Spring Sale Limited Time 65% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: pass65
marks4sure logo
Terraform-specific settings and behaviors are declared in which configuration block type?
What system endpoint can you query to determine which node is the leader of a cluster?
When using parent/child modules to deploy infrastructure, how would you export value from one module to import into another module?
For example, a module dynamically deploys an application instance or virtual machine, and you need the IP address in another module to configure a related DNS record in order to reach the newly deployed application.
Which of the following secrets engine can generate dynamic credentials? (select three)
Complete the following sentence:
For the local state, the workspaces are stored directly in a...
While Terraform is generally written using the HashiCorp Configuration Language (HCL), what another syntax can Terraform be expressed in?
From the options below, select the benefits of using the PKI (certificates) secrets engine: (select three)
In regards to deploying resources in multi-cloud environments, what are some of the benefits of using Terraform rather than a provider ' s native tooling? (select three)
Which two characters can be used when writing a policy to reflect a wildcard or path segment? (select two)
Which of the following is not an activity associated with the Vault transit secrets engine?
If a client is currently assigned the following policy, what additional policy can be added to ensure they cannot access the data stored at secret/apps/confidential but still, read all other secrets?
Which of the following policies would permit a user to generate dynamic credentials on a database?
In order to extend a Consul storage backend, Consul nodes should be provisioned across multiple data centers or cloud regions.
To prepare for day-to-day operations, the root token should be safety saved outside of Vault in order to administer Vault
Which of the following unseal options can automatically unseal Vault upon the start of the Vault service? (select four)
True or False:
Similar to how Vault works with databases and cloud providers, the Active Directory secrets engine dynamically generates the account and password for the requesting Vault client.
What are the primary benefits of running Vault in a production deployment over dev server mode? (select two)
Using multi-cloud and provider-agnostic tools provides which of the following benefits? (select two)
Vault ' s User Interface (UI) needs to be enabled in the command line before it can be used.
While Vault provides businesses tons of functionality out of the box, what feature allows you to extend its functionality with solutions written by third-party providers?
True or False:
Multiple providers can be declared within a single Terraform configuration file.
When using constraint expressions to signify a version of a provider, which of the following are valid provider versions that satisfy the expression found in the following code snippet: (select two)
1. terraform {
2. required_providers {
3. aws = " ~ > 1.2.0 "
4. }
5. }
Which of the following storage backends are supported by HashiCorp technical support? (select four)
Beyond encryption and decryption of data, which of the following is not a function of the Vault transit secrets engine?
Why might a user opt to include the following snippet in their configuration file?
1. terraform {
2. required_version = " > = 0.12 "
3. }
From the code below, identify the implicit dependency:
1. resource " aws_eip " " public_ip " {
2. vpc = true
3. instance = aws_instance.web_server.id
4. }
5. resource " aws_instance " " web_server " {
6. ami = " ami-2757f631 "
7. instance_type = " t2.micro "
8. depends_on = [aws_s3_bucket.company_data]
9. }
The userpass auth method has the ability to access external services in order to provide authentication to Vault.
When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?
Given the Terraform configuration below, in which order will the resources be created?
1. resource " aws_instance " " web_server " {
2. ami = " i-abdce12345 "
3. instance_type = " t2.micro "
4. }
5. resource " aws_eip " " web_server_ip " {
6. vpc = true
7. instance = aws_instance.web_server.id
8. }
Why is it a good idea to declare the required version of a provider in a Terraform configuration file?
1. terraform {
2. required_providers {
3. aws = " ~ > 1.0 "
4. }
5. }
Vault has failed to start. You inspect the log and find the error below. What needs to be changed in order to successfully start Vault?
" Error parsing config.hcl: At 1:12: illegal char "
What Terraform feature is shown in the example below?
1. resource " aws_security_group " " example " {
2. name = " sg-app-web-01 "
3. dynamic " ingress " {
4. for_each = var.service_ports
5. content {
6. from_port = ingress.value
7. to_port = ingress.value
8. protocol = " tcp "
9. }
10. }
11. }
Select two answers to complete the following sentence:
Before a new provider can be used, it must be ______ and _______.
You are deploying Vault in a local data center, but want to be sure you have a secondary cluster in the event the primary cluster goes offline. In the secondary data center, you have applications that are running, as they are architected to run active/active. Which type of replication would be best in this scenario?
Which flag would be used within a Terraform configuration block to identify the specific version of a provider required?
True or False? By default, Terraform destroy will prompt for confirmation before proceeding.
After executing a terraform apply, you notice that a resource has a tilde (~) next to it. What does this infer?
Terraform Cloud is more powerful when you integrate it with your version control system (VCS) provider. Select all the supported VCS providers from the answers below. (select four)
What is a downside to using a Terraform provider, such as the Vault provider, to interact with sensitive data, such as reading secrets from Vault?
Unsealing Vault creates the encryption keys, which is used to unencrypt the data on the storage backend.
In order to extend Vault beyond a data center or cloud regional boundary, what feature should be used?
When using providers that require the retrieval of data, such as the HashiCorp Vault provider, in what phase does Terraform actually retrieve the data required?
An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don ' t need to write a new one for each new user? With the requirements listed below, what would such a policy look like?
Requirement: Each user can perform all operations on their allocated key/value secret path
A " backend " in Terraform determines how the state is loaded and how an operation such as apply is executed. Which of the following is not a supported backend type?
TESTED 02 May 2026
