TF-004 Use Terraform outside the core workflow Practice Question
A company uses Terraform Cloud with a remote state backend and runs infrastructure as code through a CI/CD pipeline (GitHub Actions). The pipeline executes 'terraform plan' and 'terraform apply' using a service account with appropriate permissions. Recently, the team introduced a Sentinel policy to enforce that all AWS resources have mandatory tags (Environment, Owner, Project). The policy passes when runs are triggered manually from the Terraform Cloud UI, but fails consistently when the CI/CD pipeline runs the plan. The infrastructure configuration files are identical in both cases. The team verifies that the service account used by CI/CD has the same workspace permissions as the UI user. What is the most likely cause of the failure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CI/CD pipeline is using a different set of variables that override the tags.
The Sentinel policy enforces mandatory tags on AWS resources. When the CI/CD pipeline runs, it may use different variable definitions (e.g., from environment variables or variable files) that override the Terraform variables for tags. If the pipeline sets missing or incorrect tag values, the policy fails. Manual UI runs likely use the workspace's default variable values, which satisfy the policy. Since the configuration files are identical, the discrepancy is due to variable overrides from the pipeline, making Option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Sentinel policy is checking the wrong workspace.
Why it's wrong here
Sentinel policies are inherently scoped to specific organizations or workspaces within Terraform Cloud. If a manual run against a particular workspace passes its Sentinel checks, it confirms that the policy is correctly associated and evaluating that workspace. Therefore, if a CI/CD pipeline targets the *same* workspace and fails, the issue isn't the policy checking the wrong location, but rather what the policy is evaluating within that correct location.
- ✓
The CI/CD pipeline is using a different set of variables that override the tags.
Why this is correct
Terraform Cloud allows variables to be set at various levels, with a specific order of precedence. A CI/CD pipeline often initiates runs via the Terraform Cloud API, which can include `TF_VAR_` environment variables or `terraform.tfvars` content that overrides variables configured directly in the workspace UI. If the pipeline injects different tag values through these mechanisms, the resulting Terraform plan will differ, causing the Sentinel policy to detect a non-compliant resource configuration.
- ✗
The Sentinel policy is configured to fail on all plans regardless of compliance.
Why it's wrong here
A Sentinel policy configured to unconditionally fail all plans would consistently block every Terraform run, regardless of its origin or the resources it proposes. Since manual runs are successfully passing policy checks, this definitively indicates that the policy is not set to fail universally. Instead, the policy must be evaluating specific conditions and only failing when those conditions are met, which is not the case during manual execution.
- ✗
The CI/CD pipeline is using an older version of Terraform that does not support Sentinel.
Why it's wrong here
Sentinel policy evaluation is an intrinsic feature of the Terraform Cloud remote backend and its run environment, not dependent on the Terraform CLI version used locally. When a CI/CD pipeline initiates a remote run, the generated plan is uploaded to Terraform Cloud, where the policy engine performs the Sentinel checks. Thus, the version of Terraform CLI used in the pipeline is irrelevant to whether Sentinel itself is supported or evaluated.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.