AWS provider Practice Test 17 — 15 Questions

Question 1

Which TWO of the following are required to successfully integrate VCS with HCP Terraform?

Accepted Answer

An OAuth application created in the VCS provider.. Option D is correct because integrating a VCS provider with HCP Terraform requires registering an OAuth application (OAuth client) in the VCS provider, such as GitHub, GitLab, or Bitbucket, so that HCP Terraform can be authorized to access repositories on the organization's behalf. Option E is correct because, after the OAuth credentials (OAuth app ID and secret) are supplied, you must create and configure a VCS connection within the HCP Terraform organization settings, which links the organization to the VCS provider and enables VCS-driven workspaces. Options A and B are incorrect because HCP Terraform communicates with VCS providers over the public internet via HTTPS APIs and webhooks; no direct peering link or AWS-to-HCP Terraform VPN is needed for VCS integration. Option C is incorrect because a static IP address for the organization is not a prerequisite for VCS integration; HCP Terraform's agent and VCS communication do not depend on a fixed organization-level IP.

Answer

A direct peering link.

Answer

A VPN connection between AWS and HCP Terraform.

Answer

A static IP address for the organization.

Question 2

Where do module outputs appear after a 'terraform apply'?

Accepted Answer

In the CLI output and the state file.. After 'terraform apply', module outputs are displayed in the CLI output (as part of the apply summary) and are persisted in the Terraform state file. The state file records output values so they can be referenced by other configurations or retrieved later via 'terraform output'.

Answer

In a file named 'outputs.json'.

Answer

They are automatically emailed to the Terraform administrator.

Answer

In the '.terraform/modules' directory.

Question 3

What happens if you use a dynamic block with a 'for_each' expression that evaluates to an empty set?

Accepted Answer

It renders no blocks. Terraform's dynamic blocks iterate over the collection given to 'for_each'; if that collection is empty (empty set, list, or map), the iterator produces zero iterations and therefore zero nested blocks are rendered. This is the documented and intended behaviour, allowing conditional block generation without 'count' hacks.

Answer

It pauses execution and waits for input

Answer

It throws a configuration error

Answer

It generates a single block with null values

Question 4

How do you pass a provider instance from a root module into a child module?

Accepted Answer

Use the 'providers' map in the module block.. The providers map inside a module block explicitly passes a configured provider instance (or alias) from the root module into the child module, allowing the child to use a specific provider configuration rather than inheriting the default. This is required when the child module needs a non-default provider alias, a differently configured region, or a provider defined only in the parent. The syntax is providers = { aws = aws.us_east_1 } inside the module block.

Answer

Use a module output.

Answer

Use a variable.

Answer

You cannot pass providers.

Question 5

You are creating a Terraform module that will be used by multiple teams. You want to ensure that the module is reusable and maintainable. Which TWO practices should you follow when designing the module's interface? (Choose two.)

Accepted Answer

Validate variable inputs using validation blocks where appropriate.. Descriptive variable names with descriptions and validation blocks are key to a well-designed module interface. They enhance clarity, usability, and error prevention. Avoiding type any and unnecessary defaults or outputs keeps the module focused and secure. These practices make the module easier to understand, use, and maintain across teams.

Answer

Expose outputs for all resources created by the module.

Answer

Use a single variable of type any to accept all inputs for simplicity.

Answer

Provide default values for all variables to make the module easy to use.

Question 6

What is the primary function of the 'source' attribute in the 'required_providers' block?

Accepted Answer

To specify the registry address.. The 'source' attribute in the 'required_providers' block specifies the global source address of the provider, which is the registry hostname, namespace, and type. This tells Terraform where to download the provider from, such as 'hashicorp/aws' or 'registry.terraform.io/hashicorp/aws'. It does not define a local path or region.

Answer

To define the local path of the provider code.

Answer

To define the AWS region.

Answer

To enable debugging.

Question 7

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Accepted Answer

Inside an HCP Terraform Policy Set.. HCP Terraform (formerly Terraform Cloud) Policy Sets use Sentinel or OPA policies to enforce governance rules such as restricting EC2 instance types. You attach a policy set to workspaces or projects, and the policy evaluates the plan before apply, blocking non-compliant resources like instances larger than t3.medium. This is the correct place for cross-cutting, organization-wide enforcement.

Answer

By modifying the Terraform provider source.

Answer

In the Private Module Registry settings.

Answer

Within the workspace's variables.

Question 8

You are using Terraform to manage an AWS EC2 instance. During a planned update, you expect the instance to be destroyed and recreated because of a change to the user_data attribute. However, you want to ensure that the old instance is destroyed only after the new instance is successfully created, to minimize downtime. Which lifecycle meta-argument should you add to the aws_instance resource?

Accepted Answer

create_before_destroy = true. The create_before_destroy meta-argument is the correct choice because it instructs Terraform to create the replacement resource before destroying the existing one, minimizing downtime. The other options either prevent destruction, ignore the change, or trigger replacement without controlling order.

Answer

ignore_changes = [user_data]

Answer

replace_triggered_by = [aws_instance.example]

Answer

prevent_destroy = true

Question 9

You need to automate the publication of a module to the Private Module Registry. What should you do?

