Terraform follows adeclarativeapproach, meaning it ensures the infrastructure matches the configuration.
If you run terraform apply againwithout any changes, Terraform willdetect that the infrastructure is already up to dateand willdo nothing.
The command will complete successfully with the message"No changes. Your infrastructure matches the configuration." Official Terraform Documentation Reference:
Terraform Apply - HashiCorp Documentation

Rationale for Correct Answer:
C: Securely managed .tfvars files are acceptable if not committed to version control.
D: HCP Terraform provides secure storage for sensitive variables.
E: HashiCorp Vault is designed for secrets management and integrates with Terraform.
Analysis of Incorrect Options (Distractors):
A: Plaintext storage is insecure.
B: Secrets should never be committed to version control.
Key Concept:Sensitive values must be stored using secure secret management solutions.
Reference:Terraform Exam Objective - Use Terraform to Manage Infrastructure

Sentinel policies are checked after the plan stage of a Terraform run, but before it can be confirmed or the terraform apply is executed3. This allows you to enforce rules on your infrastructure before it is created or modified.

To import existing resources into Terraform, you need to do two things1:
Write a resource configuration block for each resource, matching the type and name used in your state file.
Run terraform import for each resource, specifying its address and ID. There is no such command as terraform Import-gcp, and provisioning new VMs with the same names will not import them into Terraform.

Detailed Explanation:
* Rationale for Correct Answer: Terraform state can contain sensitive values, including passwords, private keys, access tokens, generated secrets, database credentials, and provider-returned sensitive attributes. Even when values are marked sensitive in Terraform output, they may still exist in state.
* Analysis of Incorrect Options (Distractors):
* B. It stores all environment variables from the machine that created it. Incorrect. Terraform state does not store all local environment variables.
* C. It can be manually edited to change deployed resources. Incorrect. Manual state editing can affect Terraform's understanding of infrastructure, but it does not directly change real deployed resources.
* D. It contains personal information about the last user to update it. Incorrect. This is not the primary sensitivity concern for Terraform state.
* Key Concept: Terraform state may contain plaintext sensitive infrastructure data and must be protected.
Reference: Terraform Objective Domain: Implement and Maintain State