scenario questions

You are defining an input variable for a Terraform module that will accept a list of AWS subnet IDs. You want to ensure that the variable only accepts a list of strings and that it is required. Which variable declaration correctly achieves this?

If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?

Your organization uses HCP Terraform to manage AWS infrastructure. You need to grant a team the ability to create and manage workspaces within a specific project, but prevent them from deleting the project itself or modifying project-level settings. Which HCP Terraform team permission should you assign?

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

When defining a provider in Terraform, what does the 'alias' meta-argument signify?

You want to trigger a run only when a specific file within a module path changes. How do you configure this?

What is the primary risk of relying solely on 'create_before_destroy' without considering dependency chains?

Your team maintains a Terraform configuration that uses the AWS provider with an S3 backend. A security review requires that provider credentials never be stored in plaintext in the configuration or state. You currently use a shared credentials file referenced by the `profile` argument. Which change best satisfies this requirement while keeping the configuration portable across CI and developer machines?

Which THREE of the following are components of the 'source' string when using the Terraform Registry?

During a CI pipeline run, `terraform init` fails with an error stating that the checksums recorded in `.terraform.lock.hcl` do not match any of the packages available from the configured provider mirror. The mirror is an internal registry serving only linux_amd64 builds, while the lock file was generated on a developer's darwin_arm64 laptop. Which action resolves the failure while keeping the lock file authoritative for CI?

You are authoring a Terraform module that must accept a map of environment names to instance counts. The map is provided by callers and may contain up to 20 entries. You need to derive a flat list of instance names in the form "<env>-<index>" (e.g., "prod-0", "prod-1") so that a downstream resource can use `for_each` with stable keys. Which expression correctly produces this list?

Which meta-argument is used to explicitly associate a resource with a non-default provider instance?

An operations engineer runs `terraform init` and notices Terraform downloads the AWS provider from `registry.terraform.io`. The organization requires all provider packages to come from an internal mirror at `mirror.example.com` for compliance. The engineer adds a `provider_installation` block to the CLI configuration file. Which CLI configuration file location and block structure will make Terraform use the mirror for the AWS provider while still allowing other providers from the public registry?

Which TWO factors must be considered when using 'replace_triggered_by' with multiple resources?

Which TWO of the following are required to successfully integrate VCS with HCP Terraform?

What is the recommended approach for managing a module that has grown too large?

Where do module outputs appear after a 'terraform apply'?

Which THREE of the following are true regarding 'create_before_destroy'?

Which TWO of the following are valid ways to handle a resource that has become 'tainted'?

Your organization uses HCP Terraform with a private module registry. A developer wants to use a module from the registry in a new configuration. The module is versioned and published. What is the correct way to reference this module in the Terraform configuration?

What happens if you use a dynamic block with a 'for_each' expression that evaluates to an empty set?

How do you pass a provider instance from a root module into a child module?

You have a module `terraform-aws-modules/vpc/aws` version `3.14.0` from the public Terraform Registry. You want to ensure that your configuration always uses this exact version and does not automatically upgrade to newer versions. Which version constraint should you specify in the module block?

You are creating a Terraform module that will be used by multiple teams. You want to ensure that the module is reusable and maintainable. Which TWO practices should you follow when designing the module's interface? (Choose two.)

What is the primary function of the 'source' attribute in the 'required_providers' block?

You want to remove a resource from Terraform management without destroying the actual AWS resource. Which command accomplishes this?

You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?

Which THREE of the following items can be included in a Variable Set?

You are using Terraform to manage an AWS EC2 instance. During a planned update, you expect the instance to be destroyed and recreated because of a change to the user_data attribute. However, you want to ensure that the old instance is destroyed only after the new instance is successfully created, to minimize downtime. Which lifecycle meta-argument should you add to the aws_instance resource?

You need to automate the publication of a module to the Private Module Registry. What should you do?

A module author wants to prevent callers from accidentally overriding a critical naming convention. The module already computes a `bucket_name` local. The author wants to expose it to callers without allowing them to set it. Which approach correctly enforces this behavior?

Your team uses HCP Terraform with a VCS-connected workspace. A developer pushes a commit to the tracked branch while a plan is already running. What does HCP Terraform do with the newly triggered run by default?

A platform team maintains a shared Terraform module that must run in three AWS regions simultaneously within a single root configuration. The module itself declares only a generic `aws` provider requirement with no alias, and the team wants each module instance to use a different region without editing the module source. Which configuration approach satisfies this requirement?

Your organization uses HCP Terraform with the AWS provider. A platform team wants to ensure that any workspace in the 'production' project can only use AWS credentials from a pre-approved OIDC role, and that no static AWS access keys are ever stored as workspace variables. Which HCP Terraform feature should you configure to enforce this requirement?

Your organization uses HCP Terraform to manage AWS infrastructure. The security team requires that all runs consuming AWS credentials must be evaluated against a policy that checks the CIDR blocks of any aws_security_group resource. They want the policy to block the run if a CIDR is 0.0.0.0/0. Where should you implement this policy so it is enforced across all workspaces in the organization?

A DevOps engineer runs `terraform init` in a CI pipeline that has no internet access. The configuration uses the AWS provider from the public Terraform Registry. The pipeline fails because Terraform cannot download the provider. The team wants to use a local filesystem mirror containing the required provider packages. Which Terraform CLI configuration block should be used to point Terraform to the local mirror?

