HCP Terraform Governance

If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?

Your organization uses HCP Terraform to manage AWS infrastructure. You need to grant a team the ability to create and manage workspaces within a specific project, but prevent them from deleting the project itself or modifying project-level settings. Which HCP Terraform team permission should you assign?

You want to trigger a run only when a specific file within a module path changes. How do you configure this?

Which TWO of the following are required to successfully integrate VCS with HCP Terraform?

Your organization uses HCP Terraform with a private module registry. A developer wants to use a module from the registry in a new configuration. The module is versioned and published. What is the correct way to reference this module in the Terraform configuration?

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Which THREE of the following items can be included in a Variable Set?

You need to automate the publication of a module to the Private Module Registry. What should you do?

Your organization uses HCP Terraform with the AWS provider. A platform team wants to ensure that any workspace in the 'production' project can only use AWS credentials from a pre-approved OIDC role, and that no static AWS access keys are ever stored as workspace variables. Which HCP Terraform feature should you configure to enforce this requirement?

Your organization uses HCP Terraform to manage AWS infrastructure. The security team requires that all runs consuming AWS credentials must be evaluated against a policy that checks the CIDR blocks of any aws_security_group resource. They want the policy to block the run if a CIDR is 0.0.0.0/0. Where should you implement this policy so it is enforced across all workspaces in the organization?

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

Your organization uses HCP Terraform with remote runs. A workspace named 'prod-network' has its execution mode set to Remote. A platform engineer runs `terraform apply` locally after running `terraform plan` on their laptop, but the apply fails with an error because the workspace's state is locked by an active remote run. What is the most likely explanation for this error?

What is the purpose of 'Project' in HCP Terraform?

You are configuring run triggers in HCP Terraform to orchestrate a multi-workspace deployment on AWS. Workspace A provisions a VPC and outputs the VPC ID. Workspace B needs to consume that VPC ID to deploy subnets. You want Workspace B to automatically start a run after Workspace A successfully applies. Which configuration should you implement?

If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?

Which of the following can be used to monitor costs in an HCP Terraform workspace?

Which TWO of the following are true regarding Private Module Registry versioning?

Which type of Sentinel policy is used to block a run without possibility of override?

How can you view the detailed breakdown of cost estimates for a specific Terraform plan?

Your team uses HCP Terraform to manage AWS infrastructure. You have a workspace that provisions an Amazon RDS instance. You want to ensure that the RDS instance is not publicly accessible. You have written a Sentinel policy that checks the 'publicly_accessible' attribute. However, after enabling the policy, you notice that runs are not being blocked even when the attribute is set to true. What is the most likely reason for the policy not blocking the run?

What happens if a Sentinel policy results in an 'advisory' output?

Your organization uses HCP Terraform with Sentinel policies. A policy is configured with an enforcement level of 'hard-mandatory' and checks that all AWS S3 buckets have server-side encryption enabled. A developer runs a plan that includes an unencrypted bucket. What happens when the policy fails?

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

You are managing an HCP Terraform organization with multiple workspaces. A security requirement mandates that all workspaces use a specific version of the AWS provider (5.0.0 or later) and that any deviation triggers a notification to the security team. You have configured a Sentinel policy to check the provider version. Which enforcement level should you set for this policy to meet the requirement while allowing developers to proceed with their work if they acknowledge the risk?

Your organization uses HCP Terraform to manage AWS infrastructure. A platform engineer has been assigned the 'Write' permission on a workspace but is still unable to modify the AWS credentials stored as workspace variables. Which HCP Terraform permission level is required to manage sensitive workspace variables?

Which of the following is an advantage of using Variable Sets?

Which of the following is a primary benefit of using a Private Module Registry?

Your team uses HCP Terraform to manage AWS infrastructure. You need to allow a specific team of developers to apply changes in a workspace, but you do not want them to be able to modify workspace settings or delete the workspace. Which team permission should you assign to the developers?

Your organization uses HCP Terraform with the AWS provider. You want to share a set of AWS region and tagging variables across all workspaces in a specific project without duplicating them in each workspace. Which HCP Terraform feature should you use?

You are configuring a Sentinel policy for your HCP Terraform organization. The policy must prevent any Terraform run from creating an AWS S3 bucket without server-side encryption enabled. The policy should block the run if such a bucket is detected, but you want to allow administrators to override the policy in emergency situations. Which enforcement level should you set for the policy?

You are using HCP Terraform with the AWS provider and have configured a policy set with Sentinel policies. A policy fails during a run, and the run is paused. You have the necessary permissions to override the policy. What is the effect of overriding a soft-mandatory policy failure?

Your organization uses HCP Terraform with Sentinel policies. A policy set is configured with enforcement level 'hard-mandatory' and includes a policy that checks for the presence of a 'CostCenter' tag on all AWS resources. During a run, the policy fails because a newly added aws_s3_bucket lacks the tag. What happens to the run?

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that all workspaces in a specific project automatically inherit a set of environment variables containing AWS credentials. These variables must be available to all runs in those workspaces without manual configuration. What is the most efficient way to achieve this?

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?

You need to ensure that all workspaces use a specific set of tags. How can this be enforced?

Which TWO of the following are standard stages of an HCP Terraform run pipeline?

Your organization uses HCP Terraform with the AWS provider. A Sentinel policy set is attached to the 'production' project with a soft-mandatory policy that checks for required tags on all AWS resources. During a run, the policy fails because a developer forgot to add a 'CostCenter' tag to an EC2 instance. What is the outcome of the run, and what can the developer do?

Your team uses HCP Terraform to manage AWS resources. You need to ensure that all workspaces in a project automatically inherit a set of AWS region and tagging variables. What is the most efficient way to achieve this?

You are designing a governance strategy for your HCP Terraform organization. You need to enforce that all AWS resources are tagged with a 'CostCenter' tag. The policy should block any run that creates resources without this tag, but you also want to allow a temporary exception for a migration project. Which combination of Sentinel enforcement level and policy set scoping should you use?

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

Your organization has a Sentinel policy with enforcement level 'soft-mandatory' that checks for required tags on AWS resources. During a run, the policy fails because an EC2 instance is missing the 'Environment' tag. The workspace allows users with write access to override policies. What is the immediate outcome of the run?