HashiCorp Updated Terraform-Associate-004 Exam Questions and Answers by sky

Detailed Explanation:

Rationale for Correct Answer:

B: HashiCorp Vault is designed for securely storing and dynamically generating secrets, with access controls and auditing.

D: Using environment variables (including TF_VAR_... for input variables) avoids committing secrets to code and works well in CI/CD.

E: HCP Terraform sensitive variables (workspace variables marked sensitive) are a recommended way to store secrets for runs in HCP Terraform without exposing them in the UI or logs (they are masked).

Analysis of Incorrect Options (Distractors):

A: Incorrect. Plaintext on a shared drive is insecure and lacks access control/auditing best practices.

C: Incorrect. Committing secrets to version control is strongly discouraged; even private repos can leak, and history is hard to scrub.

Key Concept:Secrets management best practices in Terraform workflows: keep secrets out of code and VCS; use Vault, HCP Terraform sensitive vars, or environment variables.

Rationale for Correct Answer: terraform output shows the root module’s outputs (the outputs defined in the current working directory’s root module). Outputs from child modules are not directly listed unless the root module re-exports them via its own output blocks (e.g., output " child_public_ip " { value = module.child.public_ip }).

Analysis of Incorrect Options (Distractors):

A (True): Incorrect because child module outputs are accessible via module. < name > . < output > , but terraform output displays only outputs defined in the root module.

Key Concept: Module outputs scope: child outputs must be exposed through root outputs to be shown by terraform output.

Detailed Explanation:

Rationale for Correct Answer: terraform init -upgrade tells Terraform to disregard the previously selected versions in the dependency lock file when appropriate and consider newer provider versions that satisfy the configured version constraints.

Analysis of Incorrect Options (Distractors):

B: terraform apply executes actions from an execution plan; it is not the command for deliberately upgrading provider dependencies.

C: terraform plan previews infrastructure changes but does not perform a provider upgrade.

D: terraform refresh concerns state synchronization and does not install a newly selected provider version.

Key Concept: Provider dependency installation, version constraints, and the dependency lock file.

terraform graphgeneratesGraphviz DOT formatoutput, which allows visualization ofresource dependenciesin Terraform.

A (terraform refresh)– Incorrect, as it only updates the state file.

C (terraform output)– Incorrect, as it only displays Terraform output values.

D (terraform show)– Incorrect, as it only displays the Terraform state.

Official Terraform Documentation Reference:

terraform graph - HashiCorp Documentation