Which of the following is a valid lifecycle meta-argument in Terraform?

Which argument in a module block allows you to provide a custom name to the module instance?

What is the purpose of the 'terraform providers lock' command?

Which TWO of the following are true regarding variable validation in modules?

A module outputs an AWS S3 bucket name. The root configuration needs to pass this output to another module as an input variable. How should the root configuration reference the output from the first module?

A module uses for_each over a map to create several IAM roles, and the map keys are derived from a variable that callers may change. The team wants to avoid replacing roles when only the map's values change. Which change to the module is required?

You have defined a resource and set 'prevent_destroy = true'. If you perform a 'terraform destroy', what will happen?

Which TWO of the following are limitations of 'ignore_changes'?

Two engineers on your team both run `terraform apply` against the same HCP Terraform workspace that uses remote state, and their runs overlap in time. The second engineer's apply is rejected with a message that the workspace is locked. Which HCP Terraform behavior explains this outcome?

You have a Terraform configuration that uses a module from the public registry. How do you ensure your team uses a specific version?

Which TWO of the following are benefits of using HCP Terraform for teams?

A team wants to ensure their Terraform configuration uses a specific major version of the AWS provider to prevent breaking changes. Which block should they use?

Your organization is standardizing on HCP Terraform and needs to decide which workspaces should use remote execution with a self-hosted agent pool rather than HCP Terraform's hosted runners. Which TWO conditions justify using a self-hosted agent pool? (Choose two.)

You are authoring a module that creates an AWS RDS instance. The module must enforce that the `engine` input is one of `mysql`, `postgres`, or `mariadb`. A consumer passes `engine = "aurora"`. What is the most appropriate way to handle this in the module to provide a clear error message and enforce the constraint?

You have an AWS EC2 instance managed by Terraform. The operations team occasionally updates the instance's tags directly in the AWS Console to reflect temporary maintenance status. You want Terraform to ignore these external tag changes and not revert them during the next apply. However, you still want Terraform to manage other attributes of the instance. Which lifecycle meta-argument should you use?

In a dynamic block, you need to access the current iteration item. What is the default label assigned to the iterator object?

You are writing a Terraform configuration that reads a list of environment names from a variable and creates one aws_s3_bucket for each environment. The order of the list may change over time, and you want to avoid unnecessary bucket replacement. Which configuration snippet achieves this with stable resource addressing?

You are refactoring a Terraform configuration by moving an `aws_s3_bucket` resource into a child module. The bucket already exists and is tracked in state at the root. You want to avoid destroying and recreating the bucket. Which command should you use to update the state address without touching the real infrastructure?

You are building a module that needs to be consumed by multiple teams. How should you structure your module to ensure that the root module can provide values for variable definitions without hardcoding them in the module itself?

Which TWO types of variables can be set in HCP Terraform?

You want to optionally create an S3 bucket only if a specific variable 'create_bucket' is set to true. Which HCL feature is best for this?

An operations engineer runs 'terraform init' in a directory where the configuration requires the AWS provider from the public registry. The machine has no direct internet access but can reach an internal Terraform registry mirror. Which action must be taken so that init succeeds using the mirror?

Which TWO of the following are valid uses of the 'for' expression?

A team wants to reuse an existing, manually managed AWS provider configuration located in a separate directory as the source of truth for a new Terraform configuration, instead of declaring a fresh provider block. Which statement describes how Terraform obtains provider configurations from elsewhere?

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

A platform team maintains a module that provisions a VPC and subnets. They want to expose the subnet IDs to callers without allowing callers to modify them. Which Terraform construct should they use in the module?

You are writing a Terraform configuration that uses a conditional expression to set the instance type for an AWS EC2 instance. The condition checks if the environment is production. The true branch returns a string, but the false branch returns a number. What will happen when you run terraform plan?

Your organization uses HCP Terraform with remote runs. A workspace named 'prod-network' has its execution mode set to Remote. A platform engineer runs `terraform apply` locally after running `terraform plan` on their laptop, but the apply fails with an error because the workspace's state is locked by an active remote run. What is the most likely explanation for this error?

Which directory structure is considered standard for a Terraform module?

An operations engineer runs `terraform init` in a directory whose configuration uses the AWS provider. After init, the engineer inspects `.terraform.lock.hcl` and sees multiple `zh:` hash entries alongside `h1:` entries for the hashicorp/aws provider. A colleague on a different platform then runs `terraform init` and Terraform reports that the provider package does not match any of the checksums recorded in the lock file. Which action most directly resolves the mismatch while preserving reproducibility?

Which THREE of the following are valid ways to transform data for Terraform configuration?

What are the ways to configure provider credentials? (Select THREE)

You are refactoring a module that previously used `count` to create multiple AWS IAM users. The module now uses `for_each` with a map of usernames to user details. After the refactor, you run `terraform plan` and see that Terraform wants to destroy and recreate all existing IAM users. What is the most likely cause, and how can you avoid this disruption?

When refactoring a large infrastructure configuration, you move a resource into a child module. How do you handle the existing state to prevent Terraform from destroying and recreating the resource?

What is the primary benefit of using a module registry compared to a local file path for module distribution?

