TF-Associate-004 - Terraform configuration (21% of the exam) - Section 4c
Use variables and outputs.
Input variables parameterise a configuration with types, defaults and validation; outputs export values for humans or calling modules. Candidates should know variable precedence and marking a variable or output sensitive, and that outputs are computed after apply.
input variableoutput valuevariable defaults and typessensitive outputs
Practice question for this objective
lock_openFree sampleTerraform configurationmedium
A practitioner reads a credential from Vault with a data source and passes it into a resource. During terraform apply the value still appears in a nearby output block in the console. The team wants the output value redacted from CLI output. What is the correct fix?
output "connection_string" {
value = local.connection_string
}
ARemove the output block entirely, because any output that references a Vault value forces Terraform to print it in clear text.
BAdd sensitive = true to the output block so Terraform redacts its value in plan and apply output.check_circle Correct
CMove the credential into a separate workspace so the output runs in a context where redaction is applied by default.
DWrap the value in the nonsensitive function so Terraform recognises it should be hidden from the console.
Marking an output block sensitive redacts its value from CLI output while the value remains stored in state. Terraform tracks sensitivity through expressions, but an output derived from a secret is only redacted when the output itself is marked sensitive; that setting changes display, not storage, so the value still lives in state.
Why A is wrong: Deleting the output is heavier than needed and the premise is wrong; an output can reference a secret and still be redacted with the right setting.
Why B is correct: Correct: marking the output sensitive suppresses its value in CLI output while still recording it in state, which is the intended redaction control.
Why C is wrong: Workspaces isolate state but do not change how outputs are displayed, so this does nothing to redact the printed value.
Why D is wrong: This is backwards; nonsensitive strips the sensitive marking to reveal a value, so it would expose rather than redact the output.
Answers that look right on this material and are not. Each one is a distractor from a different question in the TF-Associate-004 bank for this domain.
The reference is invalid because a resource cannot depend on an attribute that has no value during plan.
errorWhy it is wrong: This misreads the marker as an error, but (known after apply) is normal for computed attributes and does not indicate an invalid reference.
aws_instance.web.config.public_ip, reading the argument the practitioner set in the block.
errorWhy it is wrong: This looks structured but no config attribute path exists, and the block never set public_ip, so the argument is not a source for the assigned value.
To export a computed attribute of a resource so that other configurations and the CLI can read it after apply.
errorWhy it is wrong: Exposing a computed value after apply is the job of an output value, not an input variable, so this confuses the two constructs.