to engineers to mandate encryption feature on S3.

  Correct Answer: A

  Sentinel is an embedded policy-as-code framework integrated with the HashiCorp Enterprise products. It enables fine-grained, logic-based policy decisions, and can be extended to use information from external sources. Using Sentinel with Terraform Cloud involves:

  *

  Defining the policies-Policies are defined using the policy language with imports for parsing the Terraform plan, state and configuration.

  *

  Managing policies for organizations-Users with permission to manage policies can add policies to their organization by configuring VCS integration or uploading policy sets through the API. They also define which workspaces the policy sets are checked against during runs. (More about permissions.)

  *

  Enforcing policy checks on runs-Policies are checked when a run is performed, after the terraform plan but before it can be confirmed or the terraform apply is executed.

  *

  Mocking Sentinel Terraform data-Terraform Cloud provides the ability to generate mock data for any run within a workspace. This data can be used with the Sentinel CLI to test policies before deployment. https://www.terraform.io/docs/cloud/sentinel/index.html

• Question 284:

  Your company has been using Terraform Cloud for a some time now . But every team is creating their own modules , and there is no standardization of the modules , with each team creating the resources in their own unique way . You want to enforce a standardization of the modules across the enterprise . What should be your approach.

  A. Create individual workspaces for each team , and ask them to share modules across workspaces.

  B. Implement a Private module registry in Terraform cloud , and ask teams to reference them.

  C. Upgrade to Terraform enterprise , since this is not possible in terraform cloud.

  D. Upload the modules in the terraform public module registry , and ask teams to reference them

  Correct Answer: B

  Terraform Cloud's private module registry helps you share Terraform modules across your organization. It includes support for module versioning, a searchable and filterable list of available modules, and a configuration designer to help you build new workspaces faster. By design, the private module registry works much like the public Terraform Registry. If you're already used the public registry, Terraform Cloud's registry will feel familiar. Understand the different offerings in Terraform OS, Terraform Cloud and Terraform Enterprise. Terraform Cloud's private module registry helps you share Terraform modules across your organization. https://www.terraform.io/docs/cloud/registry/index.html https://www.terraform.io/docs/cloud/registry/publish.html

• Question 285:

  You have created a terraform script that uses a lot of new constructs that have been introduced in terraform v0.12. However, many developers who are cloning the script from your git repo, are using v0.11, and getting errors. What can be done from your end to solve this problem?

  A. Force developer to use v0.12 by using terraform setting `required_version' and set it to >=0.12.

  B. Refactor the code to support both v0.11, and v0.12. It might be a difficult process, but there is no other way.

  C. Add a condition in front of each such specific construct, to check whether the running terraform version id v0.11 or v0.12, and ,work accordingly.

  D. Add comments in your code to tell developers to use v0.12 . If they use v0.11 , that should be their problem , which they need to figure out.

  Correct Answer: A

  https://www.terraform.io/docs/configuration/terraform.html

• Question 286:

  1.

  resource "aws_s3_bucket" "example" {

  2.

  bucket = "my-test-s3-terraform-bucket"

  3.

  ...} resource "aws_iam_role" "test_role" {

  4.

  name = "test_role"

  5.

  ...}

  Due to the way that the application code is written, the s3 bucket must be created before the test role is created, otherwise there will be a problem. How can you ensure that?

  A. Add explicit dependency using depends_on . This will ensure the correct order of resource creation.

  B. This will already be taken care of by terraform native implicit dependency. Nothing else needs to be done from your end.

  C. This is not possible to control in terraform . Terraform will take care of it in a native way , and create a dependency graph that is best suited for the parallel resource creation.

  D. Create 2 separate terraform config scripts , and run them one by one , 1 for s3 bucket , and another for IAM role , run the S3 bucket script first.

  Correct Answer: A

  Implicit dependency works only if there is some reference of one resource to another. Explicit dependency is the option here.

• Question 287:

  Taint the resource "aws_instance" "baz" resource that lives in module bar which lives in module foo.

  A. terraform taint module.foo.module.bar.baz

  B. terraform taint module.foo.bar.aws_instance.baz

  C. terraform taint module.foo.module.bar.aws_instance.baz

  D. terraform taint foo.bar.aws_instance.baz

  Correct Answer: C

  Check resource addressing https://www.terraform.io/docs/internals/resource-addressing.html

• Question 288:

  A colleague has informed you that a new version of a Terraform module that your team hosts on an Amazon S3 bucket is broken. The Amazon S3 bucket has versioning enabled. Your colleague tells you to make sure you are not using the

  latest version in your configuration. You have the following configuration block in your code that refers to the module:

  module "infranet" { source = "s3::https://s3-us-west-2.amazonaws.com/infrabucket/infra_module.zip"}

  What is the best way to ensure that you are not using the latest version of the module?

  A. Add a module version constraint in your configuration's backend block and specify a previous version.

  B. Add a version key to the module configuration and specify a previous version.

  C. Delete the latest version of the module in S3 to rollback to the previous version.

  D. Add a version property to the module in Terraform's state file and specify a previous version.

  Correct Answer: C

  Version constraints are supported only for modules installed from a module registry, such as the Terraform Registry or Terraform Cloud's private module registry. Other module sources can provide their own versioning mechanisms within the source string itself, or might not support versions at all. In particular, modules sourced from local file paths do not support version; since they're loaded from the same source repository. Only Terraform Registries support module versioning by using the version key, one cannot configure a previous version of the module in the configuration. Deleting the latest version of the module in S3 is the only option of the available options that ensures you won't use the latest version. You could also modify the source URL to specify a versionId URL parameter for a previous version. https://www.terraform.io/docs/configuration/modules.html#source

• Question 289:

  Eric needs to make use of module within his terraform code. Should the module always be public and open-source to be able to be used?

  A. False

  B. True

  Correct Answer: A

  Terraform module need not be public and open-source. Module can be placed in

  *

  Local paths

  *

  Terraform Registry

  *

  GitHub

  *

  Bitbucket

  *

  Generic Git, Mercurial repositories

  *

  HTTP URLs

  *

  S3 buckets

  *

  GCS buckets https://www.terraform.io/docs/modules/sources.html

• Question 290:

  The terraform state command can be used to ____

  A. Update current state

  B. Refresh existing state file

  C. Print the current state file in console

  D. It is not a valid command

  Correct Answer: A

  The terraform state command is used for advanced state management. Rather than modify the state directly, the terraform state commands can be used in many cases instead. https://www.terraform.io/docs/commands/state/index.html