TF-Associate-004 - Terraform configuration - Section 4c

Use variables and outputs.

Input variables parameterise a configuration with types, defaults and validation; outputs export values for humans or calling modules. Candidates should know variable precedence and marking a variable or output sensitive, and that outputs are computed after apply.

input variableoutput valuevariable defaults and typessensitive outputs

Practice question for this objective

Free sampleTerraform configurationmedium

A practitioner reads a credential from Vault with a data source and passes it into a resource. During terraform apply the value still appears in a nearby output block in the console. The team wants the output value redacted from CLI output. What is the correct fix?

output "connection_string" {
  value = local.connection_string
}
  • ARemove the output block entirely, because any output that references a Vault value forces Terraform to print it in clear text.
  • BAdd sensitive = true to the output block so Terraform redacts its value in plan and apply output. Correct
  • CMove the credential into a separate workspace so the output runs in a context where redaction is applied by default.
  • DWrap the value in the nonsensitive function so Terraform recognises it should be hidden from the console.
Marking an output block sensitive redacts its value from CLI output while the value remains stored in state. Terraform tracks sensitivity through expressions, but an output derived from a secret is only redacted when the output itself is marked sensitive; that setting changes display, not storage, so the value still lives in state.

Why A is wrong: Deleting the output is heavier than needed and the premise is wrong; an output can reference a secret and still be redacted with the right setting.

Why B is correct: Correct: marking the output sensitive suppresses its value in CLI output while still recording it in state, which is the intended redaction control.

Why C is wrong: Workspaces isolate state but do not change how outputs are displayed, so this does nothing to redact the printed value.

Why D is wrong: This is backwards; nonsensitive strips the sensitive marking to reveal a value, so it would expose rather than redact the output.

See more TF-Associate-004 practice questions, answers explained.

More in this domain

Back to all Terraform configuration objectives, or the TF-Associate-004 cert hub.

Examworthy is not affiliated with or endorsed by HashiCorp. Original, blueprint-aligned practice material only.