A team is using the Private Module Registry and needs to ensure that only approved module versions are available for use in workspaces. Which feature should they implement?
A team reports that their Terraform plan is failing because it cannot find a provider version. What is the most likely cause if the provider is in the Private Module Registry?
Your organization uses HCP Terraform with Sentinel policies to enforce governance. A platform engineer needs to run a one-off, high-risk operation that would violate an existing hard-mandatory policy. They have permission to create a new policy set but not to modify or override existing policies. What is the most appropriate way to allow this exception while maintaining auditability?
You are configuring a Sentinel policy set in HCP Terraform to enforce governance across all workspaces in your organization. The policy must evaluate the planned changes before any infrastructure is provisioned. Which enforcement mode should you select to ensure the run pauses for an operator with permission to override the policy if a legitimate exception is needed?
You are managing an HCP Terraform organization with multiple projects. You need to allow a team of developers to create and manage workspaces within the 'development' project, but they must not be able to delete any workspaces or modify workspace settings that affect the entire project. Which TWO actions should you take to achieve this? (Choose two.)
You are configuring HCP Terraform to enforce governance for AWS infrastructure. Which TWO of the following are valid methods to apply a Sentinel policy set to a specific project within an organization? (Choose two.)
Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that a specific variable, 'AWS_REGION', is automatically available to all workspaces in a project named 'core-networking'. Which two actions must you take? (Choose two.)
You are designing a governance strategy for your organization's HCP Terraform workspaces that manage AWS resources. You want to enforce policies that restrict the types of AWS resources that can be provisioned. Which TWO of the following are valid ways to apply Sentinel policies to workspaces? (Choose two.)
Your organization uses HCP Terraform with Sentinel policies to enforce AWS tagging standards. You need to identify which TWO statements accurately describe the behavior of Sentinel policy checks during a run. (Choose two.)
Your organization uses HCP Terraform and wants to allow a team to manage workspaces in a project but prevent them from deleting any workspaces. Which HCP Terraform feature should you use to restrict workspace deletion permissions?
Your organization uses HCP Terraform with AWS. A workspace named `prod-app` is in a project called `Production`. You need to ensure that only runs that originate from the workspace's VCS repository are allowed, and that any local CLI-driven runs are blocked. How should you configure this?
You are managing an HCP Terraform organization with multiple projects. You need to enforce that all workspaces in the 'Production' project use a specific set of AWS credentials stored as a variable set, and that these credentials cannot be overridden. Which two actions should you take? (Choose two.)
You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?
A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?
If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?
Your team uses HCP Terraform to manage AWS infrastructure. You have a workspace that provisions an Amazon RDS instance. You want to ensure that the RDS instance is not publicly accessible. You have written a Sentinel policy that checks the 'publicly_accessible' attribute. However, after enabling the policy, you notice that runs are not being blocked even when the attribute is set to true. What is the most likely reason for the policy not blocking the run?
Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?
You are managing an HCP Terraform organization with multiple workspaces. A security requirement mandates that all workspaces use a specific version of the AWS provider (5.0.0 or later) and that any deviation triggers a notification to the security team. You have configured a Sentinel policy to check the provider version. Which enforcement level should you set for this policy to meet the requirement while allowing developers to proceed with their work if they acknowledge the risk?
Your organization uses HCP Terraform with the AWS provider. A platform team wants to ensure that any workspace in the 'production' project can only use AWS credentials from a pre-approved OIDC role, and that no static AWS access keys are ever stored as workspace variables. Which HCP Terraform feature should you configure to enforce this requirement?
Your organization uses HCP Terraform to manage AWS infrastructure. The security team requires that all runs consuming AWS credentials must be evaluated against a policy that checks the CIDR blocks of any aws_security_group resource. They want the policy to block the run if a CIDR is 0.0.0.0/0. Where should you implement this policy so it is enforced across all workspaces in the organization?