You have a Terraform variable defined as a list of objects, each with a name and a list of ports. You need to create AWS security group rules for each port across all objects. Which expression correctly generates a flattened list of objects containing the name and port for each combination?

Which TWO of the following accurately describe the behavior of 'terraform state rm'?

You are updating a shared Terraform module that provisions an Amazon RDS instance. The module currently defines an input variable `engine_version` with `default = "14.7"`. Your team wants to ensure that any consumer who does not explicitly set `engine_version` still gets a valid value, but you also want to prevent consumers from accidentally passing a null value that would cause an API error. Which change should you make to the variable definition?

You are writing a Terraform configuration that creates multiple AWS S3 buckets. The bucket names are derived from a list of project names, but you need to ensure that the names are unique and that the configuration can be safely modified without affecting existing buckets. Which approach should you use?

Which THREE actions are best practices when publishing a module to a private registry?

Two engineers on your team run `terraform apply` against the same HCP Terraform workspace within seconds of each other. The workspace uses remote execution and has no run triggers configured. What does HCP Terraform do to coordinate these concurrent runs?

When a resource is marked as 'tainted', what is the expected outcome of the next 'terraform apply'?

What is the purpose of 'Project' in HCP Terraform?

Which file stores the mapping between your Terraform configuration and the real-world infrastructure?

What is the correct way to specify a version constraint for a provider that must be at least 3.0 but less than 4.0?

You have an AWS Lambda function defined with the aws_lambda_function resource. The function's source code is packaged in an S3 object. You want Terraform to replace the Lambda function whenever the S3 object's ETag changes, indicating a new version of the code. Which configuration should you add to the aws_lambda_function resource?

You are configuring run triggers in HCP Terraform to orchestrate a multi-workspace deployment on AWS. Workspace A provisions a VPC and outputs the VPC ID. Workspace B needs to consume that VPC ID to deploy subnets. You want Workspace B to automatically start a run after Workspace A successfully applies. Which configuration should you implement?

You manage an AWS RDS DB instance with Terraform. During a maintenance window, an operator manually resizes the instance class in the AWS Management Console. You want Terraform to detect this drift on the next plan but NOT automatically revert it, so you can decide later. What should you do?

A team wants to prevent any terraform apply from running in a production workspace unless a specific individual has reviewed and approved the plan. Which HCP Terraform capability should they enable?

You are authoring a Terraform module that creates an AWS IAM policy. The policy's Statement blocks must be generated from a list of objects, but each Statement must also conditionally include a Condition block only when the object's condition attribute is non-null. Which approach correctly generates the Statement blocks while conditionally including the nested Condition block?

In HCP Terraform, you have a workspace that uses the CLI-driven workflow. A team member runs terraform apply locally and then pushes the updated state to HCP Terraform. What is the primary benefit of this workflow?

An operations engineer runs terraform init in a CI pipeline and notices the .terraform.lock.hcl file lists hashes for linux_amd64 only. A developer on macOS arm64 runs terraform init in the same repository and Terraform downloads a different provider build. The team wants the lock file to include hashes for both platforms so CI and developer workstations verify the same provider artifacts. Which command should the engineer run?

What is the purpose of the 'terraform init' command when working with modules?

You have an aws_instance resource in your Terraform configuration that was created six months ago. The operations team now requires that any future replacement of this instance preserves the existing Elastic Network Interface (ENI) to maintain its private IP address. You add a lifecycle block with create_before_destroy = true to the aws_instance resource. What is the effect of this change when the instance must be replaced?

Which TWO of the following functions are most useful for manipulating lists?

When troubleshooting a failed plan in HCP Terraform, which THREE sources should you check?

You are authoring a Terraform configuration that provisions an aws_autoscaling_group. The desired instance count is stored in a variable named instance_count, and you need to create exactly that many aws_instance resources. Which approach correctly creates the required number of instances while keeping the configuration valid?

If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?

Which THREE of these are benefits of using modules in Terraform?

What happens if you have a provider version conflict in your module dependencies?

A Terraform module is used by multiple teams. The module requires the AWS provider but should not enforce a specific provider configuration. The module's author wants to ensure that when the module is used, the caller must pass an AWS provider instance with a specific alias. What should the author include in the module's terraform block?

Which of the following can be used to monitor costs in an HCP Terraform workspace?

Which THREE of the following represent potential pitfalls when using 'count'?

Which TWO of the following are true regarding Private Module Registry versioning?

You are writing a module that creates an AWS Security Group. The module accepts a variable `ingress_rules` defined as a list of objects with `from_port`, `to_port`, and `protocol`. You want to ensure that the module's interface is flexible enough to allow callers to add or remove rules without modifying the module code. Which Terraform feature should you use to iterate over the list and create dynamic ingress blocks?

You maintain a Terraform module that provisions an AWS Application Load Balancer and its target groups. Consumers frequently need to attach additional security groups to the ALB, but the module currently hardcodes a single security group. You want to allow consumers to supply a list of security group IDs without breaking existing module calls. Which change should you make to the module's variables and resource configuration?

If you use 'ignore_changes = [tags]', and you manually change the tags in the AWS Console, what will happen during the next 'terraform plan'?

When using 'terraform state mv', what is the impact on the collaboration workflow?

