AWS provider Practice Test 2 — 25 Questions

Question 1

What is the effect of running 'terraform init -upgrade' on the '.terraform.lock.hcl' file?

Accepted Answer

It updates the file to reflect new provider versions.. Running 'terraform init -upgrade' re-resolves provider version constraints against the registry and updates the .terraform.lock.hcl file to record the newly selected provider versions and their hashes. It is the supported way to move to newer provider releases without deleting the lock file manually.

Answer

It deletes the file.

Answer

It makes the file read-only.

Answer

It hides the file.

Question 2

Your organization uses HCP Terraform with the AWS provider. A Sentinel policy set is attached to the 'production' project with a soft-mandatory policy that checks for required tags on all AWS resources. During a run, the policy fails because a developer forgot to add a 'CostCenter' tag to an EC2 instance. What is the outcome of the run, and what can the developer do?

Accepted Answer

The run is paused, and a user with permission to override policies can choose to override the failure and continue the apply.. A soft-mandatory Sentinel policy failure pauses the run and requires an authorized user to override the failure before the apply can proceed. This provides a balance between enforcement and flexibility, allowing developers to address issues or override when justified. The developer can override if they have the necessary permissions, and the run will then continue.

Answer

The run continues automatically but logs a warning, and the apply proceeds without any intervention.

Answer

The run fails immediately and cannot be overridden; the developer must modify the configuration and push a new commit.

Answer

The run is paused, and an organization owner must approve an override before the apply can proceed.

Question 3

A team defines an aws_instance resource whose instance_type should normally come from a variable, but for one specific workspace named "dr" the value must be forced to t3.micro regardless of the variable. The team wants a single resource block that behaves correctly in every workspace without duplicating the resource. Which expression assigns instance_type appropriately?

Accepted Answer

instance_type = terraform.workspace == "dr" ? "t3.micro" : var.instance_type. The conditional operator compares the current workspace name to the target and chooses the hard-coded instance type only when they match, preserving the variable-driven value elsewhere. Both result branches are strings, so no type inconsistency arises and the single resource block adapts per workspace at plan time.

Answer

instance_type = terraform.workspace != "dr" ? "t3.micro" : var.instance_type

Answer

instance_type = terraform.workspace == "dr" ? var.instance_type : "t3.micro"

Answer

instance_type = var.instance_type == "dr" ? "t3.micro" : var.instance_type

Question 4

A team wants to ensure their Terraform configuration uses a specific major version of the AWS provider to prevent breaking changes. Which block should they use?

Accepted Answer

terraform { required_providers { aws = { source = "hashicorp/aws", version = "~> 4.0" } } }. The `terraform { required_providers { ... } }` block is the canonical location for declaring a provider's source and version constraint in modern Terraform (0.13+). The `version = "~> 4.0"` pessimistic constraint operator allows any 4.x release but blocks 5.0 and above, which is exactly what's needed to prevent breaking major-version upgrades. This block is also what `terraform init` reads when resolving and locking provider versions in `.terraform.lock.hcl`.

Answer

provider "aws" { version = "~> 4.0" }

Answer

terraform { version = "~> 4.0" }

Answer

provider_version = "4.0"

Question 5

Your team uses HCP Terraform with a VCS-driven workflow. A pull request modifies a module that three separate workspaces consume from a shared private registry. You want reviewers to see the effect of the module change in each consuming workspace before the PR merges, without any state being written. What should you configure?

Accepted Answer

Enable speculative plans on the workspaces and attach the VCS repository so pull requests queue a plan-only run for each workspace.. Speculative plans are the HCP Terraform mechanism that runs terraform plan on pull requests without applying or persisting state. Attaching the shared repository to each consuming workspace causes a plan-only run per workspace when the PR opens or updates, letting reviewers inspect the module's impact everywhere before merge. This satisfies the no-write requirement while keeping the VCS-driven workflow intact.

Answer

Create a run trigger on each consuming workspace so a plan is queued whenever the module repository receives a new commit to the default branch.

Answer

Configure a CLI-driven workflow on each workspace and have a developer run terraform plan locally against every workspace before approving the PR.

Answer

Add a policy set with a soft-mandatory sentinel policy that blocks applies until the module change is approved in the registry.

