HashiCorp HashiCorp Certifications TERRAFORM-ASSOCIATE-003 Questions & Answers

• Question 101:

  One remote backend configuration always maps to a single remote workspace.

  A. True

  B. False

  Correct Answer: A

  The remote backend can work with either a single remote Terraform Cloud workspace, or with multiple similarly-named remote workspaces (like networking-dev and networking-prod). The workspaces block of the backend configuration determines which mode it uses. To use a single remote Terraform Cloud workspace, set workspaces.name to the remote workspace's full name (like networking-prod). To use multiple remote workspaces, set workspaces.prefix to a prefix used in all of the desired remote workspace names. For example, set prefix = "networking-" to use Terraform cloud workspaces with names like networking-dev and networking-prod. This is helpful when mapping multiple Terraform CLI workspaces used in a single Terraform configuration to multiple Terraform Cloud workspaces3. However, one remote backend configuration always maps to a single remote workspace, either by name or by prefix. You cannot use both name and prefix in the same backend configuration, or omit both. Doing so will result in a configuration error3. References = [Backend Type: remote]3

• Question 102:

  Which command add existing resources into Terraform state?

  A. Terraform init

  B. Terraform plan

  C. Terraform refresh

  D. Terraform import

  E. All of these

  Correct Answer: D

  This is the command that can add existing resources into Terraform state, by matching them with the corresponding configuration blocks in your files.

• Question 103:

  A terraform apply can not _________ infrastructure.

  A. change

  B. destroy

  C. provision

  D. import

  Correct Answer: D

  The terraform import command is used to import existing infrastructure into Terraform's state. This allows Terraform to manage and destroy the imported infrastructure as part of the configuration. The terraform import command does not modify the configuration, so the imported resources must be manually added to the configuration after the import. References = [Importing Infrastructure]

• Question 104:

  You have never used Terraform before and would like to test it out using a shared team account for a cloud provider. The shared team account already contains 15 virtual machines (VM). You develop a Terraform configuration containing one VM. perform terraform apply, and see that your VM was created successfully. What should you do to delete the newly-created VM with Terraform?

  A. The Terraform state file contains all 16 VMs in the team account. Execute terraform destroy and select the newly-created VM.

  B. Delete the Terraform state file and execute terraform apply.

  C. The Terraform state file only contains the one new VM. Execute terraform destroy.

  D. Delete the VM using the cloud provider console and terraform apply to apply the changes to the Terraform state file.

  Correct Answer: C

  This is the best way to delete the newly-created VM with Terraform, as it will only affect the resource that was created by your configuration and state file. The other options are either incorrect or inefficient.

• Question 105:

  You can configure Terraform to log to a file using the TF_LOG environment variable.

  A. True

  B. False

  Correct Answer: A

  You can configure Terraform to log to a file using the TF_LOG environment variable. This variable can be set to one of the log levels: TRACE, DEBUG, INFO, WARN or ERROR. You can also use the TF_LOG_PATH environment variable to specify a custom log file location. References = : Debugging Terraform

• Question 106:

  Your risk management organization requires that new AWS S3 buckets must be private and encrypted at rest. How can Terraform Cloud automatically and proactively enforce this security control?

  A. Auditing cloud storage buckets with a vulnerability scanning tool

  B. By adding variables to each Terraform Cloud workspace to ensure these settings are always enabled

  C. With an S3 module with proper settings for buckets

  D. With a Sentinel policy, which runs before every apply

  Correct Answer: D

  The best way to automatically and proactively enforce the security control that new AWS S3 buckets must be private and encrypted at rest is with a Sentinel policy, which runs before every apply. Sentinel is a policy as code framework that allows you to define and enforce logic-based policies for your infrastructure. Terraform Cloud supports Sentinel policies for all paid tiers, and can run them before any terraform plan or terraform apply operation. You can write a Sentinel policy that checks the configuration of the S3 buckets and ensures that they have the proper settings for privacy and encryption, and then assign the policy to your Terraform Cloud organization or workspace. This way, Terraform Cloud will prevent any changes that violate the policy from being applied. References = [Sentinel Policy Framework], [Manage Policies in Terraform Cloud], [Write and Test Sentinel Policies for Terraform]

• Question 107:

  When using a remote backend or terraform Cloud integration, where does Terraform save resource sate?

  A. In an environment variable

  B. On the disk

  C. In the remote backend or Terraform Cloud

  D. In memory

  Correct Answer: C

  This is where Terraform saves resource state when using a remote backend or Terraform Cloud integration, as it allows you to store and manage your state file in a remote location, such as a cloud storage service or Terraform Cloud's servers. This enables collaboration, security, and scalability for your Terraform infrastructure.

• Question 108:

  Which Terraform collection type should you use to store key/value pairs?

  A. Set

  B. Map

  C. Tuple

  D. list

  Correct Answer: B

  The Terraform collection type that should be used to store key/value pairs is map. A map is a collection of values that are accessed by arbitrary labels, called keys. The keys and values can be of any type, but the keys must be unique within a map. For example, var = { key1 = "value1", key2 = "value2" } is a map with two key/value pairs. Maps are useful for grouping related values together, such as configuration options or metadata. References = [Collection Types], [Map Type Constraints]

• Question 109:

  How does the Terraform cloud integration differ from other state backends such as S3, Consul,etc?

  A. It can execute Terraform runs on dedicated infrastructure in Terraform Cloud

  B. It doesn't show the output of a terraform apply locally

  C. It is only arable lo paying customers

  D. All of the above

  Correct Answer: A

  This is how the Terraform Cloud integration differs from other state backends such as S3, Consul, etc., as it allows you to perform remote operations on Terraform Cloud's servers instead of your local machine. The other options are either incorrect or irrelevant.

• Question 110:

  Running terraform fmt without any flags in a directory with Terraform configuration files check the formatting of those files without changing their contents.

  A. True

  B. False

  Correct Answer: B

  Running terraform fmt without any flags in a directory with Terraform configuration files will not check the formatting of those files without changing their contents, but will actually rewrite them to a canonical format and style. If you want to check the formatting without making changes, you need to use the -check flag.