AWS provider HCP Terraform Governance Practice Test 2 — 15 Questions

Question 1

You are configuring HCP Terraform to enforce governance for AWS infrastructure. Which TWO of the following are valid methods to apply a Sentinel policy set to a specific project within an organization? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate the policy set with the project using the HCP Terraform UI.. Policy sets in HCP Terraform can be scoped to projects directly through the UI or via the tfe provider's tfe_policy_set resource with project_ids. These methods allow precise application of Sentinel policies to specific projects. Tag-based matching applies to workspaces, not projects, and modifying policy code or creating separate organizations are not valid scoping mechanisms.

Answer

Modify the Sentinel policy code to check the project name and only enforce if it matches.

Answer

Create a separate organization for each project and apply the policy set there.

Answer

Add a tag to the project and configure the policy set to match that tag.

Question 2

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that a specific variable, 'AWS_REGION', is automatically available to all workspaces in a project named 'core-networking'. Which two actions must you take? (Choose two.)

Accepted Answer

Create a variable set at the project level and add the 'AWS_REGION' variable to it.. To automatically provide a variable to all workspaces in a project, you can create a variable set scoped to that project and add the variable. Alternatively, an organization-level variable set assigned to the project achieves the same. Both methods ensure the variable is available to every workspace in 'core-networking' without per-workspace configuration.

Answer

Define the variable in a 'terraform.tfvars' file in each workspace's VCS repository.

Answer

Use a Sentinel policy to inject the variable into each workspace during runs.

Answer

Add the variable directly to each workspace's variables page.

Question 3

You are designing a governance strategy for your organization's HCP Terraform workspaces that manage AWS resources. You want to enforce policies that restrict the types of AWS resources that can be provisioned. Which TWO of the following are valid ways to apply Sentinel policies to workspaces? (Choose two.)

Accepted Answer

Attach a policy set to individual workspaces.. Policy sets in HCP Terraform can be scoped to projects or individual workspaces. Project-level policy sets apply to all workspaces within the project, while workspace-level policy sets apply to specific workspaces. These are the two valid methods for applying Sentinel policies. Run triggers and variable sets are unrelated to policy enforcement.

Answer

Attach a policy set to a run trigger.

Answer

Attach a policy set to a variable set.

Answer

Attach a policy set to an organization, which applies to all workspaces in the organization.

Question 4

Your organization uses HCP Terraform with Sentinel policies to enforce AWS tagging standards. You need to identify which TWO statements accurately describe the behavior of Sentinel policy checks during a run. (Choose two.)

Accepted Answer

Sentinel policies are evaluated after a plan is generated but before any apply occurs.. Sentinel policies evaluate plan data before apply, enabling pre-deployment enforcement of tagging standards. They can also incorporate cost estimation data when that feature is enabled, allowing cost-based rules. Overrides are restricted to authorized users, and Sentinel uses its own policy language, not HCL.

Answer

Sentinel policies can only be written in HashiCorp Configuration Language (HCL).

Answer

Sentinel policies can be overridden by any user with write access to the workspace.

Answer

Sentinel policies are evaluated only after the apply phase completes.

Question 5

Your organization uses HCP Terraform and wants to allow a team to manage workspaces in a project but prevent them from deleting any workspaces. Which HCP Terraform feature should you use to restrict workspace deletion permissions?

Accepted Answer

Team permissions with a custom role that excludes workspace deletion.. HCP Terraform provides team-based access control with roles that define permissions. To prevent workspace deletion, assign the team a role that lacks the delete permission for workspaces. This allows them to manage workspaces without the ability to delete them, enforcing the desired restriction.

Answer

Sentinel policies that block delete operations on workspaces.

Answer

Workspace locking to prevent any changes, including deletion.

Answer

Organization-level variable sets that restrict deletion via environment variables.

Question 6

Your organization uses HCP Terraform with AWS. A workspace named `prod-app` is in a project called `Production`. You need to ensure that only runs that originate from the workspace's VCS repository are allowed, and that any local CLI-driven runs are blocked. How should you configure this?

Accepted Answer

Enable the 'Remote run' setting and disable 'CLI-driven runs' in the workspace's settings.. To block local CLI runs and allow only VCS-triggered runs, you must enable remote execution and disable CLI-driven runs. This ensures runs are initiated from the VCS repository or the HCP Terraform UI, not from a local machine. The other options either do not restrict run sources or are unrelated to the requirement.

Answer

Configure the workspace's 'Run triggers' to only allow runs from the VCS repository.

Answer

Set the workspace's execution mode to 'Remote' and enable 'VCS trigger' only.

Answer

Enable the 'Remote run' setting in the workspace's general settings.

