AWS provider HCP Terraform Governance — 25 Questions

Question 1

When using Cost Estimation in HCP Terraform, which of the following is true?

Accepted Answer

It requires the Terraform provider to support the cost estimation feature.. HCP Terraform uses the current plan to calculate cost impact against the existing state.

Answer

It calculates costs based on real-time AWS billing API calls.

Answer

It applies to all resources, including custom providers.

Answer

It only works for paid HCP Terraform tiers.

Question 2

A team is using the Private Module Registry and needs to ensure that only approved module versions are available for use in workspaces. Which feature should they implement?

Accepted Answer

Use module sharing permissions to manage access to the registry.. Module sharing levels allow teams to restrict access to modules, but 'Module Versioning' and 'Module Status' (beta/deprecated) are the standard ways to manage availability in the Private Module Registry.

Answer

Implement Sentinel policies on the registry.

Answer

Enable auto-publish for all versions.

Answer

Set the module to Private and grant access only to specific organizations.

Question 3

How can you restrict the ability of team members to delete workspaces?

Accepted Answer

Remove the 'Delete' permission from the team's project-level permissions.. RBAC in HCP Terraform is granular. You must ensure users do not have the 'Admin' or 'Delete' permissions on the specific workspace.

Answer

Set the workspace status to 'Locked'.

Answer

Change the workspace execution mode to local.

Answer

Enable 'Prevent Destroy' in Terraform code.

Question 4

What is the result of deleting a Project in HCP Terraform?

Accepted Answer

The workspaces are deleted as well.. Deleting a Project removes the container and all associated workspaces within it.

Answer

The workspaces are moved to a 'default' project.

Answer

The workspaces are unassigned but remain.

Question 5

A team reports that their Terraform plan is failing because it cannot find a provider version. What is the most likely cause if the provider is in the Private Module Registry?

Accepted Answer

The provider is not configured in the 'required_providers' block.. Providers and Modules are different concepts in HCP Terraform. If a provider is required, it must be available in the registry or the provider cache.

Answer

The Private Module Registry does not host providers.

Answer

The workspace is in 'Local' execution mode.

Answer

The organization's subscription does not allow custom providers.

Question 6

In the context of team permissions, what does the 'Admin' role on an organization allow?

Accepted Answer

Full control over all resources in the organization.. The 'Admin' role in an AWS Organization grants full administrative control over all accounts and resources within that organization. This includes the ability to invite accounts, create OUs, apply service control policies (SCPs), and manage billing and security settings across the entire organization. It is the highest level of permission within the organization's management account context, effectively giving the holder complete authority over all member accounts and their resources.

Answer

Permission to create new organizations.

Answer

Read access to logs only.

Answer

Access to view the billing credit card information.

Question 7

Which THREE of the following are benefits of using projects to organize workspaces?

Accepted Answer

Improved workspace discovery.. Option A (Improved workspace discovery) is correct because projects provide a named, scoped container that lets users filter and locate the workspaces relevant to a team or initiative instead of scanning a flat global list. Option B (Simplified RBAC management for teams) is correct because permissions can be granted at the project level, so team-based roles are assigned once to the project and inherited by its workspaces rather than being managed workspace-by-workspace. Option C (Logical grouping for complex organizations) is correct because projects let large organizations map workspaces to business units, environments, or product lines, keeping the hierarchy organized and governable. Option D is not a benefit of projects because plan execution speed is determined by the run environment, parallelism, and provider/infrastructure performance, not by workspace organization. Option E is not a benefit of projects because state backup is handled by state storage configuration and versioning (for example, remote backend versioning), not by grouping workspaces into projects.

Answer

Faster plan execution speeds.

Answer

Automatic state backup.

Question 8

Which TWO of the following are valid ways to trigger a run in an HCP Terraform workspace?

Accepted Answer

Pushing a change to the linked VCS repository.. Option A is correct because HCP Terraform workspaces can be connected to a VCS repository, and pushing a commit to that linked repository automatically triggers a run (plan/apply) through the VCS-driven workflow. Option E is correct because the HCP Terraform UI provides a 'Queue plan' (or Start new run) action that manually triggers a run in the workspace. Option B is incorrect because an API key is used for authentication and API calls, not as a run trigger by itself. Option C is incorrect because directly modifying the state file is not a supported or valid way to trigger a run and can corrupt state. Option D is incorrect because running 'terraform apply' locally executes Terraform on the local machine and does not trigger a run in the HCP Terraform workspace.

Answer

Using a local API key for authentication.

Answer

Modifying the state file directly.

Answer

Executing 'terraform apply' locally.

Question 9

Which THREE of the following are required components of a Sentinel Policy Set?

