Task 8.2: Describe HCP Terraform collaboration and governance features

• AVariable sets that hold the allowed regions and tags for those workspaces

  Incorrect

  Stored values alone cannot evaluate a plan against rules.

• BAgent pools that run the checks inside the compliance team's network

  Incorrect

  Agents execute Terraform runs in private networks; they do not define rules.

• CPolicy sets with Sentinel or OPA policies applied to those workspaces

  Correct

  HCP Terraform checks the plan against the policy sets applied to a workspace during each run; policies are written in Sentinel or OPA.

• DNotification settings that email the compliance team about every plan

  Incorrect

  Notifications report events; a person would still have to check each plan.

Policy as code in HCP Terraform runs between plan and apply, on every run.

• AModules published to the organization's private registry are available only to its members

  Correct

  The private registry shares modules and providers across one organization, with a searchable list; private modules are available only to members of that organization.

• BModules published to the public Terraform Registry can be limited to the company's namespace

  Incorrect

  The public registry is open to everyone; a namespace names the publisher and does not restrict who can use the module.

• CA variable set can hold the module source code and share it with every workspace

  Incorrect

  Variable sets share variable values with workspaces; module code is not a variable value.

• DModules in the private registry support versions, as modules in the public registry do

  Correct

  The private registry works like the public Terraform Registry, including support for module versions.

• EOther workspaces can load the modules from the state of one shared workspace

  Incorrect

  State records infrastructure and output values, not reusable module code.

The private registry is the organization's own catalog of modules and providers, with versions like the public registry but visible only inside the organization.

• ACost estimation enabled for every workspace

  Incorrect

  Cost estimates price planned resources; they do not search the estate.

• BThe explorer for workspace visibility

  Correct

  The explorer surfaces information across the organization and offers queries and filters over workspaces, modules and more.

• CA global variable set

  Incorrect

  That holds values; it does not search across workspaces.

• DThe private registry's module page

  Incorrect

  The registry lists modules, not where each version is used.

Explorer answers estate-wide questions about workspaces.

• ASpeculative plans posted to each workspace

  Incorrect

  Speculative plans show changes; they are not tasks for teams.

• BSentinel advisory policies

  Incorrect

  Policies evaluate runs; they do not create tasks.

• CChange requests created from the explorer

  Correct

  Administrators can create change requests from explorer queries; workspaces track them until team members archive them.

• DWorkspace descriptions edited by the administrator

  Incorrect

  Descriptions are not tracked requests.

Explorer finds the problems; change requests hand them to the owners.

• AA team API token

  Correct

  Each team can have API tokens not associated with a specific user.

• BA user token from the CI administrator's account

  Incorrect

  A user token is tied to that person.

• CThe organization's VCS OAuth token

  Incorrect

  That connects to the VCS provider, not the API.

• DA provider credential stored as a variable

  Incorrect

  Provider credentials authenticate to clouds.

Team tokens give automation an identity of its own.

• AAn agent that posts to Slack

  Incorrect

  Agents run Terraform operations in private networks.

• BA check block that sends messages

  Incorrect

  Check blocks evaluate assertions.

• CA variable set with the Slack channel name

  Incorrect

  Variables do not send messages.

• DA workspace notification with a Slack destination

  Correct

  Workspaces can notify external systems such as Slack, Microsoft Teams, email or generic webhooks about run events.

Notifications are per workspace and support several destinations.

• AIt can be deleted once another team has been given organization-level permissions

  Incorrect

  Every organization keeps its owners team; it cannot be deleted.

• BMembers can be added and removed, but the team cannot be deleted or left empty

  Correct

  Owners are managed like any other team's members, but HCP Terraform does not let anyone delete the owners team or leave it without members.

• CIt holds at most five members in every edition, so a new owner needs a free seat

  Incorrect

  The five-member limit applies to free organizations only; in paid organizations the owners team has no size limit.

• DThe organization's creator stays a member permanently and cannot be removed

  Incorrect

  The creator is simply the first member; owners can be removed like other members, as long as the team keeps at least one.

To hand over an organization, add the new owner to the owners team first, then remove yourself.