Question 7

You are managing an HCP Terraform organization with multiple projects. You need to enforce that all workspaces in the 'Production' project use a specific set of AWS credentials stored as a variable set, and that these credentials cannot be overridden. Which two actions should you take? (Choose two.)

Accepted Answer

Assign the variable set to the 'Production' project and ensure it is the only variable set containing AWS credentials.. To enforce that all workspaces in the project use specific AWS credentials and cannot override them, you must create a project-level variable set with the credentials and enable 'Prevent overrides'. Additionally, ensuring that no other variable sets provide conflicting credentials avoids ambiguity. This combination provides centralized, non-overridable configuration.

Answer

Create a variable set at the project level and mark the AWS credentials as 'sensitive'.

Answer

In the project's variable set, set the AWS credentials as 'HCL' and 'sensitive'.

Answer

Create a variable set at the organization level and assign it to the 'Production' project.

Question 8

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'Read' and 'Queue Plan' permissions allow a user to view workspaces and trigger runs, but not modify variables. This follows the principle of least privilege for the required actions.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.

Question 9

Which of the following is a primary benefit of using a Private Module Registry?

Accepted Answer

It allows central management and version control of reusable modules.. A Private Module Registry (available in Terraform Cloud/Enterprise and as a self-hosted registry) provides a centralized, versioned catalog of reusable modules that teams can publish, discover, and consume. It enforces versioning and access control, so consumers pin module versions and get consistent, auditable infrastructure patterns across the organization. This is its primary benefit over ad-hoc Git-based module sourcing.

Answer

It encrypts all Terraform state files.

Answer

It forces all workspaces to use the same module versions.

Answer

It automatically generates cost estimates for all modules.

Question 10

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Accepted Answer

The policy attempts to access cost data before the estimation has completed.. Cost estimation in Terraform Cloud runs asynchronously after the plan. If a Sentinel policy references cost data (e.g., 'tfrun.cost_estimate') before the estimation has completed, the policy will fail because the data is not yet populated. This is the most likely cause when cost estimation is enabled but the policy still fails.

Answer

The cost estimation provider is not configured for AWS.

Answer

The workspace does not have Sentinel enabled.

Answer

The API key for AWS is invalid.

Question 11

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

Accepted Answer

Modifying workspace settings like variable sets and execution modes.. The 'Workspace: Settings' permission in HCP Terraform grants the ability to modify workspace-level configuration, including variable sets, execution modes (remote/local/agent), and other workspace settings. It does not grant run execution or deletion rights. This permission is typically assigned to workspace admins who need to tune how runs behave.

Answer

Viewing plan and apply logs only.

Answer

Triggering runs manually.

Answer

Deleting the workspace.

Question 12

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Accepted Answer

Inside an HCP Terraform Policy Set.. HCP Terraform (formerly Terraform Cloud) Policy Sets use Sentinel or OPA policies to enforce governance rules such as restricting EC2 instance types. You attach a policy set to workspaces or projects, and the policy evaluates the plan before apply, blocking non-compliant resources like instances larger than t3.medium. This is the correct place for cross-cutting, organization-wide enforcement.

Answer

By modifying the Terraform provider source.

Answer

In the Private Module Registry settings.

Answer

Within the workspace's variables.

Question 13

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Accepted Answer

The run pauses and waits for an override.. A soft-mandatory Sentinel policy, when it fails, causes the run to pause and wait for an override. This allows an authorized user to manually approve the run and continue, providing a balance between enforcement and flexibility. This is in contrast to hard-mandatory, which aborts the run immediately.

Answer

The run is immediately aborted.

Answer

The policy is skipped automatically.

Answer

The run completes but triggers an alert.

Question 14

What is the purpose of 'Project' in HCP Terraform?

Accepted Answer

To group workspaces and manage access control for teams.. Projects are used to group workspaces, allowing for easier team permission management and organization.

Answer

To define the Sentinel policies for an environment.

Answer

To store Terraform state files securely.

Answer

To define the cloud provider budget.

Question 15

What happens if a Sentinel policy results in an 'advisory' output?

Accepted Answer

The run logs display a warning, but the process continues.. In HashiCorp Sentinel, policies can be configured with different enforcement levels: advisory, soft-mandatory, and hard-mandatory. When a policy is set to advisory, a failed policy check does not block the run; instead, it logs a warning message and allows the run to proceed. This is by design to provide informational feedback without enforcing compliance. Thus, the correct answer is that the run logs display a warning but the process continues.

Answer

The plan is marked as failed.

Answer

The policy is treated as a hard-mandatory failure.

Answer

The run is paused for manual intervention.