You are configuring run triggers in HCP Terraform to orchestrate a multi-workspace deployment on AWS. Workspace A provisions a VPC and outputs the VPC ID. Workspace B needs to consume that VPC ID to deploy subnets. You want Workspace B to automatically start a run after Workspace A successfully applies. Which configuration should you implement?
You are configuring a Sentinel policy for your HCP Terraform organization. The policy must prevent any Terraform run from creating an AWS S3 bucket without server-side encryption enabled. The policy should block the run if such a bucket is detected, but you want to allow administrators to override the policy in emergency situations. Which enforcement level should you set for the policy?
Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that all workspaces in a specific project automatically inherit a set of environment variables containing AWS credentials. These variables must be available to all runs in those workspaces without manual configuration. What is the most efficient way to achieve this?
Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?
Your organization uses HCP Terraform to manage AWS infrastructure. A platform engineer has been assigned the 'Write' permission on a workspace but is still unable to modify the AWS credentials stored as workspace variables. Which HCP Terraform permission level is required to manage sensitive workspace variables?
Your organization has a Sentinel policy with enforcement level 'soft-mandatory' that checks for required tags on AWS resources. During a run, the policy fails because an EC2 instance is missing the 'Environment' tag. The workspace allows users with write access to override policies. What is the immediate outcome of the run?
Your team uses HCP Terraform to manage AWS infrastructure. You need to allow a specific team of developers to apply changes in a workspace, but you do not want them to be able to modify workspace settings or delete the workspace. Which team permission should you assign to the developers?
You are designing a governance strategy for your HCP Terraform organization. You need to enforce that all AWS resources are tagged with a 'CostCenter' tag. The policy should block any run that creates resources without this tag, but you also want to allow a temporary exception for a migration project. Which combination of Sentinel enforcement level and policy set scoping should you use?
Your organization uses HCP Terraform with Sentinel policies. A policy is configured with an enforcement level of 'hard-mandatory' and checks that all AWS S3 buckets have server-side encryption enabled. A developer runs a plan that includes an unencrypted bucket. What happens when the policy fails?
You are using HCP Terraform with the AWS provider and have configured a policy set with Sentinel policies. A policy fails during a run, and the run is paused. You have the necessary permissions to override the policy. What is the effect of overriding a soft-mandatory policy failure?
Your organization uses HCP Terraform with remote runs. A workspace named 'prod-network' has its execution mode set to Remote. A platform engineer runs `terraform apply` locally after running `terraform plan` on their laptop, but the apply fails with an error because the workspace's state is locked by an active remote run. What is the most likely explanation for this error?
Your team uses HCP Terraform to manage AWS resources. You need to ensure that all workspaces in a project automatically inherit a set of AWS region and tagging variables. What is the most efficient way to achieve this?
Your organization uses HCP Terraform with the AWS provider. You want to share a set of AWS region and tagging variables across all workspaces in a specific project without duplicating them in each workspace. Which HCP Terraform feature should you use?
Your organization uses HCP Terraform with Sentinel policies. A policy set is configured with enforcement level 'hard-mandatory' and includes a policy that checks for the presence of a 'CostCenter' tag on all AWS resources. During a run, the policy fails because a newly added aws_s3_bucket lacks the tag. What happens to the run?
Your organization uses HCP Terraform to manage AWS infrastructure. You need to grant a team the ability to create and manage workspaces within a specific project, but prevent them from deleting the project itself or modifying project-level settings. Which HCP Terraform team permission should you assign?
Your organization uses HCP Terraform with the AWS provider. A Sentinel policy set is attached to the 'production' project with a soft-mandatory policy that checks for required tags on all AWS resources. During a run, the policy fails because a developer forgot to add a 'CostCenter' tag to an EC2 instance. What is the outcome of the run, and what can the developer do?
Your organization uses HCP Terraform with a private module registry. A developer wants to use a module from the registry in a new configuration. The module is versioned and published. What is the correct way to reference this module in the Terraform configuration?