AWS provider Practice Test 12 — 15 Questions

Question 1

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The Read permission set in HCP Terraform grants team members the ability to view workspaces, runs, state, and variables, but it does not include the permission to apply runs or approve plans. Write permission is required to queue applies and approve plans, so Read is the correct choice to allow visibility without approval authority.

Answer

Write

Answer

Admin

Answer

Cost Estimation

Question 2

If you need to share output values between workspaces, what is the best practice in HCP Terraform?

Accepted Answer

Using the 'terraform_remote_state' data source. The `terraform_remote_state` data source is the canonical way to share outputs between workspaces (or separate state files) in HCP Terraform and Terraform OSS. It reads the remote state of another workspace and exposes its root-level outputs as attributes, so consumers always get the latest values without manual copying. This keeps state as the single source of truth and avoids drift.

Answer

Emailing the values

Answer

Hardcoding the IDs

Answer

Exporting to a flat file

Question 3

How can you debug the output of a complex 'for' expression in Terraform?

Accepted Answer

Use terraform console. terraform console launches an interactive REPL where you can evaluate HCL expressions — including complex for expressions, functions, and variable references — against the current configuration and state, printing the result immediately. This makes it the fastest way to inspect what a for expression actually produces without running a full plan. It's the standard debugging tool for expression logic in Terraform.

Answer

Check the state file

Answer

Use terraform plan

Answer

Use terraform debug

Question 4

Which function allows you to safely access a map value even if the key might not exist?

Accepted Answer

lookup(). The lookup() function is specifically designed to retrieve a value from a map by key while providing a fallback default if the key is absent, preventing errors. Its signature is lookup(map, key, default), so it safely handles missing keys without throwing an error. This makes it the idiomatic choice for optional map attributes in Terraform configurations.

Answer

try()

Answer

element()

Answer

coalesce()

Question 5

Why might someone use 'prevent_destroy = true' on a database resource while allowing it on smaller web server instances?

Accepted Answer

To protect critical data from accidental deletion.. prevent_destroy = true is used to protect resources whose loss would be catastrophic or unrecoverable, such as databases containing critical data. Web server instances are typically stateless and easily recreated, so the protection is unnecessary there — making option B correct.

Answer

To increase the speed of the destroy process.

Answer

To ensure create_before_destroy works.

Answer

To satisfy the AWS provider requirements.

Question 6

Which type of Sentinel policy is used to block a run without possibility of override?

Accepted Answer

Hard-mandatory.. Sentinel policies in Terraform Cloud/Enterprise have three enforcement levels: advisory, soft-mandatory, and hard-mandatory. A hard-mandatory policy blocks the run outright and cannot be overridden by any user, including organization owners, making it the correct answer for 'block without possibility of override'.

Answer

Advisory.

Answer

Policy-Override.

Answer

Soft-mandatory.

Question 7

When debugging provider issues, which commands are most useful? (Select THREE)

Accepted Answer

terraform providers. Option A, `terraform providers`, is correct because it prints the provider requirements and the provider configuration tree for the current working directory, showing which providers each module uses and where they come from, which is essential when diagnosing provider source, version, or inheritance issues. Option B, `TF_LOG=DEBUG`, is correct because setting this environment variable enables detailed Terraform debug logging (including provider plugin communication and API calls), which is the primary way to trace provider errors and failures. Option E, `terraform init`, is correct because it initializes the working directory by downloading and installing the required provider plugins and modules, so it is the command used to resolve or reveal provider installation and version-constraint problems. Option C, `terraform fmt`, is not correct because it only rewrites configuration files to canonical formatting and does not help diagnose provider behavior. Option D, `terraform taint`, is not correct because it merely marks a resource for destruction and recreation on the next apply, which is unrelated to debugging provider issues.

Answer

terraform fmt

Answer

terraform taint

Question 8

Which command is used to move a resource from one state file to another, commonly used when refactoring modules?

Accepted Answer

terraform state mv. terraform state mv moves a resource from one state address to another, and when used with different state files (via -state and -state-out), it can move resources between state files. This is the standard command for refactoring modules without destroying and recreating resources. It updates the state mapping so Terraform associates the existing resource with the new address.

Answer

terraform migrate

Answer

terraform plan -refactor

Answer

terraform refresh

Question 9

If you want to use a provider that is not published in the Terraform Registry, how do you install it?

Accepted Answer

Use a filesystem mirror in the .terraformrc file.. Providers not published in the Terraform Registry are installed by configuring a filesystem mirror in the CLI configuration file (.terraformrc or terraform.rc), which tells Terraform where to find the provider plugin binaries locally. The provider_installation block with a filesystem_mirror directive points Terraform at a directory containing the provider packages, bypassing the default registry lookup. This is the standard approach for air-gapped environments or internal/private providers.

