QUESTION: 193

The Security Operations team of ABC Enterprise wants to mandate that all the Terraform configuration that creates an S3 bucket must have encryption feature enabled. What is the best way to achieve it?

Use Sentinel Policies.
Use S3 bucket policy.
Create a script that checks the encryption parameter is enabled on every git commit.
Shared a SOP to engineers to mandate encryption feature on S3.

Answer(s): A

Explanation:

Sentinel is an embedded policy-as-code framework integrated with the HashiCorp Enterprise products. It enables fine-grained, logic-based policy decisions, and can be extended to use information from external sources.
Using Sentinel with Terraform Cloud involves:
* Defining the policies - Policies are defined using the policy language with imports for parsing the Terraform plan, state and configuration.
* Managing policies for organizations - Users with permission to manage policies can add policies to their organization by configuring VCS integration or uploading policy sets through the API. They also define which workspaces the policy sets are checked against during runs. (More about permissions.)

* Enforcing policy checks on runs - Policies are checked when a run is performed, after the terraform plan but before it can be confirmed or the terraform apply is executed.
* Mocking Sentinel Terraform data - Terraform Cloud provides the ability to generate mock data for any run within a workspace. This data can be used with the Sentinel CLI to test policies before deployment.

Reference:

https://www.terraform.io/docs/cloud/sentinel/index.html

Reveal Solution Next Question

QUESTION: 194

A colleague has informed you that a new version of a Terraform module that your team hosts on an Amazon S3 bucket is broken. The Amazon S3 bucket has versioning enabled. Your colleague tells you to make sure you are not using the latest version in your configuration. You have the following configuration block in your code that refers to the module:
module "infranet" { source = "s3::https://s3-us-west- 2.amazonaws.com/infrabucket/infra_module.zip"}
What is the best way to ensure that you are not using the latest version of the module?

Add a module version constraint in your configuration's backend block and specify a previous version.
Add a version key to the module configuration and specify a previous version.
Delete the latest version of the module in S3 to rollback to the previous version.
Add a version property to the module in Terraform's state file and specify a previous version.

Answer(s): C

Explanation:

Version constraints are supported only for modules installed from a module registry, such as the Terraform Registry or Terraform Cloud's private module registry. Other module sources can provide their own versioning mechanisms within the source string itself, or might not support versions at all. In particular, modules sourced from local file paths do not support version; since they're loaded from the same source repository.
Only Terraform Registries support module versioning by using the version key, one cannot configure a previous version of the module in the configuration. Deleting the latest version of the module in S3 is the only option of the available options that ensures you won't use the latest version. You could also modify the source URL to specify a versionId URL parameter for a previous version. https://www.terraform.io/docs/configuration/modules.html#source

Reveal Solution Next Question

QUESTION: 195

Which of the following are string functions? Select three

tostring
tonumber
Chomp
format
join

Answer(s): C,D,E

Explanation:

tonumber and tostring are Type Conversion function

Reference:

https://www.terraform.io/docs/configuration/functions.html

Reveal Solution Next Question

QUESTION: 196

What kind of resource dependency is stored in terraform.tfstate file?

Both implicit and explicit dependencies are stored in state file.
Only explicit dependencies are stored in state file.
Only implicit dependencies are stored in state file.
No dependency information is stored in state file.

Answer(s): A

Explanation:

Terraform state captures all dependency information, both implicit and explicit. One purpose for state is to determine the proper order to destroy resources. When resources are created all of their dependency information is stored in the state. If you destroy a resource with dependencies, Terraform can still determine the correct destroy order for all other resources because the dependencies are stored in the state. https://www.terraform.io/docs/state/purpose.html#metadata

Reveal Solution Next Question

Free Terraform Associate Exam Braindumps (page: 49)

QUESTION: 193

Explanation:

Reference:

QUESTION: 194

Explanation:

QUESTION: 195

Explanation:

Reference:

QUESTION: 196

Explanation: