In regards to Terraform state file, select all the statements below which are correct?

Question

Options

• AWhen using local state, the state file is stored in plain-text.
• BThe state file is always encrypted at rest.
• CStoring state remotely can provide better security.
• DUsing the mask feature, you can instruct Terraform to mask sensitive data in the state
• EThe Terraform state can contain sensitive data, therefore the state file should be
• FTerraform Cloud always encrypts state at rest.

• A
  90% (47)
• B
  4% (2)
• D
  6% (3)

Explanation

A is correct: local state is stored as a plain-text JSON file (terraform.tfstate) with no encryption. B is incorrect: state is NOT always encrypted at rest - it depends on the backend (local state is unencrypted). C is correct: remote backends like S3 with server-side encryption, or Terraform Cloud, provide better security than a local plaintext file. D is incorrect: Terraform has no 'mask' feature for sensitive data in state files - sensitive values are stored in plaintext within the state. E is correct: state can contain sensitive data (passwords, keys, connection strings), so the file must be protected with strict access controls. F is correct: Terraform Cloud always encrypts state at rest as part of its managed service guarantees.

No community discussion yet for this question.