You maintain a Terraform configuration in a GitHub repository that provisions AWS infrastructure. Your organization uses HCP Terraform with VCS-driven workspaces. A teammate pushes a commit that modifies `main.tf` in the `production` branch, but you need the change to be reviewed and approved before any infrastructure is modified. What should you configure to enforce this workflow?

You are writing a Terraform configuration that uses a for expression to transform a map of objects into a new map. The original map has keys that are strings, and each object contains an attribute 'enabled' of type bool. You need to create a new map that includes only the entries where 'enabled' is true, and the new map's keys should be the original keys prefixed with 'prod-'. Which for expression achieves this?

A platform team publishes a shared networking module to a private Terraform registry. Several consuming teams pin the module using `version = "~> 2.1.0"`. The platform team later adds a new optional input variable to the module and publishes it as version 2.2.0 without changing any existing behavior. What is the effect on the consuming teams' next `terraform init`?

Which type of Sentinel policy is used to block a run without possibility of override?

Which of these is a valid use case for a dynamic block?

You are writing a Terraform configuration that uses a `dynamic` block to generate multiple `ingress` blocks inside an `aws_security_group` resource. The `var.ingress_rules` variable is a list of objects with `from_port`, `to_port`, and `cidr_blocks`. You need to reference the current rule inside the dynamic block's content. Which iterator configuration and reference is correct?

If you want to use a provider that is not published in the Terraform Registry, how do you install it?

You need to manage resources in two different AWS regions using the same provider configuration. How do you achieve this?

Which TWO of the following statements are correct regarding 'for_each' and state?

Your team uses a GitHub repository as the VCS connection for an HCP Terraform workspace in the AWS provider organization. A developer pushes a commit that modifies a variable value in `terraform.tfvars` and also touches a file inside a subdirectory that is excluded by the workspace's trigger patterns. Only the subdirectory file is in the trigger pattern exclusion list. What will HCP Terraform do?

A platform team is standardizing Terraform provider usage across many AWS accounts. They want to enforce a specific AWS provider version and ensure every root module records the provider source explicitly so that ambiguous provider lookups do not occur. Which two actions should the team take? (Choose two.)

How can you view the detailed breakdown of cost estimates for a specific Terraform plan?

Which THREE items should be included in a well-documented Terraform module?

You are using a for expression to create a map from a list of objects. Each object has an attribute 'name' that is a string. You want the resulting map's keys to be the 'name' values and the values to be the entire objects. However, you encounter an error because some objects have duplicate 'name' values. How can you modify the for expression to handle duplicates by grouping objects with the same name into a list, so that the map values become lists of objects?

You are writing a reusable module that creates an AWS S3 bucket and an associated bucket policy. The module will be consumed by multiple teams. Which TWO practices should you follow to make the module robust and maintainable? (Choose two.)

Which are characteristics of the Terraform Plugin SDK? (Select TWO)

Which meta-argument is best for deploying resources that are strictly dependent on the number of items in a configuration?

Your team uses HCP Terraform to manage AWS infrastructure. You have a workspace that provisions an Amazon RDS instance. You want to ensure that the RDS instance is not publicly accessible. You have written a Sentinel policy that checks the 'publicly_accessible' attribute. However, after enabling the policy, you notice that runs are not being blocked even when the attribute is set to true. What is the most likely reason for the policy not blocking the run?

An operations engineer runs terraform init in a CI pipeline that has no outbound internet access but does have a local filesystem mirror of providers. The configuration uses the AWS provider and a custom provider named example. The engineer runs: terraform init -plugin-dir=/opt/terraform/plugins. What is the result?

A teammate accidentally deleted an `aws_security_group` through the AWS Console. The resource is still present in Terraform state, and no configuration changes have been made. What will `terraform plan` report for that resource, and what is the appropriate next step?

What happens if a Sentinel policy results in an 'advisory' output?

When writing a custom provider, what is the 'Schema' used for?

A platform team is preparing a reusable module for internal distribution. They want to ensure that consumers can reliably upgrade the module without unexpected breaking changes. Which TWO practices best support this goal? (Choose two.)

A root module configures the AWS provider with `region = "eu-central-1"` and declares an aliased configuration `aws.dr` pointing at `region = "eu-west-1"`. The team wants a single `aws_route53_record` resource to be created in the DR region while all other AWS resources stay in eu-central-1. Which two statements correctly describe how provider selection works for this resource? (Choose two.)

You are writing a module that creates an AWS EC2 instance and an associated security group. The module has a variable `instance_type` with a default of `t3.micro`. A consumer wants to override this default for a production environment. How should the consumer pass a different value when calling the module?

When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?

A resource has an attribute 'tags' that is managed by an external script. You want Terraform to ignore any changes made to 'tags' after the initial creation. How should you configure the 'lifecycle' block?

Your organization uses HCP Terraform with Sentinel policies. A policy is configured with an enforcement level of 'hard-mandatory' and checks that all AWS S3 buckets have server-side encryption enabled. A developer runs a plan that includes an unencrypted bucket. What happens when the policy fails?

You are creating a security group in AWS and need to define multiple ingress rules based on a list of port numbers. Which meta-argument is most appropriate to use to create one resource instance per port?

A consultant is authoring a module that must support both AWS commercial and AWS China regions. The module needs to create resources in whichever partition the caller selects, and the caller may also want to create resources in a second region within the same partition. The module must not hardcode any region. Which approach best satisfies this?