Accepted Answer

Push a release tag to the linked VCS repository.. HCP Terraform's Private Module Registry is VCS-driven: publishing a module happens automatically when you push a new release tag (e.g., v1.0.0) to the repository linked to the registry. The tag triggers the registry to ingest and version the module.

Answer

Run the 'terraform publish' command.

Answer

Manually upload the zip file to the registry.

Answer

Configure a webhook in the workspace settings.

Question 10

A module author wants to prevent callers from accidentally overriding a critical naming convention. The module already computes a `bucket_name` local. The author wants to expose it to callers without allowing them to set it. Which approach correctly enforces this behavior?

Accepted Answer

Declare the value as a local and expose it through an output block so callers can reference it read-only.. Input variables are inherently caller-controlled, so any value that must remain fixed belongs in a local and is shared outward through an output. Outputs are read-only references from the caller's perspective, meaning the module can publish `bucket_name` without offering a mechanism to override it. Validation and sensitivity flags affect acceptance and display, not write protection.

Answer

Declare the value as an input variable marked `sensitive = true` so callers cannot read or modify it.

Answer

Declare the value as an input variable with `nullable = false` and a validation block that rejects changes.

Answer

Declare the value as an input variable with a default, and document that callers should not change it.

Question 11

A platform team maintains a shared Terraform module that must run in three AWS regions simultaneously within a single root configuration. The module itself declares only a generic `aws` provider requirement with no alias, and the team wants each module instance to use a different region without editing the module source. Which configuration approach satisfies this requirement?

Accepted Answer

Declare one aliased provider per region in the root module, then pass the matching provider configuration into each module block using the `providers` argument.. Provider configurations are defined once, typically in the root module, and child modules receive them through the `providers` argument on the module block. Declaring aliased aws providers for each region and mapping each module instance to the appropriate one lets a single root configuration deploy the same module across multiple regions while the module source stays generic.

Answer

Add an `alias` argument inside the shared module's terraform block so the module can select its own region at runtime.

Answer

Create three separate root modules, one per region, and invoke the shared module from each with a different workspace.

Answer

Set the `region` argument directly on the module block so Terraform forwards it to the module's implicit aws provider.

Question 12

Your organization uses HCP Terraform with the AWS provider. A platform team wants to ensure that any workspace in the 'production' project can only use AWS credentials from a pre-approved OIDC role, and that no static AWS access keys are ever stored as workspace variables. Which HCP Terraform feature should you configure to enforce this requirement?

Accepted Answer

Policy sets with a Sentinel policy that inspects the run's variables and blocks runs if any AWS access key variables are present.. Sentinel policy sets are the governance mechanism in HCP Terraform that can evaluate run context, including variables and plan data, and enforce rules such as disallowing static AWS access keys. Attaching the policy set to the production project ensures every run in that project is checked, providing the required guardrail without relying on manual review.

Answer

A team API token with read-only permissions on the production project.

Answer

Run triggers that automatically start a run whenever the AWS credentials in the workspace are modified.

Answer

Workspace variable sets with the 'sensitive' flag enabled for all AWS credential variables.

Question 13

Your organization uses HCP Terraform to manage AWS infrastructure. The security team requires that all runs consuming AWS credentials must be evaluated against a policy that checks the CIDR blocks of any aws_security_group resource. They want the policy to block the run if a CIDR is 0.0.0.0/0. Where should you implement this policy so it is enforced across all workspaces in the organization?

Accepted Answer

Create a Sentinel policy in the organization's policy sets and assign it to all workspaces.. Sentinel policies in HCP Terraform are managed at the organization level and can be applied to all workspaces through policy sets. They evaluate the Terraform plan and can block runs that violate rules, such as allowing 0.0.0.0/0 in security group CIDRs. This provides centralized, consistent enforcement across the organization.

Answer

Define an AWS IAM policy that denies the CreateSecurityGroup action when the CIDR is 0.0.0.0/0.

Answer

Use Terraform's built-in validation blocks in the aws_security_group resource to reject 0.0.0.0/0.

Answer

Configure a pre-plan run task that runs a script to check the Terraform configuration for 0.0.0.0/0.

Question 14

What is the purpose of the 'terraform providers lock' command?

Accepted Answer

To secure the provider versions and checksums.. The 'terraform providers lock' command is used to update the dependency lock file (.terraform.lock.hcl) with the checksums of provider packages. It ensures that the provider versions and their checksums are recorded, which helps in verifying the integrity of providers during subsequent init operations. This is particularly useful in air-gapped environments or when you want to ensure consistent provider versions across teams.

Answer

To encrypt the state file.

Answer

To prevent others from running init.

Answer

To download all providers.

Question 15

A module outputs an AWS S3 bucket name. The root configuration needs to pass this output to another module as an input variable. How should the root configuration reference the output from the first module?

Accepted Answer

module.bucket.bucket_name. Module outputs are referenced using the module.. syntax. This allows the root configuration to consume values from child modules and pass them to other modules or resources. The other options refer to different constructs: output blocks declare root outputs, var references input variables, and terraform_remote_state accesses external state files. The correct syntax is module.bucket.bucket_name.

Answer

var.bucket.bucket_name

Answer

output.bucket.bucket_name

Answer

data.terraform_remote_state.bucket.bucket_name