TF-004 Read, generate and modify configuration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  First, define the output as sensitive. Next, run terraform apply. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.

  Why this is correct

  This sequence correctly outlines the process for handling sensitive data. Defining the output as sensitive in the configuration *before* running `terraform apply` ensures that Terraform marks the value as sensitive within the state file. After `terraform apply` provisions resources and stores their outputs, `terraform output -json` is the specific command required to explicitly retrieve the raw, unredacted sensitive value from the state for programmatic use. Finally, with the raw value obtained, it can then be securely handled, such as being passed to a secret management system or encrypted for storage.

• ✗

  First, run terraform apply. Next, define the output as sensitive. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.

  Why it's wrong here

  This order is incorrect because the `sensitive = true` attribute must be defined in the output block *before* `terraform apply` is executed. If `terraform apply` runs first, the output value will be written to the state file without the sensitive flag, potentially exposing it in logs or standard output. Even if the output is subsequently marked sensitive, the initial value might have already been stored or displayed in an insecure manner, defeating the purpose of the sensitivity declaration.

• ✗

  First, define the output as sensitive. Next, use terraform output -json to retrieve the raw value. Then, run terraform apply. Finally, securely handle the raw value.

  Why it's wrong here

  This sequence is incorrect because `terraform output -json` cannot be used to retrieve a value before `terraform apply` has been executed. The `terraform output` command, regardless of flags, reads values from the Terraform state file. Prior to `terraform apply`, resources are not provisioned, and their output values have not been computed or written into the state, meaning there is no data for `terraform output` to retrieve.

• ✗

  First, define the output as sensitive. Next, run terraform apply. Then, securely handle the raw value. Finally, use terraform output -json to retrieve the raw value.

  Why it's wrong here

  This order is incorrect because one cannot "securely handle the raw value" before actually retrieving it. When an output is marked sensitive, `terraform apply` stores it in the state, but `terraform output` (without the `-json` flag) will redact the value from console output. To access the actual raw sensitive data for handling, it must first be explicitly extracted from the state using `terraform output -json`.

Go deeper

Related to this question