AWS provider HCP Terraform Governance Practice Test 3 — 15 Questions

Question 1

If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?

Accepted Answer

Check the Policy Set configuration and execution logs.. A run stuck in the Policy Check phase means the policy evaluation is either failing, erroring, or awaiting override. The administrator should inspect the Policy Set configuration and the run's policy execution logs to identify which policy is blocking and why. This is the direct diagnostic step before considering overrides or fixes.

Answer

Trigger a new plan.

Answer

Delete and recreate the workspace.

Answer

Disable the policy check.

Question 2

Which type of Sentinel policy is used to block a run without possibility of override?

Accepted Answer

Hard-mandatory.. Sentinel policies in Terraform Cloud/Enterprise have three enforcement levels: advisory, soft-mandatory, and hard-mandatory. A hard-mandatory policy blocks the run outright and cannot be overridden by any user, including organization owners, making it the correct answer for 'block without possibility of override'.

Answer

Advisory.

Answer

Policy-Override.

Answer

Soft-mandatory.

Question 3

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

Accepted Answer

In a Variable Set.. In HCP Terraform (formerly Terraform Cloud), a Variable Set is a named collection of variables that can be applied to multiple workspaces across an organization. Variable Sets are designed specifically to share variables globally or across selected workspaces, making them the correct mechanism for organization-wide variable definitions. They can contain both Terraform variables and environment variables, and can be scoped to all workspaces or a subset.

Answer

In the Private Module Registry.

Answer

In the individual workspace configuration.

Answer

In the organization settings directly.

Question 4

You need to automate the publication of a module to the Private Module Registry. What should you do?

Accepted Answer

Push a release tag to the linked VCS repository.. HCP Terraform's Private Module Registry is VCS-driven: publishing a module happens automatically when you push a new release tag (e.g., v1.0.0) to the repository linked to the registry. The tag triggers the registry to ingest and version the module.

Answer

Run the 'terraform publish' command.

Answer

Manually upload the zip file to the registry.

Answer

Configure a webhook in the workspace settings.

Question 5

If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?

Accepted Answer

Assign teams access at the Project level rather than the Organization level.. HCP Terraform projects group workspaces and let you assign team permissions at the project level, so a team can manage its own workspaces without seeing workspaces in other projects. This scopes access narrowly and satisfies the least-privilege requirement. Organization-level access would grant visibility across all projects, which is exactly what must be prevented.

Answer

Enable 'Organization-wide' access for all teams.

Answer

Use individual workspace permissions instead of projects.

Answer

Create a separate organization for each team.

Question 6

Which of the following can be used to monitor costs in an HCP Terraform workspace?

Accepted Answer

Cost Estimation feature.. HCP Terraform's Cost Estimation feature analyzes the planned resources in a run and estimates the monthly cost using cloud pricing data, displaying it in the run's UI. It is the built-in mechanism for monitoring the financial impact of infrastructure changes before they are applied.

Answer

Terraform State inspection.

Answer

Sentinel Policy sets.

Answer

VCS commit logs.

Question 7

You need to ensure that all workspaces use a specific set of tags. How can this be enforced?

Accepted Answer

Using an HCP Terraform Sentinel policy.. HCP Terraform Sentinel policies are policy-as-code rules that are evaluated during the plan phase of a run. Sentinel policies can inspect the planned state of resources and enforce constraints such as requiring specific tags on all taggable resources. Because Sentinel operates at the organization level and can be applied to all workspaces, it is the correct way to enforce a consistent tagging standard across every workspace.

Answer

Using a VCS branch protection rule.

Answer

Using a variable validation block.

Answer

Enabling 'Strict Mode' in the organization settings.

Question 8

Which of the following is an advantage of using Variable Sets?

Accepted Answer

They centralize variable management to avoid duplication across workspaces.. Variable Sets allow you to define variables once and apply them across multiple workspaces, eliminating duplication and ensuring consistency. They are ideal for shared credentials, common tags, or provider configurations that many workspaces need. This centralization reduces drift and simplifies updates.

Answer

They allow for secret rotation in AWS.

Answer

They automatically run Terraform plans.

Answer

They provide encryption for state files.

Question 9

You want to trigger a run only when a specific file within a module path changes. How do you configure this?

Accepted Answer

Use the 'VCS Triggers' setting in the workspace.. HCP Terraform (formerly Terraform Cloud) workspaces support VCS Triggers, which let you specify file or directory paths so that a run is only queued when changes are detected in those paths. This is the native mechanism for path-based run triggering tied to version control commits.

Answer

Use a 'trigger_path' variable in the Terraform code.

Answer

Modify the '.terraform-version' file.

Answer

Use a Sentinel policy to filter changes.

Question 10

How can you view the detailed breakdown of cost estimates for a specific Terraform plan?

Accepted Answer

Open the run page in the HCP Terraform UI.. The run details page in the HCP Terraform UI displays the cost estimation summary, which can be expanded for details.

Answer

Run the 'terraform show' command on the state file.

