HFCP study plan

Explain the cloud shared responsibility model and map each layer to what the customer configures versus what the provider configures

Compare IaaS, PaaS, and SaaS using at least two concrete examples per model and state which operational tasks shift to the provider

Install Terraform locally and configure a remote backend against an object storage bucket, then verify state locking works by running two applies concurrently

Write a Terraform configuration that provisions one network and one compute instance using variables, outputs, and a provider version constraint

Trace how terraform init, plan, and apply differ in what they read and write, including what the plan file contains

Refactor a flat configuration into modules with defined input variables, outputs, and a pinned source reference

Demonstrate the difference between count and for_each by building a collection of resources and predicting the plan output for each

Use terraform state commands to inspect, move, and remove a resource from state without destroying the real infrastructure

Configure lifecycle rules including create_before_destroy and prevent_destroy, and explain when each prevents an outage

Write a plan that shows a no-op change after a manual drift edit, then reconcile the drift

Set up a CI pipeline that runs terraform fmt check, validate, and a saved plan on every pull request

Implement a manual approval gate before apply and explain why plan artifacts must be treated as sensitive

Add automated tests for module behavior using a framework such as Terratest or native terraform test, covering at least one success and one failure path

Configure pre-commit hooks that block commits failing fmt or validate

Describe how workspaces or directory separation isolate environments and choose one approach with written justification

Model a network with public and private subnets, route tables, and a NAT path using Terraform, then verify traffic flow

Write security group and network policy rules that follow least privilege and prove a denied connection is actually blocked

Explain how service discovery resolves a service name to healthy instances and contrast client-side with server-side load balancing

Deploy a service mesh sidecar proxy and observe mTLS-encrypted traffic between two services

Define a mesh traffic policy that splits traffic between two service versions and verify the split empirically

Start a Vault dev server, then repeat the setup with a file backend and explain why dev mode is unsuitable outside labs

Compare token, approle, and userpass auth methods and configure one non-root auth method with a least-privilege policy

Write a policy that grants read on one path and denies another, then prove the denial with a CLI request

Enable a KV v2 secrets engine, store a credential, and demonstrate versioning plus soft delete and undelete

Configure a dynamic database credential or cloud credential engine and show that the lease expires and the credential is revoked

Explain Vault seal and unseal, and contrast Shamir shares with auto-unseal using a cloud KMS

Integrate an application with Vault by injecting a secret at runtime instead of baking it into an image or environment file

Describe the HCP control plane model and distinguish organization, project, and workspace scoping

Create an HCP Terraform workspace, connect it to a VCS repository, and run a remote plan triggered by a commit

Configure a variable set and a sensitive variable in HCP Terraform, and verify the value is masked in run output

Implement a policy-as-code check that fails a plan when a resource violates an approved rule

Design a promotion workflow that moves the same artifact from a non-production to a production workspace with approval

Automate Vault secret rotation and wire the rotated credential into an application without downtime

Explain how run triggers, CLI-driven runs, and API-driven runs differ and pick the right one for a scheduled drift check

Document a rollback procedure for a failed apply and rehearse it in a non-production workspace

Review missed practice questions by domain and rewrite the underlying concept in your own words for each miss

Re-derive the shared responsibility boundary for a managed Kubernetes service and a managed database

Re-explain mesh mTLS, service identity, and certificate rotation from memory without notes

Complete two timed mixed-domain practice sets and record per-domain accuracy

Build a one-page reference sheet linking Terraform, Vault, and mesh concepts to the operational problem each solves