Your manager has instructed you to start using terraform for your day-to-day operations, but your security team is concerned about the terraform state files. They have heard it contains confidential…

Question

Options

• AInform the security team that using terraform state is optional . There are ways to avoid
• BEnsure that the state is managed in a remote backend , preferably an enterprise grade
• CMask the confidential entries in the terraform state file , using Vault Enterprise, another
• DKeep the state file locally on each developer machine , and ensure that there is a local

• A
  4% (1)
• B
  80% (20)
• C
  12% (3)
• D
  4% (1)

Explanation

Terraform state files can contain sensitive data such as database passwords, access keys, and other secrets in plaintext. The recommended best practice is to store state in a remote backend (e.g., Terraform Cloud, AWS S3 with encryption, HashiCorp Consul). Enterprise-grade remote backends provide encryption at rest, TLS in transit, access control policies, audit logging, and state locking. Option A is incorrect because state is not optional - Terraform requires it to track resource mappings. Option C (masking with Vault) is not a native Terraform state capability. Option D (local per-developer) is the worst approach: state can drift, secrets are exposed on developer machines, and there is no collaboration or locking.

No community discussion yet for this question.