Accepted Answer

A list of policies.. A Sentinel Policy Set requires a list of policies (B), because the set is fundamentally a grouping of one or more Sentinel policy files that are evaluated together against Terraform runs. It also requires a VCS repository containing the policy code (D), since policy sets are configured in Terraform Cloud/Enterprise by connecting a version control repository that holds the .sentinel policy files. Finally, it requires a defined scope of workspaces (E), because a policy set must be attached to either all workspaces or a specific set of workspaces for enforcement to occur. A paid subscription license key (A) is not a component of a policy set, as policy sets are configured within the platform rather than activated by a license key, and a list of allowed IP addresses (C) is unrelated to Sentinel policy set configuration, which governs policy enforcement rather than network access.

Answer

A paid subscription license key.

Answer

A list of allowed IP addresses.

Question 10

Which TWO of the following scenarios would lead to an 'Error' status in a Terraform run within HCP Terraform?

Accepted Answer

Incorrect AWS credentials preventing plan execution.. Option D is correct because when the AWS provider cannot authenticate with the supplied credentials, the plan phase fails with an authentication error (e.g., InvalidClientTokenId or AuthFailure), and HCP Terraform records the run as errored rather than merely canceled or policy-blocked. Option E is correct because invalid HCL syntax causes Terraform to fail during configuration parsing/validation before any plan can be produced, so the run terminates with an Error status. Option A is not correct because a soft-mandatory Sentinel policy warning is advisory and allows the run to continue, so it does not produce an Error status. Option B is not correct because a hard-mandatory Sentinel policy failure blocks the run with a policy override/failure state rather than the generic Error status. Option C is not correct because a workspace locked by another run causes the new run to wait or be discarded, not to error out.

Answer

A soft-mandatory Sentinel policy warning.

Answer

A hard-mandatory Sentinel policy failure.

Answer

The workspace is locked by another run.

Question 11

Which THREE of the following can be managed using team permissions in HCP Terraform?

Accepted Answer

Project visibility.. Team permissions in HCP Terraform are used to grant teams access to specific resources within an organization. Option A (Project visibility) is correct because teams can be assigned permissions on projects, which controls whether members can view or administer the project and its contents. Option C (Workspace access) is correct because teams can be granted specific workspace-level permissions such as read, plan, or write access to manage workspace operations. Option E (Module Registry access) is correct because teams can be given permissions to publish and consume modules in the private Module Registry. Option B (Global IP firewalling) is not managed via team permissions; IP allowlisting is configured at the organization or API level, not through team permission assignments. Option D (Organization billing limits) is not managed via team permissions; billing and cost limits are handled through organization settings and account ownership, not team-level permissions.

Answer

Global IP firewalling.

Answer

Organization billing limits.

Question 12

Which THREE of the following attributes are available to a Sentinel policy via the 'tfrun' import?

Accepted Answer

User who triggered the run.. The 'tfrun' import in Sentinel exposes metadata about the Terraform run being evaluated, and among the attributes it provides are the identity of the user who triggered the run (Option A), the workspace name (Option D), and the organization name (Option E) — these are all part of the run context that policies commonly use for governance decisions such as restricting who can apply in which workspace or organization. Option B is incorrect because Sentinel policies operate on plan/state data and run metadata, not on provider source code, which is never exposed through 'tfrun'. Option C is incorrect because the raw state file contents are not surfaced via the 'tfrun' import; policies access resource attributes through the structured plan/state data (e.g., 'tfplan' or 'tfstate' imports) rather than raw state file bytes.

Answer

The provider source code.

Answer

The raw state file contents.

Question 13

Your organization uses HCP Terraform with Sentinel policies to enforce governance. A platform engineer needs to run a one-off, high-risk operation that would violate an existing hard-mandatory policy. They have permission to create a new policy set but not to modify or override existing policies. What is the most appropriate way to allow this exception while maintaining auditability?

Accepted Answer

Temporarily remove the workspace from the policy set that contains the hard-mandatory policy, perform the operation, then re-add the workspace and document the change.. Temporarily removing the workspace from the policy set is the only supported way to bypass a hard-mandatory Sentinel policy without altering the policy itself. This action is logged in the audit trail, satisfying the auditability requirement. Other options either do not work due to Sentinel's enforcement model or involve unsupported overrides.

Answer

Create a new policy set containing a policy with an exception for the specific workspace or operation, scoped to that workspace, and ensure it is advisory or soft-mandatory.

Answer

Create a new Sentinel policy with a higher priority that explicitly allows the operation, and add it to a policy set that applies to the workspace.

Answer

Use the HCP Terraform API to mark the specific run as an override, providing a reason that is stored in the audit log.

Question 14

You are configuring a Sentinel policy set in HCP Terraform to enforce governance across all workspaces in your organization. The policy must evaluate the planned changes before any infrastructure is provisioned. Which enforcement mode should you select to ensure the run pauses for an operator with permission to override the policy if a legitimate exception is needed?

Accepted Answer

soft-mandatory. soft-mandatory enforcement blocks a run when a policy fails but permits a user with override permissions to manually approve the run. This balances governance—by preventing automatic deployment—with operational flexibility, allowing exceptions only after review. advisory allows runs to proceed, hard-mandatory provides no override, and audit-only is not a real mode.

