Skip to content
Cheat sheets

004 · Domain 8: HCP Terraform · 12% of the exam

Task 8.3: Describe how to organize and use HCP Terraform workspaces and projects

Projects that group workspaces, permissions at the project level, variable sets shared across workspaces, run triggers between workspaces, and how HCP Terraform workspaces differ from CLI workspaces.

Study it

  • Workspaces and projects: variable sets, run triggers and access

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

The payments team owns twelve workspaces and will create more. The organization wants the team to get the same access to all of them, including future ones, without granting access workspace by workspace. What fits?

  1. AGive the team organization owner permissions so that it can reach every workspace
  2. BTag each workspace with payments, which grants the team access automatically
  3. CCreate one variable set per workspace that lists the team's members
  4. DGroup them in a project and grant the team access there
Show the answer and why

  • AGive the team organization owner permissions so that it can reach every workspace

    Incorrect

    That grants far more than access to twelve workspaces.

  • BTag each workspace with payments, which grants the team access automatically

    Incorrect

    Tags help select workspaces; they do not grant permissions.

  • CCreate one variable set per workspace that lists the team's members

    Incorrect

    Membership lists in variables do not grant access.

  • DGroup them in a project and grant the team access there

    Correct

    Projects group workspaces, and each project has a permission set that grants teams access to all workspaces in it.

Projects are the access boundary for groups of workspaces.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 2 · choose 1

A team used CLI workspaces named dev and prod for one configuration and is moving to HCP Terraform. How do HCP Terraform workspaces differ from CLI workspaces?

  1. AHCP workspaces are only a new name for CLI workspaces and behave in exactly the same way
  2. BHCP workspaces cannot hold state; state stays in the CLI workspaces
  3. CHCP workspaces must all share one configuration, like CLI workspaces
  4. DHCP workspaces can be independent configurations with unique names
Show the answer and why

  • AHCP workspaces are only a new name for CLI workspaces and behave in exactly the same way

    Incorrect

    HCP workspaces carry their own variables, settings, permissions and run history.

  • BHCP workspaces cannot hold state; state stays in the CLI workspaces

    Incorrect

    HCP workspaces store the state.

  • CHCP workspaces must all share one configuration, like CLI workspaces

    Incorrect

    Each HCP workspace can be linked to its own configuration.

  • DHCP workspaces can be independent configurations with unique names

    Correct

    CLI workspaces are multiple states of one configuration; HCP Terraform workspaces can represent completely independent configurations and must have unique names.

In HCP Terraform, a workspace is a unit of configuration, state, variables and permissions, not just another state for the same code.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 3 · choose 1

An administrator has a global variable set that defines AWS_REGION and tries to add AWS_REGION to a second global variable set in the same organization. What happens?

  1. AThe set created most recently takes precedence
  2. BHCP Terraform returns an error, because global sets cannot share a key
  3. CBoth values are kept, and each workspace picks one in its settings
  4. DEach workspace asks for the value at the start of its next run
Show the answer and why

  • AThe set created most recently takes precedence

    Incorrect

    Creation time never settles a conflict between variable sets; for two global sets the conflict is not allowed in the first place.

  • BHCP Terraform returns an error, because global sets cannot share a key

    Correct

    HCP Terraform reports an error if you try to declare variables with the same key in multiple global variable sets.

  • CBoth values are kept, and each workspace picks one in its settings

    Incorrect

    Workspaces have no setting for choosing between two sets' values.

  • DEach workspace asks for the value at the start of its next run

    Incorrect

    HCP Terraform does not prompt for variable values during runs.

Global sets apply to every workspace, so a duplicated key would have no sensible winner; HCP Terraform refuses it when the second set is saved.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 4 · choose 1

A project administrator without organization-level permissions wants to share variables across the workspaces of their own project. What kind of variable set can they manage?

  1. AAn organization-owned global variable set
  2. BA project-owned variable set
  3. CAny variable set, since sets need no permissions
  4. DNone; only organization owners can create variable sets
Show the answer and why

  • AAn organization-owned global variable set

    Incorrect

    Organization-owned sets require organization-level permissions.

  • BA project-owned variable set

    Correct

    Project-owned variable sets require only project permissions, while organization-owned sets need a higher permission level because they can apply anywhere.

  • CAny variable set, since sets need no permissions

    Incorrect

    Managing variable sets is permission-controlled.

  • DNone; only organization owners can create variable sets

    Incorrect

    Projects can own variable sets too.

Variable set ownership follows the permission boundary: project or organization.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 5 · choose 1

A temporary workspace is no longer needed. An administrator wants to remove the infrastructure it manages and then the workspace itself. Where is this done in HCP Terraform?

  1. AIn the project's variable sets page
  2. BIn the organization's VCS provider settings
  3. COn the workspace's Destruction and Deletion settings page
  4. DBy deleting the workspace's state version in the States tab first
Show the answer and why

  • AIn the project's variable sets page

    Incorrect

    Variable sets hold variables.

  • BIn the organization's VCS provider settings

    Incorrect

    VCS settings connect repositories.

  • COn the workspace's Destruction and Deletion settings page

    Correct

    The Destruction and Deletion page lets admin users delete a workspace's managed infrastructure or delete the workspace itself.

  • DBy deleting the workspace's state version in the States tab first

    Incorrect

    Removing state does not remove infrastructure; it orphans it.

Destroy the infrastructure first, then delete the workspace, from the same settings page.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 6 · choose 1

When migrating several CLI workspaces into HCP Terraform, Terraform asks for workspace names. Which naming pattern does the documentation suggest?

  1. A<COMPONENT>-<ENVIRONMENT>-<REGION>
  2. BRandom names, so workspaces cannot be guessed
  3. CThe same name for every workspace
  4. DThe name of the person who created each workspace
Show the answer and why

  • A<COMPONENT>-<ENVIRONMENT>-<REGION>

    Correct

    The docs describe <COMPONENT>-<ENVIRONMENT>-<REGION> as a common strategy that shows the workspaces share configuration.

  • BRandom names, so workspaces cannot be guessed

    Incorrect

    Names should be meaningful.

  • CThe same name for every workspace

    Incorrect

    Names must be unique in the organization.

  • DThe name of the person who created each workspace

    Incorrect

    Ownership is better expressed through teams and projects.

Consistent names make shared configurations recognizable.

HashiCorp documentation

Task 8.3Report a problem with this question

Question 7 · choose 1

Two non-priority, workspace-scoped variable sets named A_Shared and B_Shared both set the same key for one workspace. Which value does the workspace get?

  1. AA_Shared's, by lexical order of set names
  2. BB_Shared's, because it was edited last
  3. CNeither; runs fail on the conflict
  4. DBoth values, joined as a list
Show the answer and why

  • AA_Shared's, by lexical order of set names

    Correct

    When sets with the same scope conflict, HCP Terraform uses the set whose name comes first in lexical order, regardless of edit time.

  • BB_Shared's, because it was edited last

    Incorrect

    Edit time is ignored.

  • CNeither; runs fail on the conflict

    Incorrect

    The conflict is resolved by the documented rule.

  • DBoth values, joined as a list

    Incorrect

    One value wins.

Same scope, conflicting keys: the lexically first set wins.

HashiCorp documentation

Task 8.3Report a problem with this question

Practise domain 8 →Practise all domains →