HCP Terraform: free practice questions

Option C is correct. A soft-mandatory Sentinel policy failure pauses the run and requires a user with the 'Manage Policy Overrides' permission to explicitly override the failure before the apply step is unlocked. The current operator cannot unblock it themselves due to lacking that permission. Option A is wrong because the run is not discarded—it stays in a paused/needs-override state. Option B is wrong because soft-mandatory failures DO block the run; only advisory failures are non-blocking. Option D is wrong because the apply gating is based on the override permission, not on whether the plan produces changes.

Option B is correct. HCP Terraform's cost estimation feature calculates a projected monthly cost delta—showing the estimated cost before and after the planned changes—for a supported subset of resource types across AWS, Azure, and Google Cloud. Importantly, it is inserted into the run pipeline after the plan but before Sentinel policy checks, allowing policies to act on cost data (e.g., rejecting plans that exceed a cost threshold). Option A is wrong because coverage is not complete for all resource types and does not use real-time billing API queries; it uses static pricing tables. Option C is wrong because cost estimation is prospective (pre-apply), not retrospective. Option D is wrong because cost estimation supports AWS, Azure, and GCP, and does not require any cloud credentials or IAM roles—it works from the plan's resource definitions.

When an HCP Terraform workspace uses Remote execution mode with 'Auto apply' disabled (the default), every run pauses at the 'planned' state after the plan phase and waits for a user with appropriate permissions to click 'Confirm & Apply'. This is the built-in mechanism for requiring human approval before any apply proceeds, regardless of how the run was triggered. — Option A is wrong because enabling 'Auto apply' causes runs to proceed to apply automatically without human confirmation, which is the opposite of what is required. — Option C is wrong because Local execution mode offloads the plan and apply to the engineer's local machine; HCP Terraform only stores state. It does not provide a centralized approval gate inside the platform for team-based review. — Option D is wrong because Sentinel policies gate applies based on policy logic, not on a blanket 'pause for human review' pattern. Sentinel is a policy-as-code governance tool and cannot be configured to simply require an operator comment as a generic approval mechanism; the correct purpose-built feature for approval gates is disabling Auto apply.

Option B is correct. In a VCS-driven workflow, when a pull request is opened against a connected branch, HCP Terraform automatically runs a speculative plan—a read-only, non-applied plan—and posts the results as a commit status check on the pull request, giving reviewers visibility into infrastructure changes before merge. Option A is wrong because HCP Terraform never auto-applies on a PR; an apply only occurs after a merge to the tracked branch (and even then may require confirmation). Option C is wrong because HCP Terraform does not block PRs via webhook in this way; the status check is informational and can be required by branch protection rules but is not a block managed by HCP Terraform itself. Option D is wrong because HCP Terraform does trigger a speculative plan on the PR itself, not only after merge.

A soft-mandatory policy failure causes the run to halt at the policy check stage and display a 'Policy check soft failed' status — it does not auto-apply (Option 3 is correct). However, unlike a hard-mandatory failure, it CAN be overridden: a user with the 'Manage Policies' permission (typically organization owners or policy managers) can click 'Override & Continue' to allow the apply to proceed despite the failure (Option 1 is correct). — Option A is wrong because the run is not permanently discarded; it remains in a paused state and can be overridden or the plan can be discarded manually. — Option C is wrong because that describes an 'advisory' enforcement level, not soft-mandatory. Advisory policies log the failure but never block the apply. Soft-mandatory DOES block unless overridden. — Option E is wrong because there is no automatic grace period or timer in HCP Terraform policy checks; the run waits indefinitely for a human action. — Option F is wrong because the override permission is tied to the 'Manage Policies' permission at the organization level, not solely to workspace-level admins.