You are defining an input variable for a Terraform module that will accept a map of environment names to configuration objects. The object should have an instance_type string and a min_size number. You want Terraform to validate that any provided value matches this structure. Which type constraint should you use for the variable?

You are iterating over a map using for_each. You need to access the key of the current map element. Which object do you use?

What happens if two team members try to apply changes to the same workspace in HCP Terraform simultaneously?

Which THREE factors influence the choice of using an HCP Terraform Agent?

If a module has a required variable but you do not provide it in the calling configuration, what happens?

When configuring team permissions, what does the 'Workspace: Settings' permission allow?

You are managing an HCP Terraform organization with multiple workspaces. A security requirement mandates that all workspaces use a specific version of the AWS provider (5.0.0 or later) and that any deviation triggers a notification to the security team. You have configured a Sentinel policy to check the provider version. Which enforcement level should you set for this policy to meet the requirement while allowing developers to proceed with their work if they acknowledge the risk?

A consultant joins a project and runs `terraform init` on a configuration that references `hashicorp/aws` version `~> 5.0`. The init succeeds, but a teammate later reports that their init fails with a checksum mismatch for the same provider version. The consultant's platform is `linux_amd64` and the teammate's is `darwin_arm64`. What is the most likely explanation and the correct remediation?

Your organization uses HCP Terraform to manage AWS infrastructure. A platform engineer has been assigned the 'Write' permission on a workspace but is still unable to modify the AWS credentials stored as workspace variables. Which HCP Terraform permission level is required to manage sensitive workspace variables?

Your team uses HCP Terraform with a VCS-driven workflow. A developer opens a pull request that modifies a Terraform configuration. You want the plan to run automatically and the results to be visible on the pull request before merging. What should you configure?

A team defines a variable `allowed_ports` as `list(number)` and wants to validate that every value is between 1 and 65535 before any resources are planned. They add a `validation` block to the variable. Which configuration correctly enforces this constraint?

An operations engineer maintains a module that creates an AWS RDS instance. The module block in the root configuration includes a `providers` argument mapping the module's `aws` provider to an aliased provider configuration targeting a secondary region. A new resource is added inside the module that uses `aws.global` as an explicit provider. What happens when the engineer runs `terraform plan`?

Which TWO of the following are valid ways to pass a provider configuration to a child module?

Which TWO actions can be taken to resolve issues where a resource must be replaced, but 'prevent_destroy' is enabled?

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Which of the following is an advantage of using Variable Sets?

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Which of the following is a primary benefit of using a Private Module Registry?

A team's CI pipeline runs 'terraform init' on Linux amd64 runners, while developers run it on macOS arm64 laptops. After a developer commits .terraform.lock.hcl generated on their laptop, the CI pipeline fails with 'provider ... does not have a package available for your current platform'. What is the most appropriate fix?

You maintain a Terraform module that deploys AWS resources into several environments. Rather than declaring a separate variable per environment, you want a single input variable that accepts a map of environment names to configuration objects, where each object contains a region string and an instance count number, and your configuration should reject any input that does not match this shape at plan time. Which variable type constraint should you declare?

Where are lifecycle meta-arguments placed within a Terraform configuration?

You are using a module from the public Terraform Registry in a production configuration. After running terraform init -upgrade, you notice that the module version changed unexpectedly and caused a breaking change in your infrastructure. You want to prevent this from happening again. Which approach should you take?

Your team uses HCP Terraform to manage AWS infrastructure. You need to allow a specific team of developers to apply changes in a workspace, but you do not want them to be able to modify workspace settings or delete the workspace. Which team permission should you assign to the developers?

Your organization uses HCP Terraform with the AWS provider. You want to share a set of AWS region and tagging variables across all workspaces in a specific project without duplicating them in each workspace. Which HCP Terraform feature should you use?

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

You are writing a Terraform configuration that uses a `for` expression to transform a list of strings into a map where each string is both the key and the value. Which of the following expressions achieves this?

A platform team wants to prevent any workspace in their HCP Terraform organization from provisioning EC2 instances with public IP addresses. They need the policy to block a run before apply whenever a non-compliant plan is detected, and they want the failure reason surfaced to the developer. Which approach meets these requirements?

Your organization uses HCP Terraform with several projects. A compliance officer must be able to read the results of every policy evaluation and run across all projects, but must not be able to modify workspaces or trigger runs. Which approach grants exactly these rights?

A module author wants to conditionally create an AWS CloudWatch log group only when a variable named enable_logging is true. The log group resource is defined inside a child module. Which approach correctly implements this conditional creation within the module?

An operations engineer needs to remove an aws_iam_role and its attached aws_iam_role_policy_attachment from Terraform management without deleting the role in AWS, because the role is shared with an external team. The configuration for both resources will also be deleted from the repository. Which command sequence accomplishes this?

You have written a Terraform module that outputs the ARN of an AWS S3 bucket. A user of the module wants to reference this output in their root configuration. How should they access it?

Where can you view the historical state versions in HCP Terraform?

Your team manages AWS infrastructure with Terraform. A module needs to accept a map of environment names to instance types, where each instance type must be one of a fixed set of allowed values. You want Terraform to reject invalid configurations during plan with a clear error message. Which approach best validates the variable input?