Answer

hard-mandatory

Answer

audit-only

Answer

advisory

Question 15

You are managing an HCP Terraform organization with multiple projects. You need to allow a team of developers to create and manage workspaces within the 'development' project, but they must not be able to delete any workspaces or modify workspace settings that affect the entire project. Which TWO actions should you take to achieve this? (Choose two.)

Accepted Answer

Create a custom team with permissions that include workspace creation and management but exclude workspace deletion.. To allow developers to create and manage workspaces without deleting them, you need a combination of permissions and policy enforcement. Assigning a role that includes workspace management but not deletion is challenging because predefined project roles are broad. Using a Sentinel policy to block deletion operations for non-admin teams, combined with a team role that allows workspace creation, achieves the goal. The two correct actions are creating a custom team with the necessary permissions (or using a role that allows creation but not deletion) and enforcing a policy to prevent deletion.

Answer

Assign the team the 'plan' permission on the development project.

Answer

Assign the team the 'admin' permission on the development project.

Answer

Assign the team the 'write' permission on the development project.

Question 16

You are configuring HCP Terraform to enforce governance for AWS infrastructure. Which TWO of the following are valid methods to apply a Sentinel policy set to a specific project within an organization? (Choose two.)

Accepted Answer

Associate the policy set with the project using the HCP Terraform UI.. Policy sets in HCP Terraform can be scoped to projects directly through the UI or via the tfe provider's tfe_policy_set resource with project_ids. These methods allow precise application of Sentinel policies to specific projects. Tag-based matching applies to workspaces, not projects, and modifying policy code or creating separate organizations are not valid scoping mechanisms.

Answer

Modify the Sentinel policy code to check the project name and only enforce if it matches.

Answer

Create a separate organization for each project and apply the policy set there.

Answer

Add a tag to the project and configure the policy set to match that tag.

Question 17

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that a specific variable, 'AWS_REGION', is automatically available to all workspaces in a project named 'core-networking'. Which two actions must you take? (Choose two.)

Accepted Answer

Create a variable set at the project level and add the 'AWS_REGION' variable to it.. To automatically provide a variable to all workspaces in a project, you can create a variable set scoped to that project and add the variable. Alternatively, an organization-level variable set assigned to the project achieves the same. Both methods ensure the variable is available to every workspace in 'core-networking' without per-workspace configuration.

Answer

Define the variable in a 'terraform.tfvars' file in each workspace's VCS repository.

Answer

Use a Sentinel policy to inject the variable into each workspace during runs.

Answer

Add the variable directly to each workspace's variables page.

Question 18

You are designing a governance strategy for your organization's HCP Terraform workspaces that manage AWS resources. You want to enforce policies that restrict the types of AWS resources that can be provisioned. Which TWO of the following are valid ways to apply Sentinel policies to workspaces? (Choose two.)

Accepted Answer

Attach a policy set to individual workspaces.. Policy sets in HCP Terraform can be scoped to projects or individual workspaces. Project-level policy sets apply to all workspaces within the project, while workspace-level policy sets apply to specific workspaces. These are the two valid methods for applying Sentinel policies. Run triggers and variable sets are unrelated to policy enforcement.

Answer

Attach a policy set to a run trigger.

Answer

Attach a policy set to a variable set.

Answer

Attach a policy set to an organization, which applies to all workspaces in the organization.

Question 19

Your organization uses HCP Terraform with Sentinel policies to enforce AWS tagging standards. You need to identify which TWO statements accurately describe the behavior of Sentinel policy checks during a run. (Choose two.)

Accepted Answer

Sentinel policies are evaluated after a plan is generated but before any apply occurs.. Sentinel policies evaluate plan data before apply, enabling pre-deployment enforcement of tagging standards. They can also incorporate cost estimation data when that feature is enabled, allowing cost-based rules. Overrides are restricted to authorized users, and Sentinel uses its own policy language, not HCL.

Answer

Sentinel policies can only be written in HashiCorp Configuration Language (HCL).

Answer

Sentinel policies can be overridden by any user with write access to the workspace.

Answer

Sentinel policies are evaluated only after the apply phase completes.

Question 20

Your organization uses HCP Terraform and wants to allow a team to manage workspaces in a project but prevent them from deleting any workspaces. Which HCP Terraform feature should you use to restrict workspace deletion permissions?

Accepted Answer

Team permissions with a custom role that excludes workspace deletion.. HCP Terraform provides team-based access control with roles that define permissions. To prevent workspace deletion, assign the team a role that lacks the delete permission for workspaces. This allows them to manage workspaces without the ability to delete them, enforcing the desired restriction.

Answer

Sentinel policies that block delete operations on workspaces.

Answer

Workspace locking to prevent any changes, including deletion.

Answer

Organization-level variable sets that restrict deletion via environment variables.