New (2022) HashiCorp VA-002-P Exam Dumps
Best Way To Study For HashiCorp VA-002-P Exam Brilliant VA-002-P Exam Questions PDF
HashiCorp VA-002-P Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
| Topic 6 |
|
NEW QUESTION 103
A user runs terraform init on their RHEL based server and per the output, two provider plugins are downloaded:
1. $ terraform init
2.
3. Initializing the backend...
4.
5. Initializing provider plugins...
6. - Checking for available provider plugins...
7. - Downloading plugin for provider "aws" (hashicorp/aws) 2.44.0...
8. - Downloading plugin for provider "random" (hashicorp/random) 2.2.1...
9.
10. Terraform has been successfully initialized!
Where are these plugins downloaded to?
- A. /etc/terraform/plugins
- B. The .terraform.plugins directory in the directory terraform init was executed in.
- C. The .terraform.d directory in the directory terraform init was executed in.
- D. The .terraform/plugins directory in the directory terraform init was executed in.
Answer: D
Explanation:
By default, terraform init downloads plugins into a subdirectory of the working directory, .terraform/plugins, so that each working directory is self-contained.
NEW QUESTION 104
Which two interfaces automatically assume the token for subsequent requests after successfully authenticating? (select two)
- A. UI
- B. API
- C. Consul
- D. CLI
Answer: A,D
Explanation:
After authenticating, the UI and CLI automatically assume the token for all subsequent requests. The API, however, requires the user to extract the token from the server response after authenticating in order to send with subsequent requests.
NEW QUESTION 105
By default, where does Terraform store its state file?
- A. current working directory
- B. shared directory
- C. remotely using Terraform Cloud
- D. Amazon S3 bucket
Answer: A
Explanation:
By default, the state file is stored in a local file named "terraform.tfstate", but it can also be stored remotely, which works better in a team environment.
NEW QUESTION 106
Which of the following allows Terraform users to apply policy as code to enforce standardized configurations for resources being deployed via infrastructure as code?
- A. workspaces
- B. functions
- C. module registry
- D. sentinel
Answer: D
Explanation:
Sentinel is an embedded policy-as-code framework integrated with the HashiCorp Enterprise products. It enables fine-grained, logic-based policy decisions, and can be extended to use information from external sources.
NEW QUESTION 107
True or False:
State is a requirement for Terraform to function.
- A. True
- B. False
Answer: A
Explanation:
Terraform requires some sort of database to map Terraform config to the real world. When you have a resource in your configuration, Terraform uses this map to know how that resource is represented. Therefore, to map configuration to resources in the real world, Terraform uses its own state structure.
NEW QUESTION 108
When configuring a remote backend in Terraform, it might be a good idea to purposely omit some of the required arguments to ensure secrets and other relevant data are not inadvertently shared with others. What are the ways the remaining configuration can be added to Terraform so it can initialize and communicate with the backend? (select three)
- A. directly querying HashiCorp Vault for the secrets
- B. use the -backend-config=PATH to specify a separate config file
- C. command-line key/value pairs
- D. interactively on the command line
Answer: B,C,D
Explanation:
You do not need to specify every required argument in the backend configuration. Omitting certain arguments may be desirable to avoid storing secrets, such as access keys, within the main configuration. When some or all of the arguments are omitted, we call this a partial configuration.
With a partial configuration, the remaining configuration arguments must be provided as part of the initialization process. There are several ways to supply the remaining arguments:
Interactively: Terraform will interactively ask you for the required values unless interactive input is disabled. Terraform will not prompt for optional values.
File: A configuration file may be specified via the init command line. To specify a file, use the -backend-config=PATH option when running terraform init. If the file contains secrets it may be kept in a secure data store, such as Vault, in which case it must be downloaded to the local disk before running Terraform.
Command-line key/value pairs: Key/value pairs can be specified via the init command line. Note that many shells retain command-line flags in a history file, so this isn't recommended for secrets. To specify a single key/value pair, use the -backend-config="KEY=VALUE" option when running terraform init.
NEW QUESTION 109
Terraform-specific settings and behaviors are declared in which configuration block type?
- A. resource
- B. terraform
- C. data
- D. provider
Answer: B
Explanation:
The special terraform configuration block type is used to configure some behaviors of Terraform itself, such as requiring a minimum Terraform version to apply your configuration.
NEW QUESTION 110
You are deploying Vault in a local data center, but want to be sure you have a secondary cluster in the event the primary cluster goes offline. In the secondary data center, you have applications that are running, as they are architected to run active/active. Which type of replication would be best in this scenario?
