AWS provider HCP Terraform Governance — 15 Questions

Question 1

What is the result of deleting a Project in HCP Terraform?

Accepted Answer

The workspaces are deleted as well.. Deleting a Project removes the container and all associated workspaces within it.

Answer

The workspaces are moved to a 'default' project.

Answer

The workspaces are unassigned but remain.

Question 2

When using Cost Estimation in HCP Terraform, which of the following is true?

Accepted Answer

It requires the Terraform provider to support the cost estimation feature.. HCP Terraform uses the current plan to calculate cost impact against the existing state.

Answer

It calculates costs based on real-time AWS billing API calls.

Answer

It applies to all resources, including custom providers.

Answer

It only works for paid HCP Terraform tiers.

Question 3

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'read' and 'write' permissions are distinct. Specifically, the 'Plan' permission allows triggering runs, while 'Manage' permissions are required for variables.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.

Question 4

Which of the following is a primary benefit of using a Private Module Registry?

Accepted Answer

It allows central management and version control of reusable modules.. The Private Module Registry allows organizations to share verified, reusable infrastructure code internally.

Answer

It encrypts all Terraform state files.

Answer

It forces all workspaces to use the same module versions.

Answer

It automatically generates cost estimates for all modules.

Question 5

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Accepted Answer

The policy attempts to access cost data before the estimation has completed.. Sentinel policies can access the cost estimation data via the 'tfrun' import, but if the estimation is still in progress or failed to generate, the policy will fail.

Answer

The cost estimation provider is not configured for AWS.

Answer

The workspace does not have Sentinel enabled.

Answer

The API key for AWS is invalid.

Question 6

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

Accepted Answer

Modifying workspace settings like variable sets and execution modes.. The 'Settings' permission allows users to modify workspace configurations, including variable sets and notification settings.

Answer

Viewing plan and apply logs only.

Answer

Triggering runs manually.

Answer

Deleting the workspace.

Question 7

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Accepted Answer

Inside an HCP Terraform Policy Set.. Sentinel policies are written in HCL and uploaded to Policy Sets, which are then associated with workspaces.

Answer

By modifying the Terraform provider source.

Answer

In the Private Module Registry settings.

Answer

Within the workspace's variables.

Question 8

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Accepted Answer

The run pauses and waits for an override.. Soft-mandatory policies allow a user with the appropriate permissions to override the failure and continue the run.

Answer

The run is immediately aborted.

Answer

The policy is skipped automatically.

Answer

The run completes but triggers an alert.

Question 9

A team is using the Private Module Registry and needs to ensure that only approved module versions are available for use in workspaces. Which feature should they implement?

Accepted Answer

Use module sharing permissions to manage access to the registry.. Module sharing levels allow teams to restrict access to modules, but 'Module Versioning' and 'Module Status' (beta/deprecated) are the standard ways to manage availability in the Private Module Registry.

Answer

Implement Sentinel policies on the registry.

Answer

Enable auto-publish for all versions.

Answer

Set the module to Private and grant access only to specific organizations.

Question 10

What is the purpose of 'Project' in HCP Terraform?

Accepted Answer

To group workspaces and manage access control for teams.. Projects are used to group workspaces, allowing for easier team permission management and organization.

Answer

To define the Sentinel policies for an environment.

Answer

To store Terraform state files securely.

Answer

To define the cloud provider budget.

Question 11

What happens if a Sentinel policy results in an 'advisory' output?

Accepted Answer

The run logs display a warning, but the process continues.. Advisory policies provide information or warnings in the run logs but do not block the execution.

Answer

The plan is marked as failed.

Answer

The policy is treated as a hard-mandatory failure.

Answer

The run is paused for manual intervention.

Question 12

If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?

Accepted Answer

Check the Policy Set configuration and execution logs.. If the policy check is stuck, it may indicate a timeout or an issue with the policy engine execution environment.

Answer

Trigger a new plan.

Answer

Delete and recreate the workspace.

Answer

Disable the policy check.

Question 13

Which type of Sentinel policy is used to block a run without possibility of override?

Accepted Answer

Hard-mandatory.. Hard-mandatory policies require the policy to pass before the run can proceed; they cannot be overridden.

Answer

Advisory.

Answer

Policy-Override.

Answer

Soft-mandatory.

Question 14

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

Accepted Answer

In a Variable Set.. Variable Sets allow you to group variables and apply them across multiple workspaces simultaneously.

Answer

In the Private Module Registry.

Answer

In the individual workspace configuration.

Answer

In the organization settings directly.

Question 15

You need to automate the publication of a module to the Private Module Registry. What should you do?

Accepted Answer

Push a release tag to the linked VCS repository.. HCP Terraform monitors your VCS repository; when you push a new release tag (e.g., v1.0.0), it automatically triggers the publication to the registry.

Answer

Run the 'terraform publish' command.

Answer

Manually upload the zip file to the registry.

Answer

Configure a webhook in the workspace settings.