HashiCorp Terraform Associate 003 Practice Test - Questions Answers, Page 18

A Terraform output that sets the 'sensitive' argument to true will store that value in the state file. The purpose of setting sensitive = true is to prevent the value from being displayed in the CLI output during terraform plan and terraform apply, and to mask it in the Terraform UI. However, it does not affect the storage of the value in the state file. Sensitive outputs are still written to the state file to ensure that Terraform can manage resources correctly during subsequent operations.

Terraform documentation on sensitive outputs: Terraform Output Values

Not all standard backend types support state locking and remote operations like plan, apply, and destroy. For example, the local backend does not support remote operations and state locking. State locking is a feature that ensures that no two users can make changes to the state file at the same time, which is crucial for preventing race conditions. Remote operations allow running Terraform commands on a remote server, which is supported by some backends like remote or consul, but not all.

Terraform documentation on backends: Terraform Backends

Detailed backend support: Terraform Backend Types

Terraform modules are referenced by specifying a source location. This location can be a URL or a file path. However, specifying query parameters such as ?version=vl.6.0 directly within the source path is not a valid or supported method for specifying a module version in Terraform. Instead, version constraints are specified using the version argument within the module block, not as part of the source string. Reference = This clarification is based on Terraform's official documentation regarding module usage, which outlines the correct methods for specifying module sources and versions.

Terraform Cloud includes several features designed to enhance collaboration and infrastructure management. Two of these features are:

A web-based user interface (UI): This allows users to interact with Terraform Cloud through a browser, providing a centralized interface for managing Terraform configurations, state files, and workspaces.

Remote state storage: This feature enables users to store their Terraform state files remotely in Terraform Cloud, ensuring that state is safely backed up and can be accessed by team members as needed.

The terraform refresh-only command is intended to detect state file drift. This command synchronizes the state file with the actual infrastructure, updating the state to reflect any changes that have occurred outside of Terraform.

Confidentiality: Using HCP Terraform/Terraform Cloud's private registry keeps the module configurations within your organization, ensuring privacy and access control.

Browsable Directory: The private registry offers a user interface to browse modules, making it easy for users within the organization to locate and manage modules.

This setup aligns with HashiCorp's design for private registry support in Terraform, meeting all listed requirements for secure, version-controlled, and searchable module storage.

Purpose of Refresh-Only Mode: Running Terraform in refresh-only mode updates Terraform's state file with the current state of resources in your infrastructure without making changes to the resources themselves.

Context of Terraform Import: When using terraform import, you're adding existing resources to the state file, and running Terraform in refresh-only mode before this operation can ensure that any initial configuration syncs precisely with the actual state.

For more on refresh-only mode in relation to terraform import, refer to Terraform's import documentation.

Purpose of Refresh-Only Mode: Running Terraform in refresh-only mode updates Terraform's state file with the current state of resources in your infrastructure without making changes to the resources themselves.

Context of Terraform Import: When using terraform import, you're adding existing resources to the state file, and running Terraform in refresh-only mode before this operation can ensure that any initial configuration syncs precisely with the actual state.

For more on refresh-only mode in relation to terraform import, refer to Terraform's import documentation.

Terraform state files are not automatically encrypted by default. Sensitive values are stored in plaintext within the state file. However, you can protect the state file by using remote backends that support encryption, such as AWS S3 with server-side encryption enabled or Terraform Cloud, which offers encrypted state storage.

References:

Terraform State