TF-004 Interact with Terraform modules Practice Question
A module defines an input variable with 'sensitive = true'. The root module tries to use that variable in an output block. What happens when running 'terraform apply'?
⚠ Common exam trap
The Terraform exam often tests the misconception that sensitive variables cause errors or are completely removed from the plan, when in fact they are only hidden from CLI output but persist in the state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The output value is hidden in the CLI output but still available in the state.
When a variable is marked `sensitive = true`, Terraform prevents its value from being displayed in CLI output for any output that references it. However, the value is still stored in the state file and can be used within the module. Therefore, `terraform apply` succeeds, but the output value is hidden in the CLI output while remaining available in the state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The output value is hidden in the CLI output but still available in the state.
Why this is correct
When an output value is marked as sensitive = true, Terraform intentionally obfuscates its display in CLI operations like terraform plan, terraform apply, and terraform output. This prevents accidental exposure of secrets in terminal logs or shared screens. However, for Terraform to manage and track the infrastructure correctly, the actual sensitive value is still persisted unencrypted within the terraform.tfstate file, making it accessible to Terraform itself for subsequent operations.
- ✗
The apply fails with an error because sensitive variables cannot be used in outputs.
Why it's wrong here
Terraform does not prevent sensitive input variables from being used within output values; therefore, the apply operation will not fail. The sensitive = true attribute on an output simply instructs Terraform to mask the value when displayed in the CLI, rather than causing an error or preventing its use. The terraform apply command will execute successfully, and the output will be created, but its value will be hidden from standard console output.
- ✗
The output is displayed normally because outputs are always visible.
Why it's wrong here
This statement is incorrect because when an output value is explicitly marked with sensitive = true in its definition, or if it directly references a sensitive input variable or resource attribute, Terraform will not display its value normally. Instead, Terraform will replace the actual value with (sensitive) in the CLI output, ensuring that sensitive information is not inadvertently exposed to users viewing the terminal.
- ✗
The output is removed from the plan entirely to protect the sensitive value.
Why it's wrong here
Terraform does not remove sensitive outputs from the plan entirely. During a terraform plan operation, any output explicitly marked as sensitive = true will still be listed, but its value will be replaced with (sensitive) in the plan output. This ensures that users are aware of the output's existence and its sensitive nature, without revealing the actual secret value.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.