Use Terraform outside the core workflow →mediumMultiple SelectObjective-mapped

TF-004 Use Terraform outside the core workflow Practice Question

Which TWO of the following are benefits of using Terraform Cloud Run Tasks?

⚠ Common exam trap

The exam often tests the distinction between Run Tasks (automated, third-party integrations) and other Terraform Cloud features like Sentinel policies (custom policy enforcement) or manual approvals, leading candidates to confuse Run Tasks with approval gates or cost-saving features.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Integrate with third-party tools for security scanning.

Terraform Cloud Run Tasks allow integration with third-party tools for security scanning, policy enforcement, or other validations during the plan/apply lifecycle. This is achieved by configuring run tasks that call external services via webhooks, enabling automated checks before provisioning proceeds.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Integrate with third-party tools for security scanning.
Why this is correct
Terraform Cloud Run Tasks enable seamless integration with third-party security scanning tools by allowing them to execute as part of the `terraform plan` or `terraform apply` workflow. These tasks can invoke external services to perform static analysis, vulnerability checks, or compliance scans on the planned infrastructure. If the security tool identifies issues, the Run Task can fail the Terraform run, preventing the deployment of non-compliant or insecure resources.
✗
Simplify state management by offloading to Terraform Cloud.
Why it's wrong here
Run Tasks are designed to execute external checks or actions during a Terraform run, not to manage Terraform state itself. Terraform Cloud inherently handles remote state management, including state locking and versioning, as a fundamental feature of its remote operations backend. This core state management functionality operates independently of whether any Run Tasks are configured or executed within a workspace.
✗
Provide an approval gate for manual intervention.
Why it's wrong here
While Terraform Cloud does offer approval gates, such as 'Require approval for plans,' these are distinct features configured at the workspace level or through Sentinel policies. Run Tasks, in contrast, execute external processes and return a pass/fail status, which can block an apply if failed. They do not inherently provide a mechanism to pause a run for manual intervention or explicit human approval.
✓
Enforce custom policies before allowing an apply.
Why this is correct
Run Tasks provide a powerful mechanism to enforce custom organizational policies by integrating external policy engines or custom scripts directly into the Terraform workflow. These tasks can evaluate the planned infrastructure changes against predefined compliance standards, security baselines, or architectural best practices. If a policy violation is detected, the Run Task can explicitly fail the Terraform run, effectively preventing the deployment of non-compliant infrastructure.
✗
Automatically reduce costs by identifying unused resources.
Why it's wrong here
Run Tasks are primarily designed for integrating external processes like security checks, policy enforcement, or custom validations into the Terraform lifecycle. Their core purpose is not to automatically identify unused resources or directly reduce cloud costs. While a Run Task could potentially trigger an external cost analysis tool, dedicated cloud cost management platforms are typically responsible for comprehensive cost optimization and resource utilization analysis.

Go deeper

TF-004 Use Terraform outside the core workflow Practice Question

Why each option matters

Option-by-option breakdown

Related to this question