You have a team-based collaboration project. Where should you store sensitive credentials like AWS secret keys so they are not hardcoded in your Terraform files?
You have accidentally committed a secret to your VCS repository. After rotating the secret, what is the best practice to ensure it is not used in your workspace?
You are configuring a policy set in HCP Terraform using Sentinel. You want to enforce that all AWS EC2 instances have a specific tag, but you also want to allow an override for emergency changes with a documented approval. Which TWO Sentinel features should you use to achieve this? (Choose two.)
Your team uses HCP Terraform with remote state and run triggers. A run in workspace 'networking' completes successfully and triggers a run in 'application'. The application run plans and applies correctly, but the networking team later discovers that the application run used an outdated state of networking outputs because the run trigger fired before the state was fully persisted. What is the most likely cause?
You are setting up a collaborative workflow in HCP Terraform where multiple teams will manage infrastructure across several AWS accounts. You need to ensure that team members can run plans but cannot apply changes without approval. Which TWO configurations should you implement? (Choose two.)
You are using HCP Terraform with a VCS-driven workflow. A developer pushes a commit to the main branch, triggering a run. The run's plan succeeds, but the apply fails due to a transient AWS API error. What should you do to retry the apply without re-running the plan?
You are setting up a new HCP Terraform workspace that will be used by a team of developers. You want to ensure that only members of the 'developers' team can queue plans, but anyone in the organization can view the workspace and its runs. Which workspace permissions configuration should you use?
You are setting up a collaborative workflow in HCP Terraform for a team that manages AWS infrastructure. The team wants to ensure that (1) only designated reviewers can approve production applies, and (2) all changes are automatically planned when code is merged to the main branch. Which TWO configurations should you implement? (Choose two.)
In HCP Terraform, a platform team wants every workspace in a project to consume a centrally managed set of AWS provider credentials, but individual workspace owners must not be able to read or override those credentials. Which configuration satisfies this requirement?
You are using HCP Terraform's private module registry to share modules across your organization. You want to ensure that consumers of a module can easily discover its requirements and usage. Which TWO of the following should you include in the module's README.md to meet this goal? (Choose two.)
Your organization runs HCP Terraform agents in a private network to reach an internal vSphere environment and on-premises databases. A new workspace needs to use a specific agent pool, but the runs currently fail with an error that no agent is available. What should you verify first to resolve this for the workspace?
You are using HCP Terraform with a workspace that has remote state stored in HCP Terraform. A colleague attempts to run `terraform apply` locally using the same configuration and state. What will happen?
You are using Terraform Cloud Agents (self-hosted agents) in HCP Terraform to run Terraform operations in a private network. Which two statements are true regarding agent pools and agent tokens? (Choose two.)
You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?
Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?
You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?
A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?
Your team uses HCP Terraform with a VCS-driven workflow. A developer opens a pull request that modifies a Terraform configuration. You want the plan to run automatically and the results to be visible on the pull request before merging. What should you configure?
Your team maintains a shared Terraform configuration in a GitHub repository. A developer opens a pull request that changes the instance type of a production EC2 instance. You want the change to be automatically validated by running a speculative plan before any human reviews the code. Which HCP Terraform feature should you configure to achieve this?
In HCP Terraform, you have a workspace that uses the CLI-driven workflow. A team member runs terraform apply locally and then pushes the updated state to HCP Terraform. What is the primary benefit of this workflow?
Your organization uses HCP Terraform with a private module registry. A platform team publishes a module that provisions an Amazon RDS instance, and several application teams consume it across different workspaces. The platform team must release a backwards-incompatible change to the module's `engine_version` variable, but they do not want existing consumers to break on their next run. Which two actions should the platform team take to safely version and publish this change? (Choose two.)
You maintain a Terraform configuration in a GitHub repository that provisions AWS infrastructure. Your organization uses HCP Terraform with VCS-driven workspaces. A teammate pushes a commit that modifies `main.tf` in the `production` branch, but you need the change to be reviewed and approved before any infrastructure is modified. What should you configure to enforce this workflow?
Your organization uses HCP Terraform with a VCS-driven workflow. A developer accidentally merges a change to the main branch that modifies a production workspace's Terraform code. The workspace is configured to auto-apply. Which mechanism can prevent the change from being applied immediately?
Two engineers on your team run `terraform apply` against the same HCP Terraform workspace within seconds of each other. The workspace uses remote execution and has no run triggers configured. What does HCP Terraform do to coordinate these concurrent runs?
Your team uses HCP Terraform with a VCS-driven workflow. You have a workspace that deploys to AWS. A developer wants to test a change that modifies an IAM policy without affecting the main branch. They create a feature branch and push changes, but the workspace is configured to track the `main` branch. What is the most appropriate way to allow the developer to test their change in isolation?
Your team uses HCP Terraform with a workspace connected to a GitHub repository. You need to ensure that no changes can be applied to production unless a specific compliance policy passes. The policy should block the apply if it fails, but authorized users should be able to override the failure with a justification. Which Sentinel enforcement level should you use?
Your team uses HCP Terraform with a VCS-connected workspace. A developer pushes a commit to the tracked branch while a plan is already running. What does HCP Terraform do with the newly triggered run by default?
Your team uses HCP Terraform with a VCS-driven workflow. A pull request modifies a module that three separate workspaces consume from a shared private registry. You want reviewers to see the effect of the module change in each consuming workspace before the PR merges, without any state being written. What should you configure?
Your team is using HCP Terraform with a workspace that has a remote backend. A developer runs terraform apply from their local CLI, but the apply fails because the state is locked. Which action should the developer take to resolve the lock and proceed with the apply?
A platform team wants to prevent any workspace in their HCP Terraform organization from provisioning EC2 instances with public IP addresses. They need the policy to block a run before apply whenever a non-compliant plan is detected, and they want the failure reason surfaced to the developer. Which approach meets these requirements?
A team wants to prevent any terraform apply from running in a production workspace unless a specific individual has reviewed and approved the plan. Which HCP Terraform capability should they enable?
You are configuring a new HCP Terraform workspace that uses a VCS connection to a GitHub repository. You want runs to be automatically triggered when changes are pushed to the main branch. Which setting should you enable?
Your organization uses HCP Terraform with several projects. A compliance officer must be able to read the results of every policy evaluation and run across all projects, but must not be able to modify workspaces or trigger runs. Which approach grants exactly these rights?
Your organization is standardizing on HCP Terraform and needs to decide which workspaces should use remote execution with a self-hosted agent pool rather than HCP Terraform's hosted runners. Which TWO conditions justify using a self-hosted agent pool? (Choose two.)
Your team uses a GitHub repository as the VCS connection for an HCP Terraform workspace in the AWS provider organization. A developer pushes a commit that modifies a variable value in `terraform.tfvars` and also touches a file inside a subdirectory that is excluded by the workspace's trigger patterns. Only the subdirectory file is in the trigger pattern exclusion list. What will HCP Terraform do?
Your organization runs HCP Terraform with the AWS provider and wants to enforce a policy that blocks any `aws_s3_bucket` resource lacking a `lifecycle_rule` block. You are authoring a Sentinel policy that uses the `tfplan/v2` import. Which two statements correctly describe how the policy is evaluated and enforced? (Choose two.)
Two engineers on your team both run `terraform apply` against the same HCP Terraform workspace that uses remote state, and their runs overlap in time. The second engineer's apply is rejected with a message that the workspace is locked. Which HCP Terraform behavior explains this outcome?