You need to ensure that a resource is always recreated if an associated data source value changes. Which meta-argument supports this?

You are writing a Terraform module that creates an AWS S3 bucket. You want to ensure that the bucket name is globally unique and follows a naming convention that includes the AWS account ID and region. How can you generate a unique name within the module?

Your team maintains a Terraform module that provisions an AWS VPC. The module is used by multiple teams. You need to allow callers to customize the CIDR block but enforce a default if not provided. How should you define the variable in the module?

You are configuring a Sentinel policy for your HCP Terraform organization. The policy must prevent any Terraform run from creating an AWS S3 bucket without server-side encryption enabled. The policy should block the run if such a bucket is detected, but you want to allow administrators to override the policy in emergency situations. Which enforcement level should you set for the policy?

Which file is automatically generated to lock provider versions and their checksums?

Which of the following are valid ways to specify provider versions? (Select TWO)

You are using HCP Terraform with the AWS provider and have configured a policy set with Sentinel policies. A policy fails during a run, and the run is paused. You have the necessary permissions to override the policy. What is the effect of overriding a soft-mandatory policy failure?

How can you debug the output of a complex 'for' expression in Terraform?

Which THREE of the following are consequences of drifting from the Terraform state?

Which THREE pieces of information are displayed in the HCP Terraform Run UI?

When debugging provider issues, which commands are most useful? (Select THREE)

Your organization uses HCP Terraform with Sentinel policies. A policy set is configured with enforcement level 'hard-mandatory' and includes a policy that checks for the presence of a 'CostCenter' tag on all AWS resources. During a run, the policy fails because a newly added aws_s3_bucket lacks the tag. What happens to the run?

A module accepts a variable 'environment' used only to build a name prefix. The team wants to prevent callers from passing values outside a fixed set without duplicating validation in every caller. What is the correct approach?

You want to automate the approval process for non-production environments in HCP Terraform. Which setting enables this?

If a resource is not specified with a provider meta-argument, which provider instance does it use?

You are developing a Terraform module that creates an AWS EC2 instance. You want to expose the instance's private IP address to the caller. How should you define this in the module?

When using 'for_each' on a list of strings, what must you do to ensure the configuration is stable?

Which THREE of the following are true about 'lifecycle' blocks?

Which function is most useful when you have a nested list of objects and want to create a single flat list to iterate over with for_each?

You are managing a production database instance. You want to ensure that if a developer accidentally removes the resource block from the Terraform configuration, Terraform will refuse to destroy the database. How do you implement this?

When using multiple provider instances with different regions, what must be defined in the provider configuration?

Your team requires a custom module to be versioned strictly to prevent breaking changes during deployments. What is the recommended way to reference a module from a private Git repository?

How can you protect a module's inputs from receiving incorrect types of data?

When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?

Your team uses HCP Terraform with a VCS-driven workflow. You have a workspace that deploys to AWS. A developer wants to test a change that modifies an IAM policy without affecting the main branch. They create a feature branch and push changes, but the workspace is configured to track the `main` branch. What is the most appropriate way to allow the developer to test their change in isolation?

Where are providers physically stored by default when running 'terraform init'?

Which function allows you to safely access a map value even if the key might not exist?

A CI pipeline runs Terraform against an AWS account and must assume a dedicated deployment role rather than use long-lived access keys. The role ARN differs between the staging and production pipelines. The team wants a single configuration that works in both environments without embedding credentials. Which approach correctly configures the AWS provider to assume the pipeline-specific role?

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

You need to output a complex object from a child module to be used by the root module. What is the best practice for defining the output?

You are attempting to use a conditional expression to set a variable, but the types returned by the true and false results differ. What happens?

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

Your organization uses HCP Terraform with a VCS-driven workflow. A developer accidentally merges a change to the main branch that modifies a production workspace's Terraform code. The workspace is configured to auto-apply. Which mechanism can prevent the change from being applied immediately?

Your team uses HCP Terraform to manage AWS infrastructure. You need to ensure that all workspaces in a specific project automatically inherit a set of environment variables containing AWS credentials. These variables must be available to all runs in those workspaces without manual configuration. What is the most efficient way to achieve this?

A team is designing a reusable Terraform module that provisions an AWS VPC. They want to ensure the module is flexible and follows best practices for input variables. Which two practices should they implement? (Choose two.)

A module needs to render a JSON policy document where the list of allowed actions comes from a variable that may contain duplicates and mixed case, and the final output must be deterministic and free of duplicates. The engineer writes jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = local.actions, Resource = "*" }] }). Which local definition for local.actions best guarantees determinism and uniqueness?

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

You need to share a module across your entire organization. Which registry type should you use?

Your team uses HCP Terraform with a workspace connected to a GitHub repository. You need to ensure that no changes can be applied to production unless a specific compliance policy passes. The policy should block the apply if it fails, but authorized users should be able to override the failure with a justification. Which Sentinel enforcement level should you use?

You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?

You have a nested module structure. How can you pass a variable from the root module through an intermediate module to a leaf module?

You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?

What is the primary difference between 'count' and 'for_each' regarding state management?

You want to pass a complex object type to a module, but you need to ensure specific attributes are present. How do you define this in the variable block?

