QUESTION: 257

Your team lead does not trust the junior terraform engineers who now have access to the git repo . So , he wants you to have some sort of a checking layer , whereby , you can ensure that the juniors will not create any non-compliant resources that might lead to a security audit failure in future. What can you do to efficiently enforce this?

Create a design /security document (in PDF) and share to the team , and ask them to always follow that document , and never deviate from it.
Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them.
Use Terraform OSS Sentinel Lite version , which will save cost , since there is no charge for OSS , but it can still check for most non-compliant rules using Policy-As-Code.
Create a git master branch , and implement PR . Every change needs to be reviewed by you , before being merged to the master branch.

Answer(s): B

Explanation:

Sentinel is an embedded policy-as-code framework integrated with the HashiCorp Enterprise products. It enables fine-grained, logic-based policy decisions, and can be extended to use information from external sources.

Reference:

https://www.terraform.io/docs/cloud/sentinel/index.html

Reveal Solution Next Question

QUESTION: 258

Which of the following connection types are supported by the remote-exec provisioner? (select two)

WinRM
UDP
SMB
RDP
ssh

Answer(s): A,E

Explanation:

The remote-exec provisioner invokes a script on a remote resource after it is created. The remote- exec provisioner supports both ssh and winrm type connections.
remote-exec connection types -
* ssh on Linux
* winrm on Windows

Reference:

https://www.terraform.io/docs/provisioners/remote-exec.html

Reveal Solution Next Question

QUESTION: 259

Select all features which are exclusive to Terraform Enterprise. (Select Three)

Sentinel
Cost Estimation
Audit Logs
Clustering
SAML/SSO

Answer(s): C,D,E

Explanation:

Sentinel and Cost Estimation are also available in Terraform Cloud

Reference:

https://www.hashicorp.com/products/terraform/pricing/

Reveal Solution Next Question

QUESTION: 260

Valarie has created a database instance in AWS and for ease of use is outputting the value of the database password with the following code. Valarie wants to hide the output value in the CLI after terraform apply that's why she has used sensitive parameter.
1. output "db_password" {
2. value = local.db_password
3. sensitive = true 4. }
Since sensitive is set to true, will the value associated with db password be available in plain-text in the state file for everyone to read?

Answer(s): A

Explanation:

Outputs can be marked as containing sensitive material by setting the sensitive attribute to true, like this:
output "sensitive" { sensitive = true value = VALUE
}
When outputs are displayed on-screen following a terraform apply or terraform refresh, sensitive outputs are redacted, with <sensitive> displayed in place of their value.
Limitations of Sensitive Outputs
The values of sensitive outputs are still stored in the Terraform state, and available using the terraform output command, so cannot be relied on as a sole means of protecting values.
Sensitivity is not tracked internally, so if the output is interpolated in another module into a resource, the value will be displayed.

Reveal Solution Next Question

Free Terraform Associate Exam Braindumps (page: 65)

QUESTION: 257

Explanation:

Reference:

QUESTION: 258

Explanation:

Reference:

QUESTION: 259

Explanation:

Reference:

QUESTION: 260

Explanation: