Skip to content
Cheat sheets

002 · Domain 5: Terraform Security and Governance · 13% of the exam

Task 5.3: Secure CI/CD pipeline identities and access

Least privilege for automation: dynamic provider credentials, scoped API tokens, separate plan and apply identities, and keeping credentials out of variables and logs.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A platform pipeline authenticates to HCP Terraform with the organization API token. It creates workspaces and teams without trouble, but every attempt to upload a configuration version and start a run in those workspaces is rejected. Which explanation is correct?

  1. AOrganization tokens expire after thirty days
  2. BThe workspaces must first be locked by the token before it can start runs in them
  3. COrganization tokens cannot create configuration versions or start runs
  4. DOrganization tokens can upload a configuration version only to workspaces created in the UI
Show the answer and why

  • AOrganization tokens expire after thirty days

    Incorrect

    Tokens have an expiration chosen when they are created, and the pipeline's other calls still succeed with the same token.

  • BThe workspaces must first be locked by the token before it can start runs in them

    Incorrect

    Starting a run does not require locking the workspace, and a locked workspace would block runs rather than allow them.

  • COrganization tokens cannot create configuration versions or start runs

    Correct

    Organization tokens are meant for setting up workspaces and teams; the run and configuration version endpoints require a user or team token.

  • DOrganization tokens can upload a configuration version only to workspaces created in the UI

    Incorrect

    Organization tokens act across the whole organization regardless of how a workspace was created; the limitation is on the kinds of operation.

Use organization tokens for initial setup, then hand routine work such as runs to team tokens with the access each team needs.

HashiCorp documentation

Task 5.3Report a problem with this question

Question 2 · choose 1

A team token used by a pipeline expires in two weeks. Can the team extend its expiration?

  1. AYes, by regenerating the same token value
  2. BYes, from the token's settings page in the UI
  3. CNo; create a new token and switch over to it
  4. DYes, owners can extend any token
Show the answer and why

  • AYes, by regenerating the same token value

    Incorrect

    A lost or expiring token is replaced, not extended.

  • BYes, from the token's settings page in the UI

    Incorrect

    Expiration is fixed at creation.

  • CNo; create a new token and switch over to it

    Correct

    A token's expiration cannot be modified after creation, and HCP Terraform warns 30 and seven days before it expires.

  • DYes, owners can extend any token

    Incorrect

    Owner rights do not change it: no token's expiration can be modified once it is created.

Team tokens can coexist, so add the new token before removing the old one.

HashiCorp documentation

Task 5.3Report a problem with this question

Question 3 · choose 1

An engineer finds an agent pool token on a build server and wants to reuse it for API scripts. What does the API token documentation say?

  1. AIt is valid only for agents, not for direct API calls
  2. BIt can manage any workspace in the pool's projects
  3. CIt works with the permissions of the owners team
  4. DIt acts as a user token for whoever created the agent pool
Show the answer and why

  • AIt is valid only for agents, not for direct API calls

    Correct

    Agent pool tokens let agents communicate with HCP Terraform and are not valid for direct API usage.

  • BIt can manage any workspace in the pool's projects

    Incorrect

    Agent tokens do not carry workspace management rights.

  • CIt works with the permissions of the owners team

    Incorrect

    Owners-team tokens are team tokens, not agent tokens.

  • DIt acts as a user token for whoever created the agent pool

    Incorrect

    Agent tokens are a separate token type.

Use a team token scoped to the needed workspaces for automation scripts.

HashiCorp documentation

Task 5.3Report a problem with this question

Question 4 · choose 1

A pipeline uses a team token, and the team wants to rotate it without any window where the pipeline has no valid token. What makes that possible?

  1. AOrganization tokens, which never expire
  2. BA legacy team token without a description
  3. CRegenerating the token in place
  4. DSeveral team tokens, each with a unique description
Show the answer and why

  • AOrganization tokens, which never expire

    Incorrect

    Organization tokens have expiration dates too.

  • BA legacy team token without a description

    Incorrect

    Only one legacy token can exist at a time.

  • CRegenerating the token in place

    Incorrect

    Regeneration does not keep the old value valid.

  • DSeveral team tokens, each with a unique description

    Correct

    A team can hold multiple valid tokens with unique descriptions, and adding one does not invalidate the others.

Create the new token, update the pipeline secret, then delete the old token.

HashiCorp documentation

Task 5.3Report a problem with this question

Question 5 · choose 1

Integration tests for a private registry module use dynamic credentials, and the longest test run is rejected by the cloud near its end because its token has expired. What can the organization change?

  1. ASet a token lifetime variable in the module's test file
  2. BOwners raise module_test_token_ttl in the Organizations API
  3. CNothing; HCP Terraform fixes test tokens at 5 minutes
  4. DRun the tests in the apply phase, whose tokens are valid for longer
Show the answer and why

  • ASet a token lifetime variable in the module's test file

    Incorrect

    The test token lifetime is an organization setting, not a test file setting.

  • BOwners raise module_test_token_ttl in the Organizations API

    Correct

    Module test tokens have their own time to live, from 5 to 30 minutes, which organization owners set with the module_test_token_ttl attribute.

  • CNothing; HCP Terraform fixes test tokens at 5 minutes

    Incorrect

    The time to live ranges from 5 to 30 minutes, and owners can adjust it.

  • DRun the tests in the apply phase, whose tokens are valid for longer

    Incorrect

    Module test runs always use the plan phase.

Keep the test token lifetime as short as the longest test run allows, so a leaked token stays useful for as little time as possible.

HashiCorp documentation

Task 5.3Report a problem with this question

Practice domain 5 →Practice all domains →