Question 6

Your team publishes an internal Terraform module to a private registry. A consumer wants to pin the module to a specific version to avoid unexpected changes. The module source is `app.terraform.io/example-org/vpc/aws`. Which source argument correctly pins the module to version 2.3.0?

Accepted Answer

source = "app.terraform.io/example-org/vpc/aws" version = "2.3.0". Registry modules require the version argument to be set separately from the source string. Pinning to an exact version such as "2.3.0" ensures that the same module code is used across all runs, which is critical for reproducibility and preventing unintended changes. The source format for a registry module is hostname/namespace/name/provider without any version embedded.

Answer

source = "git::https://app.terraform.io/example-org/vpc/aws.git?ref=v2.3.0"

Answer

source = "app.terraform.io/example-org/vpc/aws/2.3.0"

Answer

source = "app.terraform.io/example-org/vpc/aws?version=2.3.0"

Question 7

Your team uses HCP Terraform to manage AWS resources. You need to ensure that all workspaces in a project automatically inherit a set of AWS region and tagging variables. What is the most efficient way to achieve this?

Accepted Answer

Create a variable set and assign it to the project.. Variable sets are designed to share variables across multiple workspaces. Assigning a variable set to a project ensures all workspaces in that project inherit the variables, including future ones. This is more efficient than per-workspace definitions and is the recommended practice for organization-wide or project-wide variables.

Answer

Use a Terraform module to set the variables in each workspace.

Answer

Define the variables in each workspace individually.

Answer

Store the variables in a version control system and reference them via a remote backend.

Question 8

You are using a module that depends on a specific provider version. Where should this constraint be defined?

Accepted Answer

In the 'required_providers' block within the module's 'terraform' block.. Provider version constraints belong in the 'required_providers' block inside the module's 'terraform' block. This ensures the module declares its own compatibility requirements, which Terraform merges with the root module's constraints during initialization. It makes the module self-contained and portable.

Answer

In the 'provider' block of the calling root module.

Answer

In the root module only.

Answer

In a shell environment variable.

Question 9

A team uses the AWS provider to manage resources in three accounts: development, staging, and production. The root module must create an `aws_iam_role` in the production account while all other resources remain in the default development account. The production account's provider configuration is already declared with `alias = "prod"`. Which change to the production `aws_iam_role` resource is required?

Accepted Answer

Add `provider = aws.prod` to the resource block so it uses the aliased production provider configuration.. The provider meta-argument on a resource names the exact provider configuration to use, expressed as the provider type and alias, such as aws.prod. Because the production configuration is already declared with alias = "prod", adding provider = aws.prod to the aws_iam_role routes only that resource to the production account while everything else continues using the default development configuration.

Answer

Declare a second aws provider block without an alias and place it after the default provider block.

Answer

Set `region = "<prod-region>"` directly on the aws_iam_role resource block.

Answer

Move the aws_iam_role resource into a child module and pass the production provider via the module's providers argument.

Question 10

You have a root module that calls a child module to create an AWS VPC. The child module defines an output named `vpc_id`. After running `terraform apply`, where can you find the value of `vpc_id`?

Accepted Answer

In the root module's state file, under the child module's outputs, and accessible via `terraform output` if the root module also declares an output that references it.. Child module outputs are stored in the state file under the module's address, but they are only displayed by `terraform output` if the root module declares an output that references them. This explicit referencing is how Terraform maintains a clear contract between modules and the root configuration, and it allows consumers to control what is exposed.

Answer

Only in the child module's source directory as a generated file named `outputs.tfstate`.

Answer

Automatically in the root module's outputs, because Terraform promotes all child module outputs to the root level.

Answer

In the AWS provider's response to the `terraform apply` command, which lists all outputs from all modules.

Question 11

Which TWO of the following are benefits of using HCP Terraform for teams?

