AWS provider Practice Test 10 — 10 Questions

Question 1

What is the correct way to specify a version constraint for a provider that must be at least 3.0 but less than 4.0?

Accepted Answer

version = "~> 3.0". The pessimistic constraint operator ~> 3.0 means '>= 3.0 and < 4.0', allowing any 3.x release while preventing upgrades to 4.0. This matches the requirement of at least 3.0 but less than 4.0 exactly. It is the idiomatic Terraform way to pin to a major version while accepting minor and patch updates.

Answer

version = ">= 3.0"

Answer

version = "3.0"

Answer

version = "> 3.0, < 4.0"

Question 2

You have a nested module structure. How can you pass a variable from the root module through an intermediate module to a leaf module?

Accepted Answer

You must define the variable in the intermediate module and pass it to the leaf module.. In Terraform, variables are not automatically inherited by child modules. To pass a variable from the root module to a leaf module through an intermediate module, you must explicitly define the variable in the intermediate module and pass it to the leaf module. This means declaring the variable in the intermediate module's variables.tf and then using it in the module block that calls the leaf module.

Answer

Define the variable only in the leaf module and refer to root by index.

Answer

You can use the 'global_vars' block in the root.

Answer

The intermediate module automatically inherits all root variables.

Question 3

What happens if two team members try to apply changes to the same workspace in HCP Terraform simultaneously?

Accepted Answer

The second run is queued. HCP Terraform (formerly Terraform Cloud) enforces a run queue per workspace. When two team members trigger runs simultaneously, the first run acquires the workspace lock and executes; the second run is placed in a queue and will start only after the first completes (or is canceled). This prevents concurrent state modifications and state corruption.

Answer

The state file will be corrupted

Answer

The latest one wins

Answer

Both runs will fail

Question 4

What is the primary risk of relying solely on 'create_before_destroy' without considering dependency chains?

Accepted Answer

It can lead to resource contention or naming conflicts.. 'create_before_destroy' makes Terraform create the replacement resource before destroying the old one. When resources have unique names, fixed IPs, or other globally unique identifiers, the new resource cannot be created while the old one still exists, causing naming conflicts or resource contention. This is the primary risk when dependency chains are not carefully considered.

Answer

It causes infinite loops in Terraform.

Answer

It increases the cost of the plan.

Answer

It creates a security risk.

Question 5

Which meta-argument is used to explicitly associate a resource with a non-default provider instance?

Accepted Answer

provider. The `provider` meta-argument is used within a resource block to explicitly specify which provider configuration to use, especially when multiple provider configurations exist (e.g., different regions or accounts). For example, `provider = aws.west` tells Terraform to use the `aws` provider instance with the alias `west`. This overrides the default provider configuration for that resource.

Answer

configuration

Answer

alias

Answer

instance

Question 6

Which TWO of the following are valid ways to handle a resource that has become 'tainted'?

Accepted Answer

Run 'terraform apply' to recreate it.. Option A is correct because running 'terraform apply' after a resource has been tainted causes Terraform to destroy and recreate that resource, which is the standard way to replace a tainted object. Option B is correct because 'terraform untaint <resource_name>' explicitly removes the taint marker from the resource in the state, leaving the existing object in place without forcing replacement. Option C is wrong because 'terraform refresh' only reconciles state with real infrastructure and does not clear taint status. Option D is wrong because 'terraform state rm' removes the resource from state entirely, which is not a taint-handling operation and can cause orphaned infrastructure. Option E is wrong because 'terraform plan' has no '-force-apply' flag; it only previews changes and cannot apply or clear a taint.

Answer

Run 'terraform refresh' to clear the taint.

Answer

Use 'terraform state rm' to fix the taint.

Answer

Use 'terraform plan -force-apply'.

Question 7

An operations engineer runs terraform init in a CI pipeline and notices the .terraform.lock.hcl file lists hashes for linux_amd64 only. A developer on macOS arm64 runs terraform init in the same repository and Terraform downloads a different provider build. The team wants the lock file to include hashes for both platforms so CI and developer workstations verify the same provider artifacts. Which command should the engineer run?

Accepted Answer

terraform providers lock -platform=linux_amd64 -platform=darwin_arm64. The dependency lock file records provider package hashes per platform. Running terraform providers lock with an explicit -platform flag for each target OS and architecture regenerates the lock file so it contains hashes for linux_amd64 and darwin_arm64. Subsequent init runs on either platform then verify the selected provider build against the recorded hashes without conflict.

Answer

terraform providers schema -json > lock.hcl

Answer

terraform providers mirror ./vendor -platform=linux_amd64 -platform=darwin_arm64

Answer

terraform init -upgrade -platform=linux_amd64,darwin_arm64

Question 8

Which THREE of the following items can be included in a Variable Set?

Accepted Answer

Terraform variables.. In Terraform Cloud/Enterprise, a Variable Set is a reusable container of variables that can be applied across multiple workspaces, and it can hold Terraform variables (option A), which are the input variables (e.g., terraform.tfvars-style key/value pairs) consumed by the Terraform configuration during a run. It can also hold environment variables (option B), which are injected into the run environment as shell environment variables (for example, credentials like AWS_ACCESS_KEY_ID or TF_LOG). Additionally, a Variable Set includes a scope definition (option E) that determines whether it applies to the entire Organization or is limited to specific Projects, controlling which workspaces inherit the variables. Terraform provider configurations (option C) are not stored in Variable Sets; providers are configured in the Terraform configuration or via environment variables/credentials, not as a Variable Set item type. Sentinel policy sets (option D) are a separate governance feature managed independently of Variable Sets and are not an includable item within them.

Answer

Terraform provider configurations.

Answer

Sentinel policy sets.

Question 9

Why would you use a 'locals' block within a module instead of passing everything through variables?

Accepted Answer

To reduce repetition and perform transformations on inputs.. A 'locals' block lets you define named expressions that can be reused throughout the module, reducing repetition and enabling transformations (e.g., string concatenation, merging maps, computing tags) on input variables. Locals are computed once per plan and referenced as 'local.name'.

Answer

To allow the user to override internal values easily.

Answer

To bypass input validation.

Answer

To store state data securely.

Question 10

If an organization wants to allow teams to manage their own workspaces but prevent them from viewing other teams' workspaces, how should they configure HCP Terraform?

Accepted Answer

Assign teams access at the Project level rather than the Organization level.. HCP Terraform projects group workspaces and let you assign team permissions at the project level, so a team can manage its own workspaces without seeing workspaces in other projects. This scopes access narrowly and satisfies the least-privilege requirement. Organization-level access would grant visibility across all projects, which is exactly what must be prevented.

Answer

Enable 'Organization-wide' access for all teams.

Answer

Use individual workspace permissions instead of projects.

Answer

Create a separate organization for each team.