AWS provider HCP Terraform Governance — 10 Questions

Question 1

What is the result of deleting a Project in HCP Terraform?

Accepted Answer

The workspaces are deleted as well.. Deleting a Project removes the container and all associated workspaces within it.

Answer

The workspaces are moved to a 'default' project.

Answer

The workspaces are unassigned but remain.

Question 2

When using Cost Estimation in HCP Terraform, which of the following is true?

Accepted Answer

It requires the Terraform provider to support the cost estimation feature.. HCP Terraform uses the current plan to calculate cost impact against the existing state.

Answer

It calculates costs based on real-time AWS billing API calls.

Answer

It applies to all resources, including custom providers.

Answer

It only works for paid HCP Terraform tiers.

Question 3

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'read' and 'write' permissions are distinct. Specifically, the 'Plan' permission allows triggering runs, while 'Manage' permissions are required for variables.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.

Question 4

Which of the following is a primary benefit of using a Private Module Registry?

Accepted Answer

It allows central management and version control of reusable modules.. The Private Module Registry allows organizations to share verified, reusable infrastructure code internally.

Answer

It encrypts all Terraform state files.

Answer

It forces all workspaces to use the same module versions.

Answer

It automatically generates cost estimates for all modules.

Question 5

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Accepted Answer

The policy attempts to access cost data before the estimation has completed.. Sentinel policies can access the cost estimation data via the 'tfrun' import, but if the estimation is still in progress or failed to generate, the policy will fail.

Answer

The cost estimation provider is not configured for AWS.

Answer

The workspace does not have Sentinel enabled.

Answer

The API key for AWS is invalid.

Question 6

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

Accepted Answer

Modifying workspace settings like variable sets and execution modes.. The 'Settings' permission allows users to modify workspace configurations, including variable sets and notification settings.

Answer

Viewing plan and apply logs only.

Answer

Triggering runs manually.

Answer

Deleting the workspace.

Question 7

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Accepted Answer

Inside an HCP Terraform Policy Set.. Sentinel policies are written in HCL and uploaded to Policy Sets, which are then associated with workspaces.

Answer

By modifying the Terraform provider source.

Answer

In the Private Module Registry settings.

Answer

Within the workspace's variables.

Question 8

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Accepted Answer

The run pauses and waits for an override.. Soft-mandatory policies allow a user with the appropriate permissions to override the failure and continue the run.

Answer

The run is immediately aborted.

Answer

The policy is skipped automatically.

Answer

The run completes but triggers an alert.

Question 9

A team is using the Private Module Registry and needs to ensure that only approved module versions are available for use in workspaces. Which feature should they implement?

Accepted Answer

Use module sharing permissions to manage access to the registry.. Module sharing levels allow teams to restrict access to modules, but 'Module Versioning' and 'Module Status' (beta/deprecated) are the standard ways to manage availability in the Private Module Registry.

Answer

Implement Sentinel policies on the registry.

Answer

Enable auto-publish for all versions.

Answer

Set the module to Private and grant access only to specific organizations.

Question 10

What is the purpose of 'Project' in HCP Terraform?

Accepted Answer

To group workspaces and manage access control for teams.. Projects are used to group workspaces, allowing for easier team permission management and organization.

Answer

To define the Sentinel policies for an environment.

Answer

To store Terraform state files securely.

Answer

To define the cloud provider budget.