AWS provider Collaborative Workflows Practice Test 2 — 15 Questions

Question 1

You are setting up a new HCP Terraform workspace that will be used by a team of developers. You want to ensure that only members of the 'developers' team can queue plans, but anyone in the organization can view the workspace and its runs. Which workspace permissions configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the workspace access to 'Public' and assign the 'developers' team the 'Plan' permission.. HCP Terraform workspace permissions are managed via teams. The 'Plan' permission allows a team to queue plans but not apply them, which is exactly what the developers need. Setting the workspace access to 'Public' allows all organization members to view the workspace and its runs without additional assignments. This combination provides the required access while adhering to least privilege.

Answer

Set the workspace access to 'Public' and assign the 'developers' team the 'Write' permission.

Answer

Set the workspace access to 'Private' and assign the 'developers' team the 'Write' permission, then add all other organization members as 'Read' users.

Answer

Set the workspace access to 'Public' and assign the 'developers' team the 'Admin' permission.

Question 2

You are setting up a collaborative workflow in HCP Terraform for a team that manages AWS infrastructure. The team wants to ensure that (1) only designated reviewers can approve production applies, and (2) all changes are automatically planned when code is merged to the main branch. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Set the workspace's 'Apply method' to 'Manual apply'.. Manual apply enforces reviewer approval for production applies, while a VCS connection tracking the main branch ensures automatic plans on merge. Auto-apply would bypass approval, read permissions would not allow approvals, and run triggers are for chaining workspaces, not for approval or merge-triggered plans.

Answer

Set up a run trigger from a development workspace to the production workspace.

Answer

Create a team with 'Read' permissions and assign it to the workspace.

Answer

Enable 'Auto-apply' on the workspace.

Question 3

In HCP Terraform, a platform team wants every workspace in a project to consume a centrally managed set of AWS provider credentials, but individual workspace owners must not be able to read or override those credentials. Which configuration satisfies this requirement?

Accepted Answer

Attach a variable set scoped to the project containing the AWS credentials, leave the values unreadable to non-owners, and apply it to all workspaces in the project.. Variable sets scoped to a project deliver shared values to every workspace in that project. When the set belongs to a team whose membership excludes the workspace owners, those owners cannot read or modify the credentials, and the values take precedence in the run environment. This achieves centralized, non-overridable credential distribution without exposing secrets in configuration or module code.

Answer

Define the AWS provider block in a shared module and reference it from every workspace, embedding the credentials in the module source.

Answer

Create an HCP Terraform agent pool in the project and store the AWS credentials as environment variables on the agent, then require all runs to use the agent.

Answer

Store the AWS access key and secret in each workspace's Terraform variables, marked sensitive, and grant owners write access to variables.

Question 4

You are using HCP Terraform's private module registry to share modules across your organization. You want to ensure that consumers of a module can easily discover its requirements and usage. Which TWO of the following should you include in the module's README.md to meet this goal? (Choose two.)

Accepted Answer

The Terraform version and provider version constraints.. A well-documented module README should include the module's input variables with types and descriptions, as well as version constraints for Terraform and providers. These elements allow consumers to understand what inputs are required and whether their environment is compatible. While examples and resource lists are useful, they are secondary to these fundamental details.

Answer

Examples of how to call the module with sample values.

Answer

The full source code of the module for reference.

Answer

A list of all resources that the module will create.

Question 5

Your organization runs HCP Terraform agents in a private network to reach an internal vSphere environment and on-premises databases. A new workspace needs to use a specific agent pool, but the runs currently fail with an error that no agent is available. What should you verify first to resolve this for the workspace?

Accepted Answer

That the workspace's execution mode is set to remote and the workspace is assigned to the correct agent pool.. Agent-based runs require the workspace to use agent execution mode and to be assigned to the correct agent pool. When runs cannot find an agent, the most common cause is that the workspace still uses remote execution or is attached to a different pool than the one running agents in the private network.

Answer

That the agent token has been rotated within the last 24 hours to remain valid.

Answer

That the workspace's Terraform version matches the version the agents were built with.

Answer

That the workspace has been added to a run trigger so it can pull work from the agent pool.

Question 6

You are using HCP Terraform with a workspace that has remote state stored in HCP Terraform. A colleague attempts to run `terraform apply` locally using the same configuration and state. What will happen?

