1Z0-997-25 Question 24
Select 2You are leading the deployment of a multi-tier application on Oracle Cloud Infrastructure (OCI) using Terraform. The design includes multiple compartments, a VCN with subnets for each tier, an Internet Gateway, and several Compute instances. You need to ensure minimal manual configuration and maintain consistent environments for development, testing, and production. Which TWO practices should you follow to implement Infrastructure as Code (IaC) effectively in this scenario?
- A
Store Terraform state in an OCI Object Storage bucket with versioning enabled, and configure backend block references to manage states across all environments.
- B
Hard-code all secrets in Terraform variable files to simplify automation for different application tiers.
- C
Create Terraform modules for reusable resources like VCNs and subnets, and call these modules from separate environment-specific configurations.
- D
Run 'terraform apply' manually from a single developer� workstation for each environment to ensure direct control.
Show answer and explanation
Correct answers: A, C
Explanation
When implementing IaC on OCI using Terraform, best practices include storing Terraform state securely in an OCI Object Storage bucket (with versioning and encryption) and organizing reusable modules for common resource patterns. Following these practices helps proactively manage state, ensure consistency, and minimize the risk of configuration drift or human error. Refer to OCI documentation on Terraform best practices (https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/terraformUsing.htm) for more detailed guidance.
- A. Correct.
Correct. Storing state in an OCI Object Storage bucket with versioning and encrypting data at rest is a recommended best practice for managing Terraform state. By configuring a backend block to reference the bucket, you can securely keep state files for multiple environments without risk of local overwrites or accidental deletions.
- B. Incorrect.
Incorrect. Hard-coding secrets in variable files is considered insecure. It makes them visible in code repositories and logs, increasing the risk of exposure.
- C. Correct.
Correct. Creating Terraform modules for commonly used sets of resources (like your VCN and subnets) helps maintain consistency and reduces code duplication. Different environment configurations can call these modules with environment-specific variables.
- D. Incorrect.
Incorrect. Manually running Terraform from a single machine for each environment introduces a single point of failure and reduces scalability. It also risks accidental misuse of credentials or state files.