HashiCorp Exam Terraform-Associate-003 Topic 6 Question 24 Discussion

Actual exam question for HashiCorp's Terraform-Associate-003 exam

Question #: 24
Topic #: 6

Your security team scanned some Terraform workspaces and found secrets stored in plaintext in state files. How can you protect that data?

AEdit your state file to scrub out the sensitive data

BAlways store your secrets in a secrets.tfvars file

CDelete the state file every time you run Terraform

DStore the state in an encrypted backend

Show Suggested Answer

Suggested Answer: B

In Terraform Cloud, speculative plan runs are not automatically started when changes are merged or committed to the version control repository linked to a workspace. Instead, speculative plans are typically triggered as part of proposed changes in merge requests or pull requests to give an indication of what would happen if the changes were applied, without making any real changes to the infrastructure. Actual plan and apply operations in Terraform Cloud workspaces are usually triggered by specific events or configurations defined within the Terraform Cloud workspace settings. Reference = This behavior is part of how Terraform Cloud integrates with version control systems and is documented in Terraform Cloud's usage guidelines and best practices, especially in the context of VCS-driven workflows.

by Catarina at Sep 18, 2024, 11:45 PM

Limited Time Offer

25%

Off

Get Premium Terraform-Associate-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

German

5 days ago

Storing state in an encrypted backend is a must!

upvoted 0 times

...

Leonora

11 days ago

Deleting the state file every time seems risky and impractical. I think option D is definitely the way to go for security.

upvoted 0 times

...

Yoko

16 days ago

I practiced a question similar to this, and I think storing secrets in a secrets.tfvars file is a good practice, but I'm not sure if it's enough on its own.

upvoted 0 times

...

Keshia

22 days ago

I'm not entirely sure, but I feel like just editing the state file to scrub data isn't a long-term solution.

upvoted 0 times

...

Kathryn

28 days ago

I remember reading about encrypting state files, so I think option D might be the best choice.

upvoted 0 times

...

Vicki

28 days ago

Ah, I see what they're getting at here. The state file is where Terraform stores the current state of your infrastructure, so you definitely don't want sensitive data in there. I think Option D is the way to go - using an encrypted backend to store the state.

upvoted 0 times

...

Cyril

28 days ago

Okay, let's think this through. Editing the state file to scrub out the data seems risky, and deleting the state file every time isn't a great long-term solution. I'm leaning towards Option B - using a separate secrets.tfvars file to store the sensitive info.

upvoted 0 times

...

Chaya

28 days ago

Hmm, this is a tricky one. I think the key is to make sure we're not storing sensitive data in the state file itself. Option D seems like the best approach - storing the state in an encrypted backend.

upvoted 0 times

...

Zack

1 months ago

Hmm, this is a good one. I'm not sure I fully understand all the implications of each option, but Option D does seem like the most secure approach. Storing the state in an encrypted backend would help protect those sensitive secrets.

upvoted 0 times

...

Merissa

1 months ago

This question seems straightforward - I just need to identify the three most appropriate options for implementing the COSO Enterprise Risk Management Framework at HGY. I'll carefully read through each choice and select the best ones.

upvoted 0 times

...

Kris

6 months ago

Encrypted backend? More like 'encrypt-ted' backend, am I right? Gotta keep those secrets hush-hush, folks!

upvoted 0 times

Johnson

4 months ago

Consider using tools like Vault to manage secrets and access control.

upvoted 0 times

...

Eura

5 months ago

Implement a key management system to securely store and manage encryption keys.

upvoted 0 times

...

Kent

5 months ago

Use a secure backend like AWS KMS to encrypt the state files.

upvoted 0 times

...

Von

6 months ago

Scrubbing the state file? That's like trying to unsee a bad horror movie. Nope, I'm keeping my secrets locked up tight with that encrypted backend, thank you very much.

upvoted 0 times

Dulce

5 months ago

Scrubbing the state file is just a temporary fix. Encrypting is the long-term solution.

upvoted 0 times

...

Davida

5 months ago

I agree, using an encrypted backend is the best practice for protecting sensitive data.

upvoted 0 times

...

Tonja

5 months ago

Encrypting the state file is the way to go. Can't risk exposing those secrets.

upvoted 0 times

...

Alva

6 months ago

Option B sounds tempting, but I've heard that secrets.tfvars can still be vulnerable if not properly secured. Gotta go with the encryption option, my dude.

upvoted 0 times

Patti

5 months ago

I always make sure to encrypt any sensitive information to keep it safe from prying eyes.

upvoted 0 times

...

Laurene

5 months ago

Yeah, I agree. Option B might not be enough to fully secure the data.

upvoted 0 times

...

Latosha

6 months ago

Encrypting secrets is definitely the way to go. It adds an extra layer of protection.

upvoted 0 times

...

Alaine

7 months ago

Deleting the state file every time? That's like throwing the baby out with the bathwater. Nah, I'm going with option D - encrypted backend all the way!

upvoted 0 times

Arlean

5 months ago

Using an encrypted backend is a smart choice for securing secrets in Terraform workspaces. It's a more sustainable solution than deleting the state file every time.

upvoted 0 times

...

Elbert

5 months ago

Encrypting the backend is the best practice for protecting sensitive data. It's a more efficient solution than constantly deleting the state file.

upvoted 0 times

...

Chauncey

6 months ago

I agree, encrypting the backend is a much better solution. It keeps the data secure without having to delete it constantly.

upvoted 0 times

...

Matthew

6 months ago

Option D - encrypted backend is definitely the way to go. It's more secure than deleting the state file every time.

upvoted 0 times

...

King

7 months ago

I think editing the state file to remove sensitive data is also a good option.

upvoted 0 times

...

Katina

7 months ago

Ah, the age-old question of how to keep our secrets safe. I reckon option D is the way to go - storing the state in an encrypted backend is the most secure approach here.

upvoted 0 times