HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 341:

  Which of the following represents a feature of Terraform Cloud that is NOT free to customers?

  A. Roles and Team Management

  B. WorkSpace Management

  C. Private Module Registry

  D. VCS Integration

  Correct Answer: A

  Role Based Access Controls (RBAC) for controlling permissions for who has access to what configurations within an organization and it is not free to customers. https://www.hashicorp.com/products/terraform/pricing/

• Question 342:

  John wants to use two different regions to deploy two different EC2 instances. He has specified two provider blocks in his providers.tf file.

  provider "aws" { region = "us-east-1" }

  provider "aws" { region = "us-west-2" }

  When he run terraform plan he encountered an error. How to fix this?

  A. Use another provider version

  B. Use alias for region = "us-west-2"

  C. Use default keyword with region = "us-east-1"

  D. It can not be fixed

  Correct Answer: B

• Question 343:

  When TF_LOG_PATH is set, TF_LOG must be set in order for any logging to be enabled.

  A. False

  B. True

  Correct Answer: B

  TF_LOG_PATH specifies where the log should persist its output to. Note that even when TF_LOG_PATH is set, TF_LOG must be set in order for any logging to be enabled. For example, to always write the log to the directory you're currently running terraform from: export TF_LOG_PATH=./terraform.log export TF_LOG=TRACE

• Question 344:

  How can you ensure that the engineering team who has access to git repo will not create any non-compliant resources that might lead to a security audit failure in future. your team is using Hashicorp Terraform Enterprise Edition.

  A. Use Terraform OSS Sentinel Lite version , which will save cost , since there is no charge for OSS , but it can still check for most non-compliant rules using Policy-As-Code.

  B. Implement a review process where every code will be reviewed before merging to the master branch.

  C. Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them.

  D. Create a design /security document (in PDF) and share to the team , and ask them to always follow that document , and never deviate from it.

  Correct Answer: C

  https://www.terraform.io/docs/cloud/sentinel/index.html

• Question 345:

  The current implementation of Terraform import can only import resources into the state. It does not generate configuration.

  A. False

  B. True

  Correct Answer: B

  The current implementation of Terraform import can only import resources into the state. It does not generate configuration. A future version of Terraform will also generate configuration. Because of this, prior to running terraform import it is necessary to write manually a resource configuration block for the resource, to which the imported object will be mapped. While this may seem tedious, it still gives Terraform users an avenue for importing existing resources. https://www.terraform.io/docs/import/index.html#currently-state-only

• Question 346:

  Please identify the offerings which are unique to Terraform Enterprise, and not available in either Terraform OSS, or Terraform Cloud. Select four.

  A. Audit Logs

  B. Private Network Connectivity

  C. VCS Integration

  D. Sentinel

  E. Clustering

  Correct Answer: ABE

  https://www.hashicorp.com/products/terraform/pricing/

• Question 347:

  Terraform works well in Windows but a Windows server is required.

  A. False

  B. True

  Correct Answer: A

  You may see this

• Question 348:

  Refer to the below code where developer is outputting the value of the database password but has used sensitive parameter to hide the output value in the CLI.

  output "db_password" { value = aws_db_instance.db.password description = "The password for logging in to the database." sensitive = true}

  Since sensitive is set to true, the value associated with db password will not be present in state file as plain-text?

  A. False

  B. True

  Correct Answer: A

  Sensitive output values are still recorded in the state, and so will be visible to anyone who is able to access the state data.

• Question 349:

  If you enable TF_LOG = DEBUG, the log will be stored in syslog.log file in the currect directory.

  A. False

  B. True

  Correct Answer: A

  https://www.terraform.io/docs/internals/debugging.html

• Question 350:

  You have declared a variable name my_var in terraform configuration without a value associated with it.

  variable my_var {}

  After running terraform plan it will show an error as variable is not defined.

  A. True

  B. False

  Correct Answer: B

  Input variables are usually defined by stating a name, type and a default value. However, the type and default values are not strictly necessary. Terraform can deduct the type of the variable from the default or input value. Variables can be

  predetermined in a file or included in the command-line options. As such, the simplest variable is just a name while the type and value are selected based on the input.

  variable "variable_name" {}

  terraform apply-var variable_name="value"

  The input variables, like the one above, use a couple of different types: strings, lists, maps, and boolean. Here are some examples of how each type are defined and used.

  String

  Strings mark a single value per structure and are commonly used to simplify and make complicated values more user-friendly. Below is an example of a string variable definition.

  variable "template" {

  type = string

  default = "01000000-0000-4000-8000-000030080200"

  }

  A string variable can then be used in resource plans. Surrounded by double quotes, string variables are a simple substitution such as the example underneath.

  storage = var.template

  List

  Another type of Terraform variables lists. They work much like a numbered catalogue of values. Each value can be called by their corresponding index in the list. Here is an example of a list variable definition.

  variable "users" {

  type = list

  default = ["root", "user1", "user2"]

  }

  Lists can be used in the resource plans similarly to strings, but you'll also need to denote the index of the value you are looking for.

  username = var.users[0]

  Map

  Maps are a collection of string keys and string values. These can be useful for selecting values based on predefined parameters such as the server configuration by the monthly price.

  variable "plans" {

  type = map

  default = {

  "5USD" = "1xCPU-1GB"

  "10USD" = "1xCPU-2GB"

  "20USD" = "2xCPU-4GB"

  }

  }

  You can access the right value by using the matching key. For example, the variable below would set the plan to "1xCPU-1GB".

  plan = var.plans["5USD"]

  The values matching to their keys can also be used to look up information in other maps. For example, underneath is a shortlist of plans and their corresponding storage sizes.

  variable "storage_sizes" {

  type = map

  default = {

  "1xCPU-1GB" = "25"

  "1xCPU-2GB" = "50"

  "2xCPU-4GB" = "80"

  }

  }

  These can then be used to find the right storage size based on the monthly price as defined in the previous example.

  size = lookup(var.storage_sizes, var.plans["5USD"]) Boolean

  The last of the available variable type is boolean. They give the option to employ simple true or false values. For example, you might wish to have a variable that decides when to generate the root user password on a new deployment.

  variable "set_password" {

  default = false

  }

  The above example boolean can be used similarly to a string variable by simply marking down the correct variable.

  create_password = var.set_password

  By default, the value is set to false in this example. However, you can overwrite the variable at deployment by assigning a different value in a command-line variable.

  terraform apply-var set_password="true"