Use Terraform outside the core workflow →mediumMultiple ChoiceObjective-mapped

TF-004 Use Terraform outside the core workflow Practice Question

A company uses Terraform Cloud and wants to enforce policy checks before any apply. They have a set of Sentinel policies. Where should they configure these policies to run automatically on all runs?

⚠ Common exam trap

Many exam-takers confuse the VCS webhook trigger (which starts a run) with the policy enforcement mechanism, or mistakenly think Sentinel policies can be invoked via CLI flags, when in fact Terraform Cloud requires Policy Sets attached to workspaces for automatic policy checks.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a Policy Set in Terraform Cloud and attach to workspaces.

Terraform Cloud uses Policy Sets to group Sentinel policies and enforce them automatically on all runs for attached workspaces. When a Policy Set is associated with one or more workspaces, the policies are evaluated during the plan phase before any apply, blocking the run if any policy fails. This is the native mechanism in Terraform Cloud for automated policy enforcement without manual intervention.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
In the terraform apply command with -policy flag.
Why it's wrong here
Terraform CLI commands, specifically `terraform apply`, do not include a `-policy` flag or any direct mechanism to enforce policies during local execution. Policy enforcement in Terraform Cloud is a platform-level feature that occurs during the run lifecycle, not via CLI flags passed to `terraform apply`, which primarily focuses on executing the infrastructure changes defined in the plan.
✗
Configure a webhook in the VCS to run policy checks.
Why it's wrong here
While webhooks from a Version Control System (VCS) are indeed used to trigger Terraform Cloud runs (e.g., on a pull request or merge), they do not directly configure or execute policy checks themselves. Policy enforcement is an integrated step within the Terraform Cloud run lifecycle, which is initiated by the webhook, but the webhook's role is solely to signal the start of a run, not to define or manage policy behavior.
✓
Create a Policy Set in Terraform Cloud and attach to workspaces.
Why this is correct
Terraform Cloud enforces policies through Policy Sets, which are collections of Sentinel or OPA policies designed to evaluate infrastructure plans. To enforce a specific policy, an administrator must create a Policy Set, add the desired policy to it, and then attach that Policy Set to the relevant workspaces. During a Terraform Cloud run, these policies are evaluated after the plan phase and before the apply phase, blocking non-compliant infrastructure changes from being provisioned.
✗
Deploy a Terraform Enterprise instance with custom policy.
Why it's wrong here
While Terraform Enterprise does support custom policy enforcement and offers advanced governance features, it is an on-premises or self-hosted solution distinct from Terraform Cloud. The question explicitly states the company uses Terraform Cloud, which natively includes robust policy as code capabilities through Policy Sets, making the deployment of a separate Terraform Enterprise instance unnecessary and an overcomplication for this requirement.

Go deeper

TF-004 Use Terraform outside the core workflow Practice Question

Why each option matters

Option-by-option breakdown

Related to this question