HashiCorp VA-002-P - HashiCorp Certified: Vault Associate

Terraform Cloud supports the following VCS providers:

- GitHub

- GitHub.com (OAuth)

- GitHub Enterprise

- GitLab.com

- GitLab EE and CE

- Bitbucket Cloud

- Bitbucket Server

- Azure DevOps Server

- Azure DevOps Services

https://www.terraform.io/docs/cloud/vcs/index.html#supported-vcs-providers

The storage stanza configures the storage backend, which represents the location for the durable storage of Vault's information.

Storage backend configuration is done through the Vault configuration file using the storage stanza.

Reference link:- https://www.vaultproject.io/docs/configuration/storage

Terraform has detailed logs that can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr.

You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN, or ERROR to change the verbosity of the logs. TRACE is the most verbose and it is the default if TF_LOG is set to something other than a log level name.

The Transit engine supports the versioning of keys. Key versions that are earlier than a key's specified min_decryption_version gets archived, and the rest of the key versions belong to the working set. This is a performance consideration to keep key loading fast, as well as a security consideration: by disallowing decryption of old versions of keys, found ciphertext corresponding to obsolete (but sensitive) data can not be decrypted by most users, but in an emergency, the min_decryption_version can be moved back to allow for legitimate decryption.

Reference link:- https://www.vaultproject.io/docs/secrets/transit

Vault secrets engines are used to store, generate, or encrypt data.

The KV secrets engine can store data, AWS can generate credentials, and the transit secret engine can encrypt data.

The command format for enabling Vault features is vault , therefore the correct answer would be vault secrets enable aws

In this particular question, a VPC endpoint can provide private connectivity to an AWS service without having to traverse the public internet. This way you hit a private endpoint for the service rather than connecting to the public endpoint.

This is more of an AWS-type question, but the underlying premise still holds regardless of where your Vault cluster is deployed. If you use a public cloud KMS solution, such as AWS KMS, Azure Key Vault, GCP Cloud KMS, or AliCloud KMS, your Vault cluster will need the ability to communicate with that service to unseal itself.

The terraform console command provides an interactive console for evaluating expressions.

https://www.terraform.io/docs/commands/console.html

The local-exec provisioner invokes a local executable after a resource is created. This invokes a process on the machine running Terraform, not on the resource.

Note that even though the resource will be fully created when the provisioner is run, there is no guarantee that it will be in an operable state - for example, system services such as sshd may not be started yet on compute resources.