AWS provider Practice Exam 4 — 20 Questions

Question 1

When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?

Accepted Answer

each.value. The 'each.value' object is the standard way to access the value in the collection currently being processed by for_each.

Answer

each.key

Answer

item.value

Answer

count.index

Question 2

Which TWO actions can be taken to resolve issues where a resource must be replaced, but 'prevent_destroy' is enabled?

Accepted Answer

Run 'terraform state rm' to remove the resource from state and re-import.. You must either remove the meta-argument from the code or use the state management to remove the resource constraint before re-applying.

Answer

Use 'terraform apply -auto-approve'.

Answer

Use 'terraform refresh' to update the constraint.

Answer

Set the prevent_destroy argument to false in the CLI.

Question 3

Which THREE of these are reasons to use the 'ignore_changes' lifecycle meta-argument?

Accepted Answer

To ignore tags applied by external cost-allocation tools.. These are common scenarios for ignoring drifts or auto-populated fields in Terraform.

Answer

To force the creation of a new resource.

Answer

To prevent Terraform from destroying a database.

Question 4

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. Workspaces in HCP Terraform provide a way to maintain separate state files and variable sets for the same configuration.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 5

When implementing OPA policies, what is the 'soft-mandatory' enforcement level?

Accepted Answer

It allows the run if overridden. Soft-mandatory policies can be overridden by users with sufficient permissions after a warning is issued.

Answer

It blocks the run completely

Answer

It is a deprecated feature

Answer

It only logs the event

Question 6

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. 'terraform init' detects the backend configuration and initiates the migration process.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 7

Which THREE actions occur when you execute a Terraform run in HCP Terraform?

Accepted Answer

Policy evaluation. The process involves plan generation, policy evaluation, and then awaiting approval before applying.

Answer

Immediate infrastructure destruction

Answer

Local environment cleanup

Question 8

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

Accepted Answer

Using -var flag in terraform apply. CLI-driven runs or API overrides can pass different variables to a specific run execution.

Answer

By editing the state file

Answer

By modifying the provider block

Answer

By adding a new workspace

Question 9

You have accidentally committed a secret to your VCS repository. After rotating the secret, what is the best practice to ensure it is not used in your workspace?

Accepted Answer

Use HCP Terraform sensitive variables. You must remove the secret from the VCS and update the workspace variable to use a secure, non-version-controlled source.

Answer

Delete the repository

Answer

Disable VCS integration

Answer

Run terraform destroy

Question 10

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The 'read' permission allows viewing runs and state without modification capabilities.

Answer

Write

Answer

Admin

Answer

Cost Estimation

Question 11

Where can you view the historical state versions in HCP Terraform?

Accepted Answer

The States tab. The 'States' tab within a specific workspace shows the full history of state versions.

Answer

The Variables tab

Answer

The Runs tab

Answer

The Settings tab

Question 12

Which THREE of the following represent potential pitfalls when using 'count'?

Accepted Answer

Inability to use string keys for identification. Issues include index shifts during item removal, inability to use map keys for identification, and rigid structure for varying configurations.

Answer

Performance issues with large collections

Answer

Type mismatch errors

Question 13

Which file stores the mapping between your Terraform configuration and the real-world infrastructure?

Accepted Answer

terraform.tfstate. The state file (terraform.tfstate) is the primary location for this mapping.

Answer

terraform.tfvars

Answer

provider.tf

Answer

backend.tf

Question 14

You are creating a security group in AWS and need to define multiple ingress rules based on a list of port numbers. Which meta-argument is most appropriate to use to create one resource instance per port?

Accepted Answer

for_each. The count meta-argument creates multiple instances based on an integer, while for_each is designed for sets or maps, making it the idiomatic choice for collections like lists of port numbers.

Answer

instance_count

Answer

count

Answer

dynamic

Question 15

How can you debug the output of a complex 'for' expression in Terraform?

Accepted Answer

Use terraform console. The 'terraform console' command is the standard way to interactively evaluate HCL expressions and debug complex transformations.

Answer

Check the state file

Answer

Use terraform plan

Answer

Use terraform debug

Question 16

You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?

Accepted Answer

for expression. The for expression is the primary tool for transforming collections, allowing you to iterate over a list and produce a map.

Answer

tolist()

Answer

flatten()

Answer

merge()

Question 17

Which TWO of the following accurately describe the behavior of 'terraform state rm'?

Accepted Answer

It stops Terraform from tracking the resource.. It removes the item from the state but leaves the actual infrastructure in place.

Answer

It requires the 'force' flag for all resources.

Answer

It is a permanent action that cannot be undone.

Answer

It destroys the infrastructure in the cloud.

Question 18

If a resource is not specified with a provider meta-argument, which provider instance does it use?

Accepted Answer

The provider configuration without an alias.. It defaults to the instance of that provider without an alias.

Answer

The first one defined.

Answer

The one with the latest version.

Answer

It causes an error.

Question 19

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Accepted Answer

To access resources in a private network. Agents allow Terraform to run in a private network, accessing resources that are not reachable from the public internet.

Answer

To increase execution speed

Answer

To bypass OPA policies

Answer

To avoid paying for HCP Terraform

Question 20

You have a team-based collaboration project. Where should you store sensitive credentials like AWS secret keys so they are not hardcoded in your Terraform files?

Accepted Answer

In environment variables marked as 'sensitive'. HCP Terraform variables marked as 'sensitive' are stored securely and never displayed in the UI.

Answer

In a .tfvars file

Answer

In a version-controlled .env file

Answer

In the state file