002 · Domain 1: Scalable Terraform Configuration Design · 20% of the exam
Task 1.8: Use the Terraform MCP server to enhance development with AI coding agents
Giving an AI coding agent current Terraform knowledge: what the Terraform MCP server exposes, the MCP host, client, server, tool and transport roles, local and remote deployment, the token it needs for HCP Terraform, and reviewing what an agent writes.
Study it
AI coding agents with the Terraform MCP server
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
A platform team runs the Terraform MCP server locally for engineers' AI coding agents. Agents must be able to look up modules in the organization's HCP Terraform private registry, but they must never be able to apply runs, cancel runs or delete workspaces through the server. Which configuration meets both needs?
AStart the server with --toolsets=registry,registry-private and no TFE_TOKEN
BStart the server with --toolsets=registry and keep TFE_TOKEN unset
CGive TFE_TOKEN a token with limited permissions; leave ENABLE_TF_OPERATIONS unset
DSet ENABLE_TF_OPERATIONS=true and instruct every agent to ask before it starts an apply
Show the answer and why
AStart the server with --toolsets=registry,registry-private and no TFE_TOKEN
Incorrect
The registry-private tools are registered only when a valid TFE_TOKEN is provided.
BStart the server with --toolsets=registry and keep TFE_TOKEN unset
Incorrect
The registry toolset covers the public registry only, so agents cannot reach the private modules.
CGive TFE_TOKEN a token with limited permissions; leave ENABLE_TF_OPERATIONS unset
Correct
The private registry tools register only with a valid TFE_TOKEN, and destructive operations stay disabled unless ENABLE_TF_OPERATIONS is set to true.
DSet ENABLE_TF_OPERATIONS=true and instruct every agent to ask before it starts an apply
Incorrect
That flag turns on the apply, discard and delete tools, so the restriction would rest on the agent's behavior instead of the server.
Access to private registry content comes from the token, and destructive tools come from ENABLE_TF_OPERATIONS. Grant the first with a narrowly scoped token and leave the second off.
A team wants the Terraform MCP server to expose only the search_modules and get_module_details tools. An engineer starts it with --toolsets=registry --tools=search_modules,get_module_details. What is wrong?
ATool names must be prefixed with their toolset, such as registry.search_modules
B--tools only works when TFE_TOKEN is set
C--tools cannot be used together with --toolsets; use --tools alone
DThe registry toolset is always on and the flags have no effect
Show the answer and why
ATool names must be prefixed with their toolset, such as registry.search_modules
Incorrect
--tools takes the plain tool names listed in the reference.
B--tools only works when TFE_TOKEN is set
Incorrect
A token is needed only for the private registry and HCP Terraform tools.
C--tools cannot be used together with --toolsets; use --tools alone
Correct
The reference says the two flags cannot be combined; --tools by itself enables only the named tools.
DThe registry toolset is always on and the flags have no effect
Incorrect
The flags do restrict which tools the server registers.
Use --toolsets for whole groups such as registry or terraform, or --tools for an exact list of tools, never both.
A platform team wants AI coding agents connected to the Terraform MCP server to follow HashiCorp's style guide when generating configuration. What does the server offer for this?
AThe /terraform/style-guide resource, a read-only guide that MCP clients can retrieve
BA lint tool that rejects generated configuration that breaks the style guide
CThe search_policies tool, which returns style rules as Sentinel policies
DAn environment variable that turns style enforcement on for every tool
Show the answer and why
AThe /terraform/style-guide resource, a read-only guide that MCP clients can retrieve
Correct
The server provides static resources, including the style guide and a module development guide, for clients to read.
BA lint tool that rejects generated configuration that breaks the style guide
Incorrect
The server lists no lint tool; style guidance comes as a resource.
CThe search_policies tool, which returns style rules as Sentinel policies
Incorrect
search_policies finds Sentinel policies in the registry; it does not serve the style guide.
DAn environment variable that turns style enforcement on for every tool
Incorrect
No such variable exists among the server's settings.
MCP resources give agents structured context, here the style guide and module development guidance, alongside the tools that query the registry.
An agent asks the Terraform MCP server about storage account resources in the azurerm provider. Which sequence of tool calls returns full documentation with example configuration?
Aget_latest_provider_version, then get_module_details
Bsearch_providers to find document IDs, then get_provider_details for each ID
Csearch_modules, then get_provider_capabilities
Dget_provider_details alone, with the resource name as its argument
Show the answer and why
Aget_latest_provider_version, then get_module_details
Incorrect
The first returns only a version number, and the second covers modules, not provider resources.
Bsearch_providers to find document IDs, then get_provider_details for each ID
Correct
The server first searches the provider's documentation index, then fetches each matching document by ID.
Csearch_modules, then get_provider_capabilities
Incorrect
search_modules looks for modules, and the capabilities tool lists resource types without their documentation.
Dget_provider_details alone, with the resource name as its argument
Incorrect
get_provider_details takes a document ID that a search returns first.
The two-step search-then-fetch pattern is how the server turns broad questions into specific, versioned documentation.