33 questions · Hcp Terraform Governance topic · All types, answers revealed
If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?
Reviewing the Policy Set logs helps identify if a policy script is hanging or failing.
Why this answer
If the policy check is stuck, it may indicate a timeout or an issue with the policy engine execution environment.
Which TWO of the following scenarios would lead to an 'Error' status in a Terraform run within HCP Terraform?
Authentication failures cause the plan phase to error out.
Why this answer
Errors occur during the plan phase if the configuration is invalid or if there are provider authentication failures.
You want to trigger a run only when a specific file within a module path changes. How do you configure this?
VCS path filters allow you to restrict runs to specific directories.
Why this answer
The VCS path filter in the workspace configuration allows you to define which directory changes trigger a new run.
Which TWO of the following are required to successfully integrate VCS with HCP Terraform?
This establishes the link between the two services.
Why this answer
A VCS connection requires an OAuth application authorized in your VCS provider and the connection setup in the HCP Terraform organization settings.
Which THREE of the following are required components of a Sentinel Policy Set?
The set must contain the actual policies.
Why this answer
Policy sets require a name, a link to the policy code (VCS), and a definition of which workspaces apply to the policies.
In the context of team permissions, what does the 'Admin' role on an organization allow?
Organization admins have broad permissions over the entire environment.
Why this answer
The organization Admin role provides full control over all projects, workspaces, and team memberships within the organization.
Which TWO of the following are valid ways to trigger a run in an HCP Terraform workspace?
VCS integration is a primary trigger method.
Why this answer
Runs can be triggered via manual clicks in the UI or by pushing code changes to a connected VCS repository.
You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?
Policy Sets are the containers for Sentinel policies applied to workspaces.
Why this answer
Sentinel policies are written in HCL and uploaded to Policy Sets, which are then associated with workspaces.
A team reports that their Terraform plan is failing because it cannot find a provider version. What is the most likely cause if the provider is in the Private Module Registry?
Terraform requires explicit declaration of provider requirements.
Why this answer
Providers and Modules are different concepts in HCP Terraform. If a provider is required, it must be available in the registry or the provider cache.
Which THREE of the following items can be included in a Variable Set?
Standard Terraform input variables.
Why this answer
Variable sets can contain Terraform variables, environment variables, and can be scoped to specific projects or organizations.
You need to automate the publication of a module to the Private Module Registry. What should you do?
Tagging a version in the VCS repo is the standard trigger for module publication.
Why this answer
HCP Terraform monitors your VCS repository; when you push a new release tag (e.g., v1.0.0), it automatically triggers the publication to the registry.
Where can you define variables that apply to all workspaces within an organization in HCP Terraform?
Variable Sets are designed for global or group-wide variable management.
Why this answer
Variable Sets allow you to group variables and apply them across multiple workspaces simultaneously.
What is the purpose of 'Project' in HCP Terraform?
Projects provide a logical grouping for workspaces and RBAC scope.
Why this answer
Projects are used to group workspaces, allowing for easier team permission management and organization.
Which THREE of the following are benefits of using projects to organize workspaces?
Organizing by project makes it easier for users to find relevant workspaces.
Why this answer
Projects improve team isolation, simplify permission management, and help structure large organizations.
If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?
Project-based RBAC allows for granular isolation between teams.
Why this answer
By creating separate Projects and assigning teams specific permissions only to their relevant Projects, you achieve isolation.
Which of the following can be used to monitor costs in an HCP Terraform workspace?
Cost estimation provides financial impact analysis during plan.
Why this answer
Cost Estimation is the specific feature for tracking the monetary impact of infrastructure changes.
A team is using the Private Module Registry and needs to ensure that only approved module versions are available for use in workspaces. Which feature should they implement?
Sharing levels in the Private Module Registry allow you to define who can see and use your modules.
Why this answer
Module sharing levels allow teams to restrict access to modules, but 'Module Versioning' and 'Module Status' (beta/deprecated) are the standard ways to manage availability in the Private Module Registry.
Which TWO of the following are true regarding Private Module Registry versioning?
HCP Terraform requires SemVer for module versions.
Why this answer
Versions are managed by tags in VCS, and Semantic Versioning (SemVer) is required.
Which type of Sentinel policy is used to block a run without possibility of override?
Hard-mandatory policies cannot be overridden.
Why this answer
Hard-mandatory policies require the policy to pass before the run can proceed; they cannot be overridden.
How can you view the detailed breakdown of cost estimates for a specific Terraform plan?
The UI provides the interface to view cost estimation data.
Why this answer
The run details page in the HCP Terraform UI displays the cost estimation summary, which can be expanded for details.
What happens if a Sentinel policy results in an 'advisory' output?
Advisory policies are for non-blocking feedback.
Why this answer
Advisory policies provide information or warnings in the run logs but do not block the execution.
When configuring team permissions, what does the 'Workspace: Settings' permission allow?
Settings permission specifically grants access to configure the workspace environment.
Why this answer
The 'Settings' permission allows users to modify workspace configurations, including variable sets and notification settings.
Which THREE of the following attributes are available to a Sentinel policy via the 'tfrun' import?
The policy knows the actor.
Why this answer
The 'tfrun' import provides access to metadata about the current run, including the workspace, the user, and the organization.
When using Cost Estimation in HCP Terraform, which of the following is true?
Only providers with specific cost metadata support this feature.
Why this answer
HCP Terraform uses the current plan to calculate cost impact against the existing state.
How can you restrict the ability of team members to delete workspaces?
Project-level permissions allow managing workspace lifecycles.
Why this answer
RBAC in HCP Terraform is granular. You must ensure users do not have the 'Admin' or 'Delete' permissions on the specific workspace.
Which of the following is an advantage of using Variable Sets?
Centralization is the primary purpose of Variable Sets.
Why this answer
Variable Sets avoid duplication by allowing you to define a set of variables once and reuse them across multiple workspaces.
Which of the following is a primary benefit of using a Private Module Registry?
This is the core value proposition of the Private Module Registry.
Why this answer
The Private Module Registry allows organizations to share verified, reusable infrastructure code internally.
Which THREE of the following can be managed using team permissions in HCP Terraform?
Permissions control who can see projects.
Why this answer
Permissions control access to workspaces, projects, and the registry.
You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?
Queue Plan allows triggering runs, while Read allows viewing logs without changing variables.
Why this answer
The 'read' and 'write' permissions are distinct. Specifically, the 'Plan' permission allows triggering runs, while 'Manage' permissions are required for variables.
A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?
Policies run after the plan; if cost estimation hasn't finalized, the policy might throw an error.
Why this answer
Sentinel policies can access the cost estimation data via the 'tfrun' import, but if the estimation is still in progress or failed to generate, the policy will fail.
What is the result of a 'soft-mandatory' Sentinel policy failing during a run?
Soft-mandatory policies require manual override to proceed.
Why this answer
Soft-mandatory policies allow a user with the appropriate permissions to override the failure and continue the run.
You need to ensure that all workspaces use a specific set of tags. How can this be enforced?
Sentinel can evaluate workspace attributes via the 'tfrun' import.
Why this answer
Sentinel can inspect the workspace configuration metadata, including tags, to ensure compliance.
Which TWO of the following are standard stages of an HCP Terraform run pipeline?
Policy checking follows the plan.
Why this answer
The pipeline consists of Plan, Policy Check, and Apply stages.
Ready to test yourself?
Try a timed practice session using only Hcp Terraform Governance questions.