- A. single-node replication
- B. disaster recovery replication
- C. performance replication
- D. end-to-end replication
Answer: C
Explanation:
In this scenario, the key to answering is that there are applications actively running the secondary data center. Because of this, you can deploy Performance Replication and the applications can now use the Vault cluster in their respective data center. This reduces network latency for your applications and provides you with a secondary cluster for redundancy.
NEW QUESTION 111
Which statements best describes what the local variable assignment is doing in the following code snippet:
1. variable "subnet_details" {
2. type = list(object({
3. cidr = string
4. subnet_name = string
5. route_table_name = string
6. aznum = number
7. }))
8. }
9. locals {
10. route_tables_all = distinct([for s in var.subnet_details : s.route_table_name ])
11. }
- A. Create a distinct list of route table name objects
- B. Create a map of route table names to subnet names
- C. Create a map of route table names from a list of subnet names
- D. Create a list of route table names eliminating duplicates
Answer: D
Explanation:
route_tables_all is assigned a list of unique route table names filtered from a list of objects describing subnet details, one of those object attributes being route_table_name.
NEW QUESTION 112
As opposed to service tokens, batch tokens are ideal for what type of action?
- A. renewing tokens
- B. writing secrets
- C. configuring Vault features
- D. encrypting data
- E. issuing snapshots
- F. generating dynamic credentials
Answer: D
Explanation:
Batch tokens are generally used for encrypting data because they are lightweight and scalable and also include enough information to use with Vault.
NEW QUESTION 113
When using parent/child modules to deploy infrastructure, how would you export value from one module to import into another module?
For example, a module dynamically deploys an application instance or virtual machine, and you need the IP address in another module to configure a related DNS record in order to reach the newly deployed application.
- A. preconfigure the IP address as a parameter in the DNS module
- B. configure the pertinent provider's configuration with a list of possible IP addresses to use
- C. configure an output value in the application module in order to use that value for the DNS module
- D. export the value using terraform export and input the value using terraform input
Answer: C
Explanation:
Output values are like the return values of a Terraform module and have several uses such as a child module using those outputs to expose a subset of its resource attributes to a parent module.
NEW QUESTION 114
Which TCP port does Vault use, by default, for its API and UI?
- A. 0
- B. 1
- C. 2
- D. 3
- E. 4
- F. 5
Answer: E
Explanation:
By default, Vault uses port 8200 for its API and UI.
8201 is used for the cluster to cluster communication,
8300 is used for Consul Server RPC,
8500 is used for the Consul interface,
8600 is used for Consul DNS,
and 8301 is used for its LAN gossip protocol.
NEW QUESTION 115
Which of the following is considered a Terraform plugin?
- A. Terraform tooling
- B. Terraform language
- C. Terraform provider
- D. Terraform logic
Answer: C
Explanation:
Terraform is built on a plugin-based architecture. All providers and provisioners that are used in Terraform configurations are plugins, even the core types such as AWS and Heroku. Users of Terraform are able to write new plugins in order to support new functionality in Terraform.
NEW QUESTION 116
Which Terraform command will check and report errors within modules, attribute names, and value types to make sure they are syntactically valid and internally consistent?
- A. terraform show
- B. terraform validate
- C. terraform fmt
- D. terraform format
Answer: B
Explanation:
The terraform validate command validates the configuration files in a directory, referring only to the configuration and not accessing any remote services such as remote state, provider APIs, etc.
Validate runs checks that verify whether a configuration is syntactically valid and internally consistent, regardless of any provided variables or existing state. It is thus primarily useful for general verification of reusable modules, including the correctness of attribute names and value types.
NEW QUESTION 117
When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?
- A. Vault replication won't work with the type of certificates that a traditional load balancer uses.
- B. Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.
- C. Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.
- D. If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.
Answer: B
Explanation:
For replication (port 8201), Vault generates a mutual TLS connection between nodes using self-generated certs/keys (this is different than the TLS you configure in the listener, which is particular to client requests)... server-to-server always uses this mutual TLS, even if you have TLS disabled on the listener.
Reference link:-
https://www.vaultproject.io/docs/configuration/listener/tcp
https://www.vaultproject.io/docs/concepts/ha
NEW QUESTION 118
Which of the following Terraform files should be ignored by Git when committing code to a repo? (select two)
- A. variables.tf
- B. terraform.tfstate
- C. output.tf
- D. terraform.tfvars
Answer: B,D
Explanation:
The .gitignore file should be configured to ignore Terraform files that either contain sensitive data or aren't required to save.