Accepted Answer

The local apply will fail because the state is locked by HCP Terraform, unless the colleague has a valid API token with write access.. HCP Terraform locks remote state and requires authentication via API token for write access. A local apply without a valid token will fail due to the lock or permission denial. It will not silently succeed or create a local state file when remote backend is configured.

Answer

The local apply will succeed and update the remote state, provided the colleague has valid AWS credentials.

Answer

The local apply will succeed but will create a local state file, leaving the remote state unchanged.

Answer

The local apply will automatically use the remote state but will not update it, effectively performing a dry run.

Question 7

You are using Terraform Cloud Agents (self-hosted agents) in HCP Terraform to run Terraform operations in a private network. Which two statements are true regarding agent pools and agent tokens? (Choose two.)

Accepted Answer

An agent pool can be scoped to a specific workspace or to the entire organization.. Agent pools can be organization-wide or workspace-scoped, providing flexibility in how agents are shared. Agents need outbound access to HCP Terraform's API to receive and report on runs. Agent tokens do not expire automatically, and agents can run multiple concurrent jobs if configured. VPC peering is not used because HCP Terraform is a SaaS offering.

Answer

Agent tokens are generated per workspace and must be manually rotated every 30 days.

Answer

Each agent can only execute one run at a time, and additional runs are queued until the agent is free.

Answer

Agent pools require a dedicated VPC peering connection to the HCP Terraform network.

Question 8

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Accepted Answer

To access resources in a private network. HCP Terraform agents run Terraform operations inside your own infrastructure, so they can reach private endpoints such as internal VPCs, on-prem databases, and private APIs that the hosted public execution environment cannot route to. The public runners only have internet-facing egress, so any resource behind a firewall or private DNS is unreachable. Choosing an agent is therefore about network reachability, not speed or cost.

Answer

To increase execution speed

Answer

To bypass OPA policies

Answer

To avoid paying for HCP Terraform

Question 9

You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?

Accepted Answer

input.resource_changes. OPA policies for Terraform evaluate a JSON document that Terraform sends to the policy engine, and the resource attributes live under input.resource_changes. Each entry in that array contains the address, type, and the planned change with after values, so a policy checks input.resource_changes[_].change.after.tags for the CostCenter tag. This is the correct path to access resource attributes.

Answer

terraform.tags

Answer

state.output

Answer

var.tags

Question 10

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. The 'terraform init' command is used to initialize a Terraform working directory, and when migrating from local state to HCP Terraform, it detects the backend configuration change and prompts to migrate the state. This is the standard command to set up the backend and perform the migration. Other commands are not used for this purpose.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 11

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. HCP Terraform workspaces provide isolated environments for infrastructure management, each with its own state, variables, and run history. By using the same configuration files across multiple workspaces, you can deploy to development, staging, and production with environment-specific variables and separate state, achieving the required isolation. This is the standard pattern for multi-environment deployments in HCP Terraform.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 12

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The Read permission set in HCP Terraform grants team members the ability to view workspaces, runs, state, and variables, but it does not include the permission to apply runs or approve plans. Write permission is required to queue applies and approve plans, so Read is the correct choice to allow visibility without approval authority.

Answer

Write

Answer

Admin

Answer

Cost Estimation

Question 13

You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?

Accepted Answer

dynamodb_table. The dynamodb_table parameter in an S3 backend configuration enables state locking by having Terraform write a lock item to a DynamoDB table before any apply, preventing concurrent operations from corrupting the state file. Without it, two simultaneous applies could both read and write the same state object, causing lost updates or inconsistent resource tracking.

Answer

workspace_key_prefix

Answer

kms_key_id

Answer

acl

Question 14

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

Accepted Answer

Configuring Run Triggers in the downstream workspace. Run Triggers in HCP Terraform allow a downstream workspace to automatically queue a run when a specified upstream workspace completes a successful apply. This is the native mechanism for chaining workspaces, ensuring that dependent infrastructure is updated only after its dependencies are provisioned.

Answer

Enabling 'Auto-apply' in the upstream

Answer

Setting a 'TF_VAR' environment variable

Answer

Using a local variable

Question 15

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Accepted Answer

It provides state locking and run history. HCP Terraform (formerly Terraform Cloud) provides remote state management with built-in state locking and run history, which are critical for team collaboration. State locking prevents concurrent runs from corrupting the state file, while run history allows teams to audit changes and roll back if needed. These features are not available with local state, making HCP Terraform a superior choice for teams.

Answer

It converts HCL to JSON

Answer

It eliminates the need for AWS providers

Answer

It is always free