AWS provider Practice Test 19 — 15 Questions

Question 1

What is the primary benefit of using a module registry compared to a local file path for module distribution?

Accepted Answer

It enables version control and easier sharing across the organization.. A module registry (such as the public Terraform Registry or a private registry like Terraform Cloud's) provides a centralized, versioned catalog of modules. When you reference a module via a registry source, you can pin an exact version (e.g., `version = "1.2.0"`), which enables reproducible deployments and safe upgrades. It also makes modules discoverable and shareable across teams and organizations without manually copying files or managing relative paths. Local file paths offer none of these versioning or sharing capabilities.

Answer

It allows you to run Terraform commands faster.

Answer

It removes the need for input variables.

Answer

It automatically converts your code to a higher-level language.

Question 2

Which TWO of the following accurately describe the behavior of 'terraform state rm'?

Accepted Answer

It stops Terraform from tracking the resource.. Option A is correct because 'terraform state rm' removes the specified resource from the Terraform state file, so Terraform no longer tracks or manages that resource in future plans and applies. Option B is correct because the command only edits state metadata; it does not call the provider's delete API, so the actual real-world resource (e.g., an EC2 instance or S3 bucket) continues running untouched. Option C is wrong because no 'force' flag is required for all resources; the command simply removes the address from state. Option D is wrong because the action is not strictly irreversible — you can re-import the resource with 'terraform import' or restore a state backup. Option E is wrong because 'terraform state rm' never destroys cloud infrastructure; only 'terraform destroy' or 'terraform apply' with removal does that.

Answer

It requires the 'force' flag for all resources.

Answer

It is a permanent action that cannot be undone.

Answer

It destroys the infrastructure in the cloud.

Question 3

You are writing a Terraform configuration that creates multiple AWS S3 buckets. The bucket names are derived from a list of project names, but you need to ensure that the names are unique and that the configuration can be safely modified without affecting existing buckets. Which approach should you use?

Accepted Answer

Use for_each with a map where the keys are the project names and the values are the desired bucket configurations.. Using for_each with a map ensures that each resource instance is uniquely identified by its map key, so changes to the map only affect the corresponding instances. This provides stable resource addresses and avoids the pitfalls of count, where reordering or removing elements can cause unintended destruction and recreation of resources.

Answer

Use a for expression to create a list of bucket names and then pass that list to the bucket resource's name argument.

Answer

Use count with the length of the project list and reference each bucket by index.

Answer

Use a dynamic block to generate multiple bucket resources within a single resource block.

Question 4

Two engineers on your team run `terraform apply` against the same HCP Terraform workspace within seconds of each other. The workspace uses remote execution and has no run triggers configured. What does HCP Terraform do to coordinate these concurrent runs?

Accepted Answer

The second run is queued and can only start after the first run reaches a terminal state, respecting the workspace's run queue.. HCP Terraform enforces a single active run per workspace by queueing subsequent runs. The queued run begins only after the active run completes, which prevents simultaneous state mutations and keeps the team's changes ordered. Engineers can cancel or discard queued runs if a newer change supersedes them.

Answer

The second run overwrites the first run's plan file and applies against the latest state snapshot automatically.

Answer

Both runs execute in parallel and Terraform resolves conflicts by last-writer-wins on each resource.

Answer

The second run fails immediately with a state lock error because DynamoDB locking is not configured.

Question 5

What is the purpose of 'Project' in HCP Terraform?

Accepted Answer

To group workspaces and manage access control for teams.. Projects are used to group workspaces, allowing for easier team permission management and organization.

Answer

To define the Sentinel policies for an environment.

Answer

To store Terraform state files securely.

Answer

To define the cloud provider budget.

Question 6

Which file stores the mapping between your Terraform configuration and the real-world infrastructure?

Accepted Answer

terraform.tfstate. The `terraform.tfstate` file is Terraform's state file, which stores the mapping between resources declared in configuration and the real-world infrastructure objects, including their attributes and dependencies. It is the source of truth Terraform uses to plan changes and detect drift.

