Collaborative Workflows

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

You have a Terraform configuration that uses a module from the public registry. How do you ensure your team uses a specific version?

When using 'terraform state mv', what is the impact on the collaboration workflow?

If you need to share output values between workspaces, what is the best practice in HCP Terraform?

What happens if two team members try to apply changes to the same workspace in HCP Terraform simultaneously?

Where can you view the historical state versions in HCP Terraform?

You want to automate the approval process for non-production environments in HCP Terraform. Which setting enables this?

Which TWO of the following are benefits of using HCP Terraform for teams?

Which TWO of the following are true regarding OPA/Sentinel policies?

Which THREE pieces of information are displayed in the HCP Terraform Run UI?

Which TWO types of variables can be set in HCP Terraform?

When troubleshooting a failed plan in HCP Terraform, which THREE sources should you check?

Which THREE components are part of the 'Workspace' object in HCP Terraform?

Which THREE factors influence the choice of using an HCP Terraform Agent?

Your team uses HCP Terraform with a VCS-driven workflow. A developer opens a pull request that modifies a Terraform configuration. You want the plan to run automatically and the results to be visible on the pull request before merging. What should you configure?

Your team maintains a shared Terraform configuration in a GitHub repository. A developer opens a pull request that changes the instance type of a production EC2 instance. You want the change to be automatically validated by running a speculative plan before any human reviews the code. Which HCP Terraform feature should you configure to achieve this?

In HCP Terraform, you have a workspace that uses the CLI-driven workflow. A team member runs terraform apply locally and then pushes the updated state to HCP Terraform. What is the primary benefit of this workflow?

Your organization uses HCP Terraform with a private module registry. A platform team publishes a module that provisions an Amazon RDS instance, and several application teams consume it across different workspaces. The platform team must release a backwards-incompatible change to the module's `engine_version` variable, but they do not want existing consumers to break on their next run. Which two actions should the platform team take to safely version and publish this change? (Choose two.)

You maintain a Terraform configuration in a GitHub repository that provisions AWS infrastructure. Your organization uses HCP Terraform with VCS-driven workspaces. A teammate pushes a commit that modifies `main.tf` in the `production` branch, but you need the change to be reviewed and approved before any infrastructure is modified. What should you configure to enforce this workflow?

Your organization uses HCP Terraform with a VCS-driven workflow. A developer accidentally merges a change to the main branch that modifies a production workspace's Terraform code. The workspace is configured to auto-apply. Which mechanism can prevent the change from being applied immediately?

Two engineers on your team run `terraform apply` against the same HCP Terraform workspace within seconds of each other. The workspace uses remote execution and has no run triggers configured. What does HCP Terraform do to coordinate these concurrent runs?

Your team uses HCP Terraform with a VCS-driven workflow. You have a workspace that deploys to AWS. A developer wants to test a change that modifies an IAM policy without affecting the main branch. They create a feature branch and push changes, but the workspace is configured to track the `main` branch. What is the most appropriate way to allow the developer to test their change in isolation?

Your team uses HCP Terraform with a workspace connected to a GitHub repository. You need to ensure that no changes can be applied to production unless a specific compliance policy passes. The policy should block the apply if it fails, but authorized users should be able to override the failure with a justification. Which Sentinel enforcement level should you use?

Your team uses HCP Terraform with a VCS-connected workspace. A developer pushes a commit to the tracked branch while a plan is already running. What does HCP Terraform do with the newly triggered run by default?

Your team uses HCP Terraform with a VCS-driven workflow. A pull request modifies a module that three separate workspaces consume from a shared private registry. You want reviewers to see the effect of the module change in each consuming workspace before the PR merges, without any state being written. What should you configure?

Your team is using HCP Terraform with a workspace that has a remote backend. A developer runs terraform apply from their local CLI, but the apply fails because the state is locked. Which action should the developer take to resolve the lock and proceed with the apply?

A platform team wants to prevent any workspace in their HCP Terraform organization from provisioning EC2 instances with public IP addresses. They need the policy to block a run before apply whenever a non-compliant plan is detected, and they want the failure reason surfaced to the developer. Which approach meets these requirements?

A team wants to prevent any terraform apply from running in a production workspace unless a specific individual has reviewed and approved the plan. Which HCP Terraform capability should they enable?

You are configuring a new HCP Terraform workspace that uses a VCS connection to a GitHub repository. You want runs to be automatically triggered when changes are pushed to the main branch. Which setting should you enable?

Your organization uses HCP Terraform with several projects. A compliance officer must be able to read the results of every policy evaluation and run across all projects, but must not be able to modify workspaces or trigger runs. Which approach grants exactly these rights?

Your organization is standardizing on HCP Terraform and needs to decide which workspaces should use remote execution with a self-hosted agent pool rather than HCP Terraform's hosted runners. Which TWO conditions justify using a self-hosted agent pool? (Choose two.)

Your team uses a GitHub repository as the VCS connection for an HCP Terraform workspace in the AWS provider organization. A developer pushes a commit that modifies a variable value in `terraform.tfvars` and also touches a file inside a subdirectory that is excluded by the workspace's trigger patterns. Only the subdirectory file is in the trigger pattern exclusion list. What will HCP Terraform do?

Your organization runs HCP Terraform with the AWS provider and wants to enforce a policy that blocks any `aws_s3_bucket` resource lacking a `lifecycle_rule` block. You are authoring a Sentinel policy that uses the `tfplan/v2` import. Which two statements correctly describe how the policy is evaluated and enforced? (Choose two.)

Two engineers on your team both run `terraform apply` against the same HCP Terraform workspace that uses remote state, and their runs overlap in time. The second engineer's apply is rejected with a message that the workspace is locked. Which HCP Terraform behavior explains this outcome?