Your organization uses HCP Terraform with projects to group workspaces by business unit. A compliance rule states that any workspace in the 'finance' project must have a cost estimation check that fails the run if the monthly cost increase exceeds $500. You have enabled cost estimation in the organization settings. What should you do next to enforce this rule?

Which THREE components are part of the 'Workspace' object in HCP Terraform?

Which command helps verify if the providers are properly initialized?

When refactoring code, you rename a resource in your configuration. What happens if you run 'terraform plan' without updating the state?

You are configuring a new HCP Terraform workspace that uses a VCS connection to a GitHub repository. You want runs to be automatically triggered when changes are pushed to the main branch. Which setting should you enable?

You need to ensure that all workspaces use a specific set of tags. How can this be enforced?

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Which TWO of the following are standard stages of an HCP Terraform run pipeline?

If a user wants to ensure that a resource's lifecycle is managed by Terraform but wants to bypass the 'prevent_destroy' protection, what is the best approach?

You manage an Amazon RDS instance with Terraform. During an unrelated deployment, a junior engineer runs `terraform apply` and the instance is unexpectedly destroyed and recreated, causing a brief outage. You need to ensure that future `terraform apply` runs fail before any destructive change can be planned for this database. Which configuration should you add to the `aws_db_instance` resource?

Which block is used to configure provider-level settings like region or profile?

Your organization runs HCP Terraform with the AWS provider and wants to enforce a policy that blocks any `aws_s3_bucket` resource lacking a `lifecycle_rule` block. You are authoring a Sentinel policy that uses the `tfplan/v2` import. Which two statements correctly describe how the policy is evaluated and enforced? (Choose two.)

A team wants to pass a variable "allowed_ports" to a module and guarantee at apply time that every value is an integer between 1024 and 65535, rejecting invalid plans with a clear message. They prefer the validation to live in the variable block so callers get immediate feedback. Which declaration accomplishes this?

Which command is used to move a resource from one state file to another, commonly used when refactoring modules?

You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?

If you need to share output values between workspaces, what is the best practice in HCP Terraform?

Your team maintains a shared Terraform configuration in a GitHub repository. A developer opens a pull request that changes the instance type of a production EC2 instance. You want the change to be automatically validated by running a speculative plan before any human reviews the code. Which HCP Terraform feature should you configure to achieve this?

A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?

Which THREE of the following are valid ways to pass data to a module dynamically?

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

If a developer wants to use a provider that is not in the public registry, can they still use it?

A platform team maintains a shared Terraform child module that contains only a single `aws_s3_bucket` resource and no `provider` block. The module's `versions.tf` declares `required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }`. A consumer root module configures the AWS provider with `region = "us-west-2"` and calls the child module without any `providers` argument. During `terraform plan`, which AWS region will be used to evaluate the bucket resource inside the child module?

During a refactor, an engineer renames the Terraform address of an aws_s3_bucket from aws_s3_bucket.logs to aws_s3_bucket.audit_logs in the configuration, keeping every argument identical. The bucket holds production logs. What is the safest way to apply this change without destroying and recreating the bucket?

A configuration defines a dynamic block that generates ingress rules for an aws_security_group from a list of objects. Each object has a from_port, to_port, and protocol attribute, and one object also carries an extra cidr_blocks list. You want every generated rule to include the from_port, to_port, and protocol values, and to include cidr_blocks only when it is present, without writing a separate block for the odd entry. Which approach satisfies this?

Your team is using HCP Terraform with a workspace that has a remote backend. A developer runs terraform apply from their local CLI, but the apply fails because the state is locked. Which action should the developer take to resolve the lock and proceed with the apply?

What is the effect of running 'terraform init -upgrade' on the '.terraform.lock.hcl' file?

Your organization uses HCP Terraform with the AWS provider. A Sentinel policy set is attached to the 'production' project with a soft-mandatory policy that checks for required tags on all AWS resources. During a run, the policy fails because a developer forgot to add a 'CostCenter' tag to an EC2 instance. What is the outcome of the run, and what can the developer do?

A team defines an aws_instance resource whose instance_type should normally come from a variable, but for one specific workspace named "dr" the value must be forced to t3.micro regardless of the variable. The team wants a single resource block that behaves correctly in every workspace without duplicating the resource. Which expression assigns instance_type appropriately?

A platform team maintains a shared module in a private Terraform registry. They want to ensure that any configuration consuming this module always pulls the exact same version, even if a newer version is published. The module source is specified as "app.terraform.io/example-corp/vpc/aws". Which source argument change should be applied?

Your team uses HCP Terraform with a VCS-driven workflow. A pull request modifies a module that three separate workspaces consume from a shared private registry. You want reviewers to see the effect of the module change in each consuming workspace before the PR merges, without any state being written. What should you configure?

Your team publishes an internal Terraform module to a private registry. A consumer wants to pin the module to a specific version to avoid unexpected changes. The module source is `app.terraform.io/example-org/vpc/aws`. Which source argument correctly pins the module to version 2.3.0?

Your team uses HCP Terraform to manage AWS resources. You need to ensure that all workspaces in a project automatically inherit a set of AWS region and tagging variables. What is the most efficient way to achieve this?

You are using a module that depends on a specific provider version. Where should this constraint be defined?

