HashiCorp Terraform Associate (004) Question 209
Select 38b Describe HCP Terraform collaboration and governance featuresA platform team uses HCP Terraform to manage infrastructure for several application teams. They want every change to infrastructure code to be reviewed before apply, prevent developers from using unsupported cloud regions, and give security engineers a way to evaluate proposed changes during the plan stage. Which combination of HCP Terraform features best meets these requirements?
- A
Use VCS-driven workspaces with speculative plans and require applies through the HCP Terraform workflow, combined with team-based permissions to separate plan/review from apply access
- B
Use Sentinel policy checks to enforce rules such as denying unsupported cloud regions before runs can proceed
- C
Use run tasks to send plan information to an external security tool for additional evaluation during the run lifecycle
- D
Use terraform validate on each developer laptop as the primary governance control for region restrictions and approval enforcement
- E
Store state locally and require developers to coordinate reviews in a shared chat channel before running terraform apply
Show answer and explanation
Correct answers: A, B, C
Explanation
The best answer is the combination of VCS-driven workflows with permissions, Sentinel, and run tasks. HCP Terraform collaboration features include remote runs, VCS integration, speculative plans, workspace/team permissions, and controlled apply workflows. Its governance features include Sentinel policy enforcement and integrations through run tasks for external security and compliance checks. Together, these features let teams review proposed infrastructure changes, enforce organizational rules before apply, and incorporate third-party security evaluation into the run lifecycle. By contrast, local-only commands such as terraform validate or manual review processes in chat do not provide centralized, auditable governance. These capabilities are described in HCP Terraform documentation for workspaces and VCS-driven runs, team and permission management, Sentinel policies, and run tasks.
- A. Correct.
Correct. HCP Terraform supports VCS-driven workflows, speculative plans for proposed changes, and role/team-based access controls. In practice, this enables collaboration by letting users review plans from pull requests and restricting who can apply changes. This aligns with governance goals because review and apply permissions can be separated instead of allowing every developer to run unrestricted applies.
- B. Correct.
Correct. Sentinel is HCP Terraform's policy-as-code framework for governance. It can evaluate Terraform runs and enforce mandatory rules, such as restricting provider configuration or denying resources in unsupported regions. This is the right feature for organization-wide policy enforcement rather than relying on informal review alone.
- C. Correct.
Correct. Run tasks integrate HCP Terraform with external systems during the run lifecycle, commonly after the plan stage. This allows security or compliance platforms to inspect the planned changes and report pass/fail results before an apply proceeds. This directly matches the requirement for security engineers to evaluate proposed changes during planning.
- D. Incorrect.
Incorrect. terraform validate is useful for checking configuration syntax and internal consistency, but it is not a centralized collaboration or governance mechanism. It does not enforce organization-wide approval workflows in HCP Terraform, and by itself it is not the correct control for mandatory region restrictions across teams.
- E. Incorrect.
Incorrect. Local state and chat-based reviews bypass HCP Terraform collaboration and governance capabilities. This approach provides weak auditability, no built-in policy enforcement, and no controlled run workflow. It is the opposite of using HCP Terraform's centralized features for review, policy checks, and governed applies.