Which approach helps prevent exposure of sensitive data in Terraform state when using a remote backend?

• A. Delete the state file after every apply
• B. Store the state in an encrypted backend
• C. Scrub the state manually after each run
• D. Store secrets in a separate text file

Answer: (B)

Protecting sensitive data in Terraform state by using encryption at the backend. The state file can contain secrets like passwords, API keys, and tokens, so storing it in an unencrypted place risks exposure. A remote backend that encrypts data at rest (and typically in transit), with proper access controls and versioning, reduces that risk by ensuring the stored state is handled securely and only accessible to authorized users. This is why loading the state into an encrypted backend is the best approach when using remote backends.

Deleting the state after every apply would break Terraform’s ability to manage resources, and manual scrubbing is error‑prone and easy to miss fields. Storing secrets in a separate text file keeps data in another location but doesn’t integrate with Terraform’s state management and still risks leakage.