A team uses the AWS provider to manage resources in three accounts: development, staging, and production. The root module must create an `aws_iam_role` in the production account while all other resources remain in the default development account. The production account's provider configuration is already declared with `alias = "prod"`. Which change to the production `aws_iam_role` resource is required?

A platform team maintains a shared child module that creates AWS resources in three different regions. The root module calls this child module three times, once per region. The child module currently declares only a default AWS provider configuration. What is the correct way to make each module instance use a distinct region without modifying the child module's resource blocks?

You want to use a module that is hosted in a private GitHub repository. Which authentication method should Terraform use to access it?

Which TWO of the following are true about the '.terraform' directory?

When should you use the 'for_each' meta-argument within a module?

You have a root module that calls a child module to create an AWS VPC. The child module defines an output named `vpc_id`. After running `terraform apply`, where can you find the value of `vpc_id`?

A platform team publishes an internal module that wraps the AWS provider. They want to ensure that consumers cannot use a provider version newer than 5.x but can use any 5.x release. The module's `required_providers` currently specifies `version = "~> 5.0"`. A consumer's root module specifies `version = "~> 4.0"` for the same provider. What happens when the consumer runs `terraform init`?

You are designing a governance strategy for your HCP Terraform organization. You need to enforce that all AWS resources are tagged with a 'CostCenter' tag. The policy should block any run that creates resources without this tag, but you also want to allow a temporary exception for a migration project. Which combination of Sentinel enforcement level and policy set scoping should you use?

If a user omits the 'version' in 'required_providers', what version does Terraform use?

A team wants to ensure that their Terraform configuration always uses a specific version of the AWS provider and that the version constraint is enforced across all modules. They add the following to the root module's terraform block: terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 4.0" } } } A child module declares the AWS provider without a version constraint. What happens when terraform init is run?

A team is using Terraform to manage an aws_s3_bucket. They want Terraform to ignore any changes made to the bucket's tags outside of Terraform, but they still want Terraform to manage the bucket policy and versioning configuration. Which lifecycle configuration should they add?

What are common reasons to use multiple provider instances? (Select TWO)

What command do you run to view the documentation for a module that has been published to a registry?

Your organization uses HCP Terraform with the AWS provider. You need to ensure that all workspaces in the organization automatically use a specific set of AWS credentials for runs, without manually configuring variables in each workspace. The credentials must be available as environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) and should be centrally managed. What should you do?

You are writing a Terraform configuration that uses a dynamic block to generate multiple ingress rules within an aws_security_group resource. The dynamic block iterates over a variable named ingress_rules. Inside the content block, you need to reference the current rule. Which expression correctly accesses the current element?

What happens if you set 'ignore_changes = all' in a resource lifecycle block?

You are managing an AWS S3 bucket with Terraform. The bucket has versioning enabled and contains critical data. You want to ensure that Terraform never destroys the bucket, even if someone runs terraform destroy. Which lifecycle meta-argument should you use?

You are developing a module that creates an AWS Lambda function. The module accepts a variable `environment` and must set the Lambda function's `environment` block with variables `LOG_LEVEL` and `STAGE`. The values for these should be derived from the `environment` variable. How should you define the variable and use it within the module?

A platform engineer is preparing a Terraform configuration that will run in an environment where the AWS provider must be pinned to a specific minor version, and the provider must be sourced from the public Terraform Registry. The engineer also wants to ensure that `terraform init` records the selected version and checksums for later verification. Which two actions should the engineer take? (Choose two.)

An `aws_instance` resource has `lifecycle { ignore_changes = [ami] }`. A security team updates the AMI ID in the Terraform configuration to a new hardened image. The instance is currently running an older AMI. What does Terraform plan for this resource during the next `terraform apply`?

Your organization has a Sentinel policy with enforcement level 'soft-mandatory' that checks for required tags on AWS resources. During a run, the policy fails because an EC2 instance is missing the 'Environment' tag. The workspace allows users with write access to override policies. What is the immediate outcome of the run?

Which of the following are true regarding the .terraform.lock.hcl file? (Select TWO)

You have two resources, A and B. You want B to be replaced whenever A is updated. How do you configure B?

An engineer is authoring a reusable module that accepts variable "subnets", typed as map(object({ cidr_block = string, public = bool })). The module must create one aws_subnet per entry, attaching an aws_route_table_association only when that entry's public attribute is true. The association resource must not appear at all for private subnets, and its key must match the subnet's map key. Which approach satisfies these requirements with the least waste?

Why would you use a 'locals' block within a module instead of passing everything through variables?

You are creating a custom provider. What is the standard language used to write Terraform providers?

What is the impact of using 'sensitive = true' in a module output?

You are designing a reusable Terraform module that will be consumed by multiple teams. To ensure the module is maintainable and follows best practices, which TWO of the following should you implement? (Choose two.)

Which TWO of the following are true regarding OPA/Sentinel policies?

When a module is updated, how do you ensure that all environments using this module get the update?

Why might someone use 'prevent_destroy = true' on a database resource while allowing it on smaller web server instances?

Your organization uses HCP Terraform with a private module registry. A platform team publishes a module that provisions an Amazon RDS instance, and several application teams consume it across different workspaces. The platform team must release a backwards-incompatible change to the module's `engine_version` variable, but they do not want existing consumers to break on their next run. Which two actions should the platform team take to safely version and publish this change? (Choose two.)

You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?