AWS provider HCP Terraform Governance Practice Test 4 — 15 Questions

Question 1

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Variable Set at the organization level containing the AWS credentials as environment variables, and apply it to all workspaces.. Organization-level Variable Sets are designed to share variables across multiple workspaces, including sensitive credentials. By defining AWS access keys as environment variables in a variable set and applying it to all workspaces, you ensure every run has the necessary credentials without manual intervention. This approach centralizes management and reduces configuration drift.

Answer

Configure the AWS provider to use the default credential chain, which will automatically retrieve credentials from HCP Terraform's environment.

Answer

Create a Sentinel policy that injects the AWS credentials into each run's environment before execution.

Answer

Store the AWS credentials in a Terraform Cloud API token and reference it in the provider configuration using var.token.

Question 2

You are managing an HCP Terraform organization with multiple workspaces. A security requirement mandates that all workspaces use a specific version of the AWS provider (5.0.0 or later) and that any deviation triggers a notification to the security team. You have configured a Sentinel policy to check the provider version. Which enforcement level should you set for this policy to meet the requirement while allowing developers to proceed with their work if they acknowledge the risk?

Accepted Answer

soft-mandatory. soft-mandatory enforcement requires an authorized user to explicitly override a policy failure before the run can continue. This matches the need to allow developers to proceed after acknowledging the risk. The override is recorded, and notifications can be set up via HCP Terraform's notification features. hard-mandatory would block all non-compliant runs, advisory would not require acknowledgment, and disabled would ignore the policy.

Answer

advisory

Answer

hard-mandatory

Answer

disabled

Question 3

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy sets with a Sentinel policy that inspects the run's variables and blocks runs if any AWS access key variables are present.. Sentinel policy sets are the governance mechanism in HCP Terraform that can evaluate run context, including variables and plan data, and enforce rules such as disallowing static AWS access keys. Attaching the policy set to the production project ensures every run in that project is checked, providing the required guardrail without relying on manual review.

Answer

A team API token with read-only permissions on the production project.

Answer

Run triggers that automatically start a run whenever the AWS credentials in the workspace are modified.

Answer

Workspace variable sets with the 'sensitive' flag enabled for all AWS credential variables.

Question 4

Your organization uses HCP Terraform to manage AWS infrastructure. The security team requires that all runs consuming AWS credentials must be evaluated against a policy that checks the CIDR blocks of any aws_security_group resource. They want the policy to block the run if a CIDR is 0.0.0.0/0. Where should you implement this policy so it is enforced across all workspaces in the organization?

Accepted Answer

Create a Sentinel policy in the organization's policy sets and assign it to all workspaces.. Sentinel policies in HCP Terraform are managed at the organization level and can be applied to all workspaces through policy sets. They evaluate the Terraform plan and can block runs that violate rules, such as allowing 0.0.0.0/0 in security group CIDRs. This provides centralized, consistent enforcement across the organization.

Answer

Define an AWS IAM policy that denies the CreateSecurityGroup action when the CIDR is 0.0.0.0/0.

Answer

Use Terraform's built-in validation blocks in the aws_security_group resource to reject 0.0.0.0/0.

Answer

Configure a pre-plan run task that runs a script to check the Terraform configuration for 0.0.0.0/0.

Question 5

You are configuring run triggers in HCP Terraform to orchestrate a multi-workspace deployment on AWS. Workspace A provisions a VPC and outputs the VPC ID. Workspace B needs to consume that VPC ID to deploy subnets. You want Workspace B to automatically start a run after Workspace A successfully applies. Which configuration should you implement?

Accepted Answer

In Workspace B, add a run trigger that references Workspace A as the source workspace.. Run triggers are defined on the destination workspace, specifying the source workspace whose successful apply will trigger a run. This enables dependency chains between workspaces. Reading remote state does not trigger runs, and webhooks are for notifications, not native orchestration.

Answer

In Workspace A, add a run trigger that references Workspace B as the destination workspace.

Answer

Use a Terraform data source in Workspace B to read the remote state of Workspace A.

Answer

Configure a webhook in Workspace A that calls the HCP Terraform API to start a run in Workspace B.

Question 6

You are configuring a Sentinel policy for your HCP Terraform organization. The policy must prevent any Terraform run from creating an AWS S3 bucket without server-side encryption enabled. The policy should block the run if such a bucket is detected, but you want to allow administrators to override the policy in emergency situations. Which enforcement level should you set for the policy?

Accepted Answer

soft-mandatory. Soft-mandatory enforcement blocks a run when the policy fails but allows users with appropriate permissions to override the failure. This provides the necessary guardrail against unencrypted S3 buckets while still permitting emergency overrides. Hard-mandatory would block without override, and advisory would not block at all.

Answer

advisory

Answer

hard-mandatory

Answer

mandatory

Question 7

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that all workspaces in a specific project automatically inherit a set of environment variables containing AWS credentials. These variables must be available to all runs in those workspaces without manual configuration. What is the most efficient way to achieve this?

Accepted Answer

Create a variable set with the environment variables and assign it to the project.. Variable sets are designed to share variables across multiple workspaces. When assigned to a project, all workspaces in that project inherit the variables automatically, including new workspaces. This is the most efficient and maintainable solution. Other options require manual intervention or do not provide automatic inheritance.

Answer

Define the variables in each workspace's Terraform configuration using a shared module.

Answer

Use the HCP Terraform API to create the variables in each workspace via a script.

Answer

Configure a run trigger that copies variables from a template workspace to the target workspaces.