Answer

Check the cloud provider's billing dashboard.

Answer

Use the Sentinel CLI tool.

Question 11

Which TWO of the following are true regarding Private Module Registry versioning?

Accepted Answer

Versions must follow Semantic Versioning (SemVer).. Option B is correct because the Private Module Registry enforces Semantic Versioning (SemVer) in the MAJOR.MINOR.PATCH format, so every published module version must be a valid SemVer string. Option E is correct because when a module is connected to a VCS repository, the Registry automatically detects new Git tags that match SemVer and publishes them as module versions without manual upload. Option A is wrong because published versions cannot be freely deleted; deletion is restricted (for example, a version cannot be deleted while it is the only version or is in use). Option C is wrong because a module can have many versions, each identified by its SemVer tag. Option D is wrong because versions are normally created by tagging the linked VCS repository, not by manually uploading files.

Answer

Versions can be deleted at any time without restriction.

Answer

You can only have one version per module.

Answer

Versions are created manually by uploading files.

Question 12

Which TWO of the following are standard stages of an HCP Terraform run pipeline?

Accepted Answer

Policy Check.. Option A (Policy Check) is correct because HCP Terraform's run pipeline includes a Policy Check stage where Sentinel or OPA policies are evaluated against the plan before it can be applied, enforcing governance and compliance. Option C (Plan) is correct because the Plan stage is a core phase of every run, where Terraform generates an execution plan comparing the current state to the desired configuration. The pipeline stages are typically Plan, Policy Check, and Apply, so these two fit the standard sequence. Option B (Code linting) is not a pipeline stage; linting is done externally by tools like tflint or pre-commit hooks, not by HCP Terraform's run workflow. Option D (Automatic refactoring) is not a feature of the run pipeline; Terraform does not automatically rewrite configurations. Option E (State migration) is not a pipeline stage; state migration occurs when changing backends or workspaces, not as a standard run phase.

Answer

Code linting.

Answer

Automatic refactoring.

Answer

State migration.

Question 13

Which THREE of the following items can be included in a Variable Set?

Accepted Answer

Terraform variables.. In Terraform Cloud/Enterprise, a Variable Set is a reusable container of variables that can be applied across multiple workspaces, and it can hold Terraform variables (option A), which are the input variables (e.g., terraform.tfvars-style key/value pairs) consumed by the Terraform configuration during a run. It can also hold environment variables (option B), which are injected into the run environment as shell environment variables (for example, credentials like AWS_ACCESS_KEY_ID or TF_LOG). Additionally, a Variable Set includes a scope definition (option E) that determines whether it applies to the entire Organization or is limited to specific Projects, controlling which workspaces inherit the variables. Terraform provider configurations (option C) are not stored in Variable Sets; providers are configured in the Terraform configuration or via environment variables/credentials, not as a Variable Set item type. Sentinel policy sets (option D) are a separate governance feature managed independently of Variable Sets and are not an includable item within them.

Answer

Terraform provider configurations.

Answer

Sentinel policy sets.

Question 14

Which TWO of the following are required to successfully integrate VCS with HCP Terraform?

Accepted Answer

An OAuth application created in the VCS provider.. Option D is correct because integrating a VCS provider with HCP Terraform requires registering an OAuth application (OAuth client) in the VCS provider, such as GitHub, GitLab, or Bitbucket, so that HCP Terraform can be authorized to access repositories on the organization's behalf. Option E is correct because, after the OAuth credentials (OAuth app ID and secret) are supplied, you must create and configure a VCS connection within the HCP Terraform organization settings, which links the organization to the VCS provider and enables VCS-driven workspaces. Options A and B are incorrect because HCP Terraform communicates with VCS providers over the public internet via HTTPS APIs and webhooks; no direct peering link or AWS-to-HCP Terraform VPN is needed for VCS integration. Option C is incorrect because a static IP address for the organization is not a prerequisite for VCS integration; HCP Terraform's agent and VCS communication do not depend on a fixed organization-level IP.

Answer

A direct peering link.

Answer

A VPN connection between AWS and HCP Terraform.

Answer

A static IP address for the organization.

Question 15

Your team uses HCP Terraform to manage AWS infrastructure. You have a workspace that provisions an Amazon RDS instance. You want to ensure that the RDS instance is not publicly accessible. You have written a Sentinel policy that checks the 'publicly_accessible' attribute. However, after enabling the policy, you notice that runs are not being blocked even when the attribute is set to true. What is the most likely reason for the policy not blocking the run?

Accepted Answer

The policy set is configured with an enforcement level of advisory.. The enforcement level determines whether a failing policy blocks a run. Advisory only logs, soft-mandatory allows override, and hard-mandatory blocks. Since the policy is not blocking, the enforcement level is likely set to advisory.

Answer

The policy is written in Sentinel but the workspace is using Terraform 0.11, which does not support Sentinel.

Answer

The policy is attached to the organization but not to the specific workspace.

Answer

The Sentinel policy is using the wrong import, such as tfplan/v2 instead of tfplan/v3.