HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 31:

  A terraform apply can not___________infrastructure.

  A. import

  B. provision

  C. destroy

  D. change

  Correct Answer: A

• Question 32:

  If a Terraform creation-time provisioner fails, what will occur by default?

  A. The resource will not be affected, but the provisioner will need to be applied again

  B. The resource will be destroyed

  C. The resource will be marked as "tainted"

  D. Nothing, provisioners will not show errors in the command line

  Correct Answer: C

  If a creation-time provisioner fails, the resource is marked as tainted. A tainted resource will be planned for destruction and recreation upon the next terraform apply .

• Question 33:

  You've used Terraform to deploy a virtual machine and a database. You want to replace this virtual machine instance with an identical one without affecting the database. What is the best way to achieve this using Terraform?

  A. Use the Terraform taint command targeting the VMs then run Terraform plan and Terraform apply

  B. Delete the Terraform VM resources from your Terraform code then run Terraform plan and terraform apply

  C. Use the terraform apply command targeting the VM resources only

  D. Use the terraform state rm command to remove the VM from state file

  Correct Answer: A

  https://www.terraform.io/cli/state/taint

• Question 34:

  Which one is the right way to import a local module names consul?

  A. module "consul" { source = "consul"}

  B. module "consul" { source = "./consul"}

  C. module "consul" { source = "../consul"}

  D. module "consul" { source = "module/consul"}

  Correct Answer: BC

  A local path must begin with either ./ or ../ to indicate that a local path is intended, to distinguish from a module registry address.

  module "consul" {

  source = "./consul"

  }

• Question 35:

  You have to initialize a Terraform backend before it can be configured.

  A. True

  B. False

  Correct Answer: A

  Initialization

  Whenever a configuration's backend changes, you must run terraform init again to validate and configure the backend before you can perform any plans, applies, or state operations.

  When changing backends, Terraform will give you the option to migrate your state to the new backend. This lets you adopt backends without losing any existing state.

  To be extra careful, we always recommend manually backing up your state as well. You can do this by simply copying your terraform.tfstate file to another location. The initialization process should create a backup as well, but it never hurts to

  be safe!

  https://www.terraform.io/language/settings/backends/configuration

• Question 36:

  Where can Terraform not load a provider from?

  A. Plugins directory

  B. Provider plugin cache

  C. Official HashrCorp distribution on releases, hashicorp.com

  D. Source code

  Correct Answer: D

• Question 37:

  Which task does teraform init not perform?

  A. Sources any modules and copies the configuration locally

  B. Validates all required variables are present

  C. Connects to the backend

  D. Sources all providers present in the configuration and ensures they are downloaded and available locally

  Correct Answer: B

• Question 38:

  What does terraform refresh modify?

  A. Your cloud infrastructure

  B. Your Terraform plan

  C. Your state file

  D. Your Terraform configuration

  Correct Answer: C

• Question 39:

  You have written a terraform IaC script which was working till yesterday , but is giving some vague error from today , which you are unable to understand . You want more detailed logs that could potentially help you troubleshoot the issue , and understand the root cause. What can you do to enable this setting? Please note , you are using terraform OSS.

  A. Terraform OSS can push all its logs to a syslog endpoint. As such, you have to set up the syslog sink, and enable TF_LOG_PATH env variable to the syslog endpoint and all logs will automatically start streaming.

  B. Detailed logs are not available in terraform OSS, except the crash message. You need to upgrade to terraform enterprise for this point.

  C. Enable the TF_LOG_PATH to the log sink file location, and logging output will automatically be stored there.

  D. Enable TF_LOG to the log level DEBUG, and then set TF_LOG_PATH to the log sink file location. Terraform debug logs will be dumped to the sink path, even in terraform OSS.

  Correct Answer: D

  Terraform has detailed logs which can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr. You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN or ERROR to change the verbosity of the logs. TRACE is the most verbose and it is the default if TF_LOG is set to something other than a log level name. To persist logged output you can set TF_LOG_PATH in order to force the log to always be appended to a specific file when logging is enabled. Note that even when TF_LOG_PATH is set, TF_LOG must be set in order for any logging to be enabled.

• Question 40:

  Your risk management organization requires that new AWS S3 buckets must be private and encrypted at rest. How can Terraform Enterprise automatically and proactively enforce this security control?

  A. With a Sentinel policy, which runs before every apply

  B. By adding variables to each TFE workspace to ensure these settings are always enabled

  C. With an S3 module with proper settings for buckets

  D. Auditing cloud storage buckets with a vulnerability scanning tool

  Correct Answer: A

  https://docs.hashicorp.com/sentinel/intro/what https://medium.com/hashicorp-engineering/enforcing-aws-s3-security-best-practice-using-terraform-sentinel-ddcd181ff4b7