Question 8

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Sentinel policy that uses the tfrun import to access the cost estimation data and enforce a hard-mandatory policy when the delta exceeds $500.. Cost estimation in HCP Terraform provides data that Sentinel policies can evaluate. By writing a hard-mandatory policy that checks the monthly cost delta from the cost estimate and fails if it exceeds $500, you enforce the compliance rule automatically for all runs in the finance project. This leverages the existing cost estimation feature and the policy-as-code framework.

Answer

Configure a run trigger from a cost monitoring workspace to the finance workspaces to automatically reject runs that exceed the threshold.

Answer

Enable the 'Cost Estimation' setting on each finance workspace and manually review the cost estimate before applying.

Answer

Set a workspace variable named COST_THRESHOLD to 500 and rely on Terraform's AWS provider to enforce it during plan.

Question 9

Your organization uses HCP Terraform to manage AWS infrastructure. A platform engineer has been assigned the 'Write' permission on a workspace but is still unable to modify the AWS credentials stored as workspace variables. Which HCP Terraform permission level is required to manage sensitive workspace variables?

Accepted Answer

Admin. Managing workspace variables, particularly sensitive ones like AWS credentials, requires Admin permission on the workspace. Write permission allows runs and applies but not variable management. Plan and Read are view-only levels. Therefore, the engineer must be granted Admin to edit the credentials.

Answer

Write

Answer

Plan

Answer

Read

Question 10

Your organization has a Sentinel policy with enforcement level 'soft-mandatory' that checks for required tags on AWS resources. During a run, the policy fails because an EC2 instance is missing the 'Environment' tag. The workspace allows users with write access to override policies. What is the immediate outcome of the run?

Accepted Answer

The run is paused and a user with appropriate permissions can choose to override the policy and continue the apply.. When a soft-mandatory Sentinel policy fails, the run pauses and users with override permissions can choose to bypass the policy and continue. This allows for exceptions while still enforcing governance. Hard-mandatory policies cannot be overridden, and advisory policies do not block. The scenario specifies soft-mandatory, so the run is paused for possible override.

Answer

The policy failure is logged as an advisory and the run continues automatically without any intervention.

Answer

The run fails immediately and cannot be overridden, requiring the configuration to be fixed and a new run to be queued.

Answer

The run is canceled and the workspace is locked until the policy is updated to pass.

Question 11

Your team uses HCP Terraform to manage AWS infrastructure. You need to allow a specific team of developers to apply changes in a workspace, but you do not want them to be able to modify workspace settings or delete the workspace. Which team permission should you assign to the developers?

Accepted Answer

Write. Write permission in HCP Terraform allows users to perform runs, including apply, but restricts administrative actions like changing settings or deleting the workspace. This provides the necessary operational access while protecting the workspace configuration. Admin would give too much control, and Read would not allow applies.

Answer

Read

Answer

Plan

Answer

Admin

Question 12

You are designing a governance strategy for your HCP Terraform organization. You need to enforce that all AWS resources are tagged with a 'CostCenter' tag. The policy should block any run that creates resources without this tag, but you also want to allow a temporary exception for a migration project. Which combination of Sentinel enforcement level and policy set scoping should you use?

Accepted Answer

Use a hard-mandatory policy set scoped to all workspaces except the migration project, and a separate advisory policy set for the migration project.. To block non-compliant runs everywhere except the migration project, the hard-mandatory policy set must be scoped to all workspaces except that project. The migration project can then have an advisory policy set to log violations without blocking. This combination enforces the tagging requirement broadly while allowing the migration project to proceed with visibility.

Answer

Use a hard-mandatory policy set scoped to all workspaces, and create a separate policy set with an advisory policy for the migration project.

Answer

Use a soft-mandatory policy set scoped to all workspaces, and rely on developers to override when necessary.

Answer

Use a hard-mandatory policy set scoped only to the migration project, and an advisory policy set for all other workspaces.

Question 13

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The run is halted immediately, and the apply cannot proceed.. Hard-mandatory Sentinel policies block a run immediately upon failure, preventing any apply. No manual override is possible. Advisory policies only warn, and soft-mandatory allows override by authorized users. In this scenario, the unencrypted S3 bucket would be blocked, and the developer must remediate the configuration.

Answer

The run proceeds to apply, but the policy failure is recorded in the audit log.

Answer

The run is paused, and an organization owner must manually override the policy to proceed.

Answer

The run continues, but the policy failure is logged as an advisory warning.

Question 14

You are using HCP Terraform with the AWS provider and have configured a policy set with Sentinel policies. A policy fails during a run, and the run is paused. You have the necessary permissions to override the policy. What is the effect of overriding a soft-mandatory policy failure?

Accepted Answer

The run continues, and the override is recorded in the audit log.. Overriding a soft-mandatory policy failure permits the current run to proceed, and the override is captured in the audit log for traceability. This mechanism balances enforcement with operational flexibility. The policy itself remains unchanged and will be enforced in subsequent runs.

Answer

The policy is automatically changed to advisory for all future runs.

Answer

The policy is permanently disabled for the workspace.

Answer

The run is cancelled and must be restarted after the policy is fixed.

Question 15

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A remote run is currently in progress in the workspace, holding the state lock, so a local apply cannot proceed until it finishes or is canceled.. With remote execution mode, all runs occur in HCP Terraform and the workspace state is locked during an active run. A local apply cannot acquire the lock while a remote run is in progress. The engineer must coordinate with the remote run, typically by waiting or canceling, rather than attempting a local apply.

Answer

The workspace's state is stored locally because the backend configuration is missing, causing a lock conflict with the remote run.

Answer

The local CLI is not authenticated to HCP Terraform, so it cannot acquire the state lock.

Answer

The workspace's execution mode is set to Local, so HCP Terraform cannot accept remote applies.