Answer

You cannot use private providers.

Answer

Rename the file to provider.tf.

Answer

Copy it to the root of the project.

Question 10

If a Terraform run is stuck in a 'Policy Check' phase, which step should an administrator take?

Accepted Answer

Check the Policy Set configuration and execution logs.. A run stuck in the Policy Check phase means the policy evaluation is either failing, erroring, or awaiting override. The administrator should inspect the Policy Set configuration and the run's policy execution logs to identify which policy is blocking and why. This is the direct diagnostic step before considering overrides or fixes.

Answer

Trigger a new plan.

Answer

Delete and recreate the workspace.

Answer

Disable the policy check.

Question 11

What happens if you have a provider version conflict in your module dependencies?

Accepted Answer

Terraform will fail to initialize.. When two modules or the root module declare incompatible version constraints for the same provider, Terraform cannot satisfy both and aborts during 'terraform init' with a provider version conflict error. Terraform does not silently pick a version when constraints are mutually exclusive; it requires the user to reconcile the constraints. This fail-fast behavior prevents unpredictable provider behavior across modules.

Answer

Terraform will pick the newest version.

Answer

Terraform will ignore the constraints.

Answer

Terraform will pick the oldest version.

Question 12

You need to manage resources in two different AWS regions using the same provider configuration. How do you achieve this?

Accepted Answer

Use an alias in the provider block and reference it in the resource using the provider meta-argument.. In Terraform, a single provider configuration can only target one region. To manage resources across multiple regions with the same provider type (e.g., AWS), you must define multiple provider blocks, each with a unique alias. The default provider block (without alias) handles the primary region, while additional blocks with aliases (e.g., `alias = "west"`) specify other regions. Resources then use the `provider` meta-argument to select the appropriate aliased provider, e.g., `provider = aws.west`. This allows a single Terraform configuration to manage resources in multiple regions.

Answer

Define the region twice in a single provider block.

Answer

Define two separate aws providers in the same file without aliases.

Answer

Create two separate Terraform projects.

Question 13

Your team uses HCP Terraform with a VCS-driven workflow. A developer opens a pull request that modifies a Terraform configuration. You want the plan to run automatically and the results to be visible on the pull request before merging. What should you configure?

Accepted Answer

Enable automatic speculative plans on the workspace and connect the workspace to the VCS repository.. Speculative plans are a core feature of HCP Terraform's VCS-driven workflow. They run automatically on pull requests without applying changes, and the plan output is displayed as a status check on the PR. This gives reviewers immediate insight into the proposed infrastructure changes, enabling informed decisions before merge.

Answer

Set the workspace execution mode to 'Remote' and enable run triggers from the VCS repository.

Answer

Create a CLI-driven workspace and run terraform plan locally on the pull request branch.

Answer

Configure a webhook in the VCS provider to call the HCP Terraform API to start a run on every push.

Question 14

In HCP Terraform, you have a workspace that uses the CLI-driven workflow. A team member runs terraform apply locally and then pushes the updated state to HCP Terraform. What is the primary benefit of this workflow?

Accepted Answer

It allows local execution while still leveraging HCP Terraform for state storage and collaboration.. The CLI-driven workflow in HCP Terraform is designed for users who prefer to run Terraform locally but want to use HCP Terraform for state storage and team collaboration. It combines local execution flexibility with remote state management, enabling state locking and version history without requiring remote runs.

Answer

It enforces policy checks before every apply.

Answer

It provides a fully managed remote execution environment for Terraform operations.

Answer

It automatically runs speculative plans on pull requests.

Question 15

Your organization uses HCP Terraform with a private module registry. A platform team publishes a module that provisions an Amazon RDS instance, and several application teams consume it across different workspaces. The platform team must release a backwards-incompatible change to the module's `engine_version` variable, but they do not want existing consumers to break on their next run. Which two actions should the platform team take to safely version and publish this change? (Choose two.)

Accepted Answer

Update the module's version constraint in each consuming workspace to reference the new major version.. A breaking change to a shared module must be released as a new major version so existing consumers are unaffected, and each consumer must explicitly raise its version constraint to adopt it. Together these steps isolate the incompatible change, preserve reproducibility for teams not yet ready to migrate, and keep adoption a deliberate per-workspace decision.

Answer

Edit the `engine_version` variable in place and re-tag the existing module version so all consumers receive the update automatically.

Answer

Delete the previous major version from the registry so consumers are forced to upgrade on their next plan.

Answer

Change the module source address in the consuming workspaces to point at the platform team's VCS branch directly.