[Understand Terraform's Purpose and Use Cases] Which of these are benefits of using Sentinel with HCP Terraform/Terraform Cloud? (Pick the 2 correct…

Sentinel is the policy-as-code framework that integrates with Terraform Cloud/HCP Terraform to evaluate a run before any infrastructure is applied. Policies can inspect the generated Terraform plan and configuration, so you can: • require that resources use only a predefined list of AMIs (guard-rail on image provenance) – a classic Sentinel example; • codify and automatically enforce many security best-practices (e.g., mandatory tags, restricted ports, cost limits) as part of every run. Sentinel itself does not manipulate secrets, and its policies are written in the Sentinel language, not HCL, so those capabilities are not benefits of Sentinel.

B. Sentinel policies are written in the Sentinel language; HCL is only the syntax for Terraform configuration, not Sentinel policy. C. Credential checkout/check-in is a Vault feature; Sentinel merely evaluates policy and has no key-management functions.

1. HashiCorp Terraform Cloud Docs – “Sentinel Overview”, ¶1-2, Example: “Allowed AMI IDs” (https://developer.hashicorp.com/terraform/cloud-docs/sentinel/overview)

2. HashiCorp Sentinel Language Specification – “Policies are written in the Sentinel language” (https://developer.hashicorp.com/sentinel/language/spec)

3. HashiCorp Terraform Cloud Docs – “Common Policy Sets: Security Best Practices” (https://developer.hashicorp.com/terraform/cloud-docs/sentinel/examples#security)