TF-004 Terraform Cloud Workspace Settings Practice Question
An organization uses Terraform Cloud to manage infrastructure across multiple teams. They need to enforce that all workspaces use a specific version of Terraform and that no workspace can be deleted accidentally. Which approach meets these requirements without using Sentinel or Terraform Enterprise?
⚠ Common exam trap
Candidates may think that built-in workspace settings are not enough to enforce global compliance, but administrators can enforce these settings via organization defaults or API scripts. OPA integration is often mistakenly assumed to be available natively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.
Terraform Cloud allows configuring the Terraform version at the workspace level, ensuring a specific version is used. The 'Prevent deletion' option in workspace settings protects against accidental deletion. While per-workspace, administrators can enforce these settings across workspaces via API or organization defaults. Options A and B do not prevent deletion; Option C is incorrect because OPA is not natively integrated—Sentinel is the built-in policy engine but is excluded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Include `required_version` in each workspace's root module and configure workspace locks in the UI.
Why it's wrong here
Including `required_version` in a root module enforces the minimum Terraform CLI version required to parse and execute *that specific configuration*. However, this only acts as a check during execution and does not dictate the default or enforced Terraform version for the entire Terraform Cloud workspace. Configuring workspace locks in the UI prevents concurrent runs on a workspace, but it does not offer any protection against the accidental or intentional deletion of the workspace itself.
- ✗
Set `required_providers` with version constraints in a global Terraform file.
Why it's wrong here
Setting `required_providers` with version constraints in a Terraform configuration file only specifies the acceptable versions for the *providers* used by the configuration, such as `aws` or `azurerm`. This mechanism does not control the Terraform CLI version that Terraform Cloud uses to execute the plan and apply. Furthermore, this configuration block offers no functionality to prevent the deletion of a Terraform Cloud workspace itself.
- ✗
Use the Terraform Cloud API to write an OPA policy that enforces Terraform version and prevents workspace deletion.
Why it's wrong here
Open Policy Agent (OPA) is not the native policy engine for Terraform Cloud; Sentinel is the integrated solution for policy as code. While OPA can be integrated into a CI/CD pipeline or as a custom run task, it cannot directly enforce the Terraform CLI version used by a Terraform Cloud workspace or prevent workspace deletion at the platform level. The Terraform Cloud API does not expose direct OPA policy enforcement for these specific workspace settings.
- ✓
Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.
Why this is correct
Terraform Cloud workspaces offer explicit settings to define the exact Terraform CLI version used for all runs within that workspace, ensuring consistent execution environments regardless of the configuration's `required_version`. Additionally, a dedicated "Prevent deletion" safeguard can be enabled directly in the workspace settings. This critical feature protects against accidental or unauthorized removal of the workspace and its associated infrastructure state.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.