In terraform, most resource dependencies are handled automatically. Which of the following statements describes best how terraform resource dependencies are handled?

• A. Resource dependencies are handled automatically by the depends_on meta_argument, which is set to true by default.
• B. Resource dependencies are identified and maintained in a file called resource. dependencies. Each terraform provider is required to maintain a list of all resource dependencies for the provider and it's included with the plugin during initialization when terraform init is executed. The file is located in the terraform.d folder.
• C. The terraform binary contains a built-in reference map of all defined Terraform resource dependencies. Updates to this dependency map are reflected in terraform versions. To ensure you are working with the latest resource dependency map you much be running the latest version of Terraform.
• D. Terraform analyses any expressions within a resource block to find references to other objects and treats those references as implicit ordering requirements when creating, updating, or destroying resources.

You've decided to use AWS KMS to automatically unseal Vault on private EC2 instances. After deploying your Vault cluster, and running vault operator init, Vault responds with an error and cannot be unsealed.
You've determined that the subnet you've deployed Vault into doesn't have internet access. What can you do to enable Vault to communicate with AWS KMS in the most secure way?

• A. ask the networking team to provide Vault with inbound access from the internet
• B. add a VPC endpoint
• C. deploy Vault in a public subnet and provide the Vault nodes with public IP addresses
• D. change the permissions on the Internet Gateway to allow the Vault nodes to communicate over the Internet

When architecting a Vault replication configuration, why should you never terminate TLS on a front-end load balancer?

• A. Vault requires that only Consul service discovery can be used to direct traffic to an active Vault node.
• B. If Vault detects that the traffic has been unencrypted and re-encrypted, due to the load balancer, it will automatically drop the traffic as it is no longer trusted.
• C. Vault replication won't work with the type of certificates that a traditional load balancer uses.
• D. Vault generates self-signed mutual TLS for replication. If the LB is performing TLS termination, this will break the mutual TLS between nodes.

Which is not a benefit of running HashiCorp Vault in your environment?

• A. Consolidate static, long-lived passwords used throughout your organization
• B. The ability to generate dynamic secrets for applications and resource access
• C. Act as root or intermediate certificate authority to automate the generation of PKI certificates
• D. Integrate with your code repository to pull secrets when deploying your applications

You are deploying Vault in a local data center, but want to be sure you have a secondary cluster in the event the primary cluster goes offline. In the secondary data center, you have applications that are running, as they are architected to run active/active. Which type of replication would be best in this scenario?

• A. performance replication
• B. disaster recovery replication
• C. end-to-end replication
• D. single-node replication