Answer

terraform.tfvars

Answer

provider.tf

Answer

backend.tf

Question 7

You have an AWS Lambda function defined with the aws_lambda_function resource. The function's source code is packaged in an S3 object. You want Terraform to replace the Lambda function whenever the S3 object's ETag changes, indicating a new version of the code. Which configuration should you add to the aws_lambda_function resource?

Accepted Answer

lifecycle { replace_triggered_by = [aws_s3_object.lambda_package.etag] }. Using replace_triggered_by with the S3 object's etag attribute ensures the Lambda function is replaced when the code changes, as indicated by the ETag. The other options either ignore changes, control order, or block destruction, none of which trigger replacement based on ETag.

Answer

lifecycle { prevent_destroy = true }

Answer

lifecycle { ignore_changes = [s3_key] }

Answer

lifecycle { create_before_destroy = true }

Question 8

You are configuring run triggers in HCP Terraform to orchestrate a multi-workspace deployment on AWS. Workspace A provisions a VPC and outputs the VPC ID. Workspace B needs to consume that VPC ID to deploy subnets. You want Workspace B to automatically start a run after Workspace A successfully applies. Which configuration should you implement?

Accepted Answer

In Workspace B, add a run trigger that references Workspace A as the source workspace.. Run triggers are defined on the destination workspace, specifying the source workspace whose successful apply will trigger a run. This enables dependency chains between workspaces. Reading remote state does not trigger runs, and webhooks are for notifications, not native orchestration.

Answer

In Workspace A, add a run trigger that references Workspace B as the destination workspace.

Answer

Use a Terraform data source in Workspace B to read the remote state of Workspace A.

Answer

Configure a webhook in Workspace A that calls the HCP Terraform API to start a run in Workspace B.

Question 9

You manage an AWS RDS DB instance with Terraform. During a maintenance window, an operator manually resizes the instance class in the AWS Management Console. You want Terraform to detect this drift on the next plan but NOT automatically revert it, so you can decide later. What should you do?

Accepted Answer

Run `terraform plan` normally; the plan will show the drift as an in-place update, and you can defer applying.. A standard plan performs a refresh by default, comparing the real AWS resource against the configuration. The manual instance class change appears as an in-place update, so the drift is visible without applying. Deferring apply preserves the drift until you decide whether to accept it or revert it.

Answer

Run `terraform refresh` and then `terraform apply` to bring the instance back to the declared size.

Answer

Import the DB instance again with `terraform import` to update the state with the new instance class.

Answer

Add `lifecycle { ignore_changes = [instance_class] }` to the DB instance so the drift is ignored.

Question 10

You are authoring a Terraform module that creates an AWS IAM policy. The policy's Statement blocks must be generated from a list of objects, but each Statement must also conditionally include a Condition block only when the object's condition attribute is non-null. Which approach correctly generates the Statement blocks while conditionally including the nested Condition block?

Accepted Answer

Use a dynamic "statement" block with for_each over the list, and inside each statement block use a nested dynamic "condition" block with for_each set to a one-element list when the condition attribute is non-null, or an empty list otherwise.. The correct approach uses nested dynamic blocks with conditional for_each to generate optional nested blocks. This is the standard HCL pattern for conditionally including blocks based on input data. It ensures that the Condition block is only present when needed, avoiding invalid policy documents. The other options either misuse data sources, create empty blocks, or rely on provisioners, which are not appropriate for this declarative configuration.

Answer

Use a dynamic "statement" block with for_each over the list, and inside each statement block include a Condition block unconditionally, setting its values to null when not needed.

Answer

Use a for expression to build a list of statement objects, then pass that list directly to the statement argument of the aws_iam_policy_document data source.

Answer

Use a count meta-argument on a null_resource to loop over the list, and use provisioners to construct the policy JSON, then pass it to aws_iam_policy.

Question 11

A team wants to prevent any terraform apply from running in a production workspace unless a specific individual has reviewed and approved the plan. Which HCP Terraform capability should they enable?