The terraform.tfstate file contains the terraform state of a specific environment and doesn't need to be preserved in a repo. The terraform.tfvars file may contain sensitive data, such as passwords or IP addresses of an environment that you may not want to share with others.
NEW QUESTION 119
An administrator wants to create a new KV mount for individual users to maintain their own secrets but needs a way to simplify the policy so they don't need to write a new one for each new user? With the requirements listed below, what would such a policy look like?
Requirement: Each user can perform all operations on their allocated key/value secret path
- A. path "user-kv/data/{{identity.entity.id.name}}/*" {
capabilities = [ "create", "update", "read", "delete", "list" ]
} - B. path "user-kv/data/{{identity.entity.name}}/*" {
capabilities = [ "create", "update", "read", "delete", "list" ]
} - C. path "user-kv/data/{{identity.entity.aliases.<<mount accessor>>.id}}/*" { capabilities = [ "create", "update", "read", "delete", "list" ]
} - D. path "user-kv/data/{{user}}/*" {
capabilities = [ "create", "update", "read", "delete", "list" ]
}
Answer: B
Explanation:
Everything in the Vault is path-based, and policies are no exception. Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault.
The policy template makes it very flexible to customize the environment. By using parameters within your template, you can have Vault "insert" a value into the path based upon things like identity values, group membership, and metadata associated with either the user's identity or group they are a member of.
Using the parameter, the path user-kv/data/{{identity.entity.name}}/* converts to user-kv/data/student01/*
NEW QUESTION 120
After running into issues with Terraform, you need to enable verbose logging to assist with troubleshooting the error. Which of the following values provides the MOST verbose logging?
- A. TRACE
- B. INFO
- C. ERROR
- D. DEBUG
- E. WARN
Answer: A
Explanation:
Terraform has detailed logs that can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr.
You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN, or ERROR to change the verbosity of the logs. TRACE is the most verbose and it is the default if TF_LOG is set to something other than a log level name.
NEW QUESTION 121
After enabling the vault to autocomplete feature, you type vault and press the tab button, but nothing happens. Why doesn't vault display the available completions?
1. $ vault -autocomplete-install
2. $ vault
- A. you didn't use -force when enabling the feature
- B. your SSH client doesn't support autocompletion
- C. the SSH session needs to be restarted upon installation
- D. you don't have the permissions to use autocomplete
Answer: C
Explanation:
Be sure to restart your shell after installing autocompletion!
NEW QUESTION 122
Which of the following best describes the storage backend?
- A. configures client interaction with a cloud storage service, such as Amazon S3
- B. Encrypts the hard drives of the server which Vault is running on
- C. configures the location for storage of Vault data
- D. selects the type of storage the Vault node runs on, such as SSD or traditional spinning hard drive
Answer: C
Explanation:
The storage stanza configures the storage backend, which represents the location for the durable storage of Vault's information.
Storage backend configuration is done through the Vault configuration file using the storage stanza.
Reference link:- https://www.vaultproject.io/docs/configuration/storage
NEW QUESTION 123
What Terraform feature is shown in the example below?
1. resource "aws_security_group" "example" {
2. name = "sg-app-web-01"
3. dynamic "ingress" {
4. for_each = var.service_ports
5. content {
6. from_port = ingress.value
7. to_port = ingress.value
8. protocol = "tcp"
9. }
10. }
11. }
- A. local values
- B. dynamic block
- C. data source
- D. conditional expression
Answer: B
Explanation:
You can dynamically construct repeatable nested blocks like ingress using a special dynamic block type, which is supported inside resource, data, provider, and provisioner blocks
NEW QUESTION 124
In regards to deploying resources in multi-cloud environments, what are some of the benefits of using Terraform rather than a provider's native tooling? (select three)
- A. Terraform can manage cross-cloud dependencies
- B. Terraform simplifies management and orchestration, helping operators build large-scale, multi-cloud infrastructure
- C. Terraform is not cloud-agnostic and can be used to deploy resources across a single public cloud
- D. Terraform can help businesses deploy applications on multiple clouds and on-premises infrastructure
Answer: A,B,D
Explanation:
Terraform is a cloud-agnostic tool, and therefore isn't limited to a single cloud provider, such as AWS CloudFormation or Azure Resource Manager. Terraform supports all of the major cloud providers and allows IT organizations to focus on learning a single tool for deploying its infrastructure, regardless of what platform it's being deployed on.
NEW QUESTION 125
......
Updated Verified Pass VA-002-P Exam - Real Questions and Answers: https://dumpsstar.vce4plus.com/HashiCorp/VA-002-P-valid-vce-dumps.html