HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 371:

  You should store secret data in the same version control repository as your Terraform configuration.

  A. True

  B. False

  Correct Answer: B

  Reference: https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1

• Question 372:

  Which option can not be used to keep secrets out of Terraform configuration files?

  A. A Terraform provider

  B. Environment variables

  C. A-var flag

  D. secure string

  Correct Answer: A

  Reference: https://secrethub.io/blog/secret-management-for-terraform/

• Question 373:

  Why would you use the terraform taint command?

  A. When you want to force Terraform to destroy a resource on the next apply

  B. When you want to force Terraform to destroy and recreate a resource on the next apply

  C. When you want Terraform to ignore a resource on the next apply

  D. When you want Terraform to destroy all the infrastructure in your workspace

  Correct Answer: B

  The terraform taint command manually marks a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply. Reference: https://www.terraform.io/docs/cli/commands/taint.html

• Question 374:

  You write a new Terraform configuration and immediately run terraform apply in the CLI using the local backend. Why will the apply fail?

  A. Terraform needs you to format your code according to best practices first

  B. Terraform needs to install the necessary plugins first

  C. The Terraform CLI needs you to log into Terraform cloud first

  D. Terraform requires you to manually run terraform plan first

  Correct Answer: B

• Question 375:

  When should you use the force-unlock command?

  A. You see a status message that you cannot acquire the lock

  B. You have a high priority change

  C. Automatic unlocking failed

  D. Your apply failed due to a state lock

  Correct Answer: C

  Be very careful with this command. If you unlock the state when someone else is holding the lock it could cause multiple writers. Force unlock should only be used to unlock your own lock in the situation where automatic unlocking failed.

  Source: https://www.terraform.io/language/state/locking https://www.terraform.io/cli/commands/force-unlock

• Question 376:

  What is one disadvantage of using dynamic blocks in Terraform?

  A. They cannot be used to loop through a list of values

  B. Dynamic blocks can construct repeatable nested blocks

  C. They make configuration harder to read and understand

  D. Terraform will run more slowly

  Correct Answer: C

  "Overuse of dynamic blocks can make configuration hard to read and maintain, so we recommend using them only when you need to hide details in order to build a clean user interface for a re-usable module. Always write nested blocks out literally where possible."

  Reference: https://github.com/hashicorp/terraform/issues/19291

• Question 377:

  In Terraform 0.13 and above, outside of the required_providers block, Terraform configurations always refer to providers by their local names.

  A. True

  B. False

  Correct Answer: A

  Outside of the required_providers block, Terraform configurations always refer to providers by their local names.

  Reference: https://www.terraform.io/docs/language/providers/requirements.html https://www.terraform.io/language/providers/requirements#local-names

• Question 378:

  You have recently started a new job at a retailer as an engineer. As part of this new role, you have been tasked with evaluating multiple outages that occurred during peak shopping time during the holiday season. Your investigation found that the team is manually deploying new compute instances and configuring each compute instance manually. This has led to inconsistent configuration between each compute instance.

  How would you solve this using infrastructure as code?

  A. Implement a ticketing workflow that makes engineers submit a ticket before manually provisioning and configuring a resource

  B. Implement a checklist that engineers can follow when configuring compute instances

  C. Replace the compute instance type with a larger version to reduce the number of required deployments

  D. Implement a provisioning pipeline that deploys infrastructure configurations committed to your version control system following code reviews

  Correct Answer: D

• Question 379:

  Terraform provisioners that require authentication can use the ______ block.

  A. connection

  B. credentials

  C. secrets

  D. ssh

  Correct Answer: A

  https://www.terraform.io/language/resources/provisioners/connection "Most provisioners require access to the remote resource via SSH or WinRM and expect a nested connection block with details about how to connect." "Connection blocks don't take a block label and can be nested within either a resource or a provisioner."

• Question 380:

  You're building a CI/CD (continuous integration/ continuous delivery) pipeline and need to inject sensitive variables into your Terraform run. How can you do this safely?

  A. Pass variables to Terraform with a ar flag

  B. Copy the sensitive variables into your Terraform code

  C. Store the sensitive variables in a secure_vars.tf file

  D. Store the sensitive variables as plain text in a source code repository

  Correct Answer: A

  https://blog.gruntwork.io/a-comprehensive-guide-to-managing-secrets-in-your-terraform-code-1d586955ace1