Accepted Answer

Configure the workspace with manual apply and assign a team the run approval permission for that workspace.. Manual apply introduces a pause between plan and apply, and the run approval permission controls who is allowed to confirm. Assigning that permission to the intended reviewers means an apply cannot proceed in the production workspace until one of them approves the plan, giving the enforced human gate the team wants.

Answer

Add a Sentinel policy with the advisory enforcement level to the workspace.

Answer

Set the workspace's execution mode to Local so each engineer applies from their own machine after review.

Answer

Enable the organization setting that requires two-factor authentication for all members.

Question 12

Which TWO of the following functions are most useful for manipulating lists?

Accepted Answer

concat(). In this scenario, concat() (B) is correct because it joins two lists end-to-end into a single list, which is a core list-manipulation operation for combining sequences. flatten() (C) is also correct because it collapses nested lists into a single-level list, directly transforming list structure. The other options do not belong: keys() (A) is used to retrieve the key names of a map/object, not to manipulate lists; lookup() (D) retrieves a value associated with a key in a map or table, not a list operation; and merge() (E) typically combines maps/objects by key, not lists.

Answer

keys()

Answer

lookup()

Answer

merge()

Question 13

You are authoring a Terraform configuration that provisions an aws_autoscaling_group. The desired instance count is stored in a variable named instance_count, and you need to create exactly that many aws_instance resources. Which approach correctly creates the required number of instances while keeping the configuration valid?

Accepted Answer

Use the count meta-argument with count = var.instance_count on the aws_instance resource.. The count meta-argument is designed to create a specified number of identical resource instances. Because the desired quantity is a numeric variable, count = var.instance_count directly produces exactly that many aws_instance resources. The other options either misuse meta-arguments that expect different input types or confuse block-level repetition with resource-level repetition.

Answer

Use the for_each meta-argument with for_each = var.instance_count on the aws_instance resource.

Answer

Use the depends_on meta-argument with depends_on = [var.instance_count] on the aws_instance resource.

Answer

Use a dynamic block inside the aws_instance resource with for_each = range(var.instance_count).

Question 14

You are writing a Terraform configuration that uses a for expression to transform a map of objects into a new map. The original map has keys that are strings, and each object contains an attribute 'enabled' of type bool. You need to create a new map that includes only the entries where 'enabled' is true, and the new map's keys should be the original keys prefixed with 'prod-'. Which for expression achieves this?

Accepted Answer

{ for k, v in var.input_map : "prod-${k}" => v if v.enabled }. The correct for expression uses curly braces to produce a map, iterates over the input map, applies an if clause to filter only enabled entries, and transforms the key by prefixing 'prod-'. This meets all requirements: filtering, key transformation, and value preservation. The other options either use incorrect delimiters, omit the key transformation, or alter the value incorrectly.

Answer

[ for k, v in var.input_map : "prod-${k}" => v if v.enabled ]

Answer

{ for k, v in var.input_map : "prod-${k}" => v.enabled }

Answer

{ for k, v in var.input_map : k => v if v.enabled }

Question 15

A Terraform module is used by multiple teams. The module requires the AWS provider but should not enforce a specific provider configuration. The module's author wants to ensure that when the module is used, the caller must pass an AWS provider instance with a specific alias. What should the author include in the module's terraform block?

Accepted Answer

required_providers { aws = { source = "hashicorp/aws", configuration_aliases = [aws.west] } }.. To require a specific provider alias when a module is used, the module author declares configuration_aliases in the required_providers block. This tells Terraform that the module expects a provider instance with that alias. The caller must then pass it using the providers meta-argument in the module block, such as providers = { aws.west = aws.west }.

Answer

required_providers { aws = { source = "hashicorp/aws" } } and a provider "aws" block with alias = "west".

Answer

A terraform block with required_version = ">= 1.0" and a provider "aws" block with region = "us-west-2".

Answer

A variable named aws_alias with a default value of "west" and a provider "aws" block using alias = var.aws_alias.