Accepted Answer

Centralized state management. Option A (Centralized state management) is correct because HCP Terraform stores Terraform state remotely in a shared, versioned workspace, enabling team members to collaborate on the same infrastructure without manually passing around terraform.tfstate files or configuring their own remote backends, and it provides state locking to prevent concurrent runs from corrupting state. Option B (Automated run triggers) is correct because HCP Terraform supports run triggers that automatically queue a dependent workspace's run when an upstream workspace completes successfully, as well as VCS-driven runs triggered by commits and API-driven runs, which streamlines multi-workspace and CI/CD workflows for teams. Option C (Local execution only) is incorrect because HCP Terraform's value comes from remote execution of runs in its managed environment, not from restricting execution to a single local machine. Option D (No need for version control) is incorrect because HCP Terraform integrates with VCS providers like GitHub, GitLab, and Bitbucket and relies on version-controlled configurations to drive runs. Option E (Lower costs) is incorrect because HCP Terraform is a paid platform with tiered pricing based on resources and seats, so it is not inherently a cost-reduction benefit.

Answer

Local execution only

Answer

No need for version control

Answer

Lower costs

Question 12

If a module has a required variable but you do not provide it in the calling configuration, what happens?

Accepted Answer

Terraform fails with an error during the planning phase.. If a module declares a variable without a default and the calling configuration does not supply a value, Terraform raises an error during the planning phase, stating that the required variable has not been set. Terraform does not invent a value or fall back to prior state. This fail-fast behavior ensures module contracts are honored.

Answer

Terraform uses 'null' for the value.

Answer

Terraform uses the variable value from the previous state.

Answer

Terraform automatically sets the value to an empty string.

Question 13

If a user omits the 'version' in 'required_providers', what version does Terraform use?

Accepted Answer

The latest available version.. When the 'version' argument is omitted inside a required_providers block, Terraform does not pin the provider to any specific release and instead resolves to the newest version available in the configured registry (public Terraform Registry or private registry). This is why HashiCorp strongly recommends always pinning versions in production to avoid unexpected breaking changes.

Answer

It will fail to initialize.

Answer

Version 1.0.0.

Answer

The oldest available version.

Question 14

How can you view the detailed breakdown of cost estimates for a specific Terraform plan?

Accepted Answer

Open the run page in the HCP Terraform UI.. The run details page in the HCP Terraform UI displays the cost estimation summary, which can be expanded for details.

Answer

Run the 'terraform show' command on the state file.

Answer

Check the cloud provider's billing dashboard.

Answer

Use the Sentinel CLI tool.

Question 15

A team is using Terraform to manage an aws_s3_bucket. They want Terraform to ignore any changes made to the bucket's tags outside of Terraform, but they still want Terraform to manage the bucket policy and versioning configuration. Which lifecycle configuration should they add?

Accepted Answer

Add lifecycle { ignore_changes = [tags] } to the aws_s3_bucket resource.. ignore_changes = [tags] excludes only the tags attribute from diff evaluation, so external tag edits are tolerated while policy and versioning remain under Terraform management. The other lifecycle meta-arguments address deletion protection, full drift suppression, or replacement ordering, none of which match the stated requirement.

Answer

Add lifecycle { ignore_changes = all } to the aws_s3_bucket resource.

Answer

Add lifecycle { create_before_destroy = true } to the aws_s3_bucket resource.

Answer

Add lifecycle { prevent_destroy = true } to the aws_s3_bucket resource.

Question 16

What are common reasons to use multiple provider instances? (Select TWO)

Accepted Answer

Using different credentials for different resources.. Option D is correct because multiple provider instances (created with the alias meta-argument) let you attach distinct credential sets to different resources, for example managing resources in separate AWS accounts or with different IAM roles within one configuration. Option E is correct because aliased provider instances are the standard way to target multiple AWS regions in a single configuration, such as provider "aws" { alias = "us_east" } and provider "aws" { alias = "eu_west" }, then referencing them per resource. Option A is not a reason for multiple provider instances, since Terraform CLI performance is governed by parallelism and graph execution, not by the number of provider configurations. Option B is incorrect because provider versions are pinned in the required_providers block, not by instantiating multiple provider instances. Option C is incorrect because a state file is always required for tracking real infrastructure; provider aliases do not eliminate it.

Answer

Increasing performance of the Terraform CLI.

Answer

Installing multiple versions of the same provider.

Answer

Bypassing the need for a state file.

Question 17

What command do you run to view the documentation for a module that has been published to a registry?

Accepted Answer

Check the registry website for the module page.. Terraform has no CLI subcommand for browsing registry module documentation; the canonical way to read a published module's inputs, outputs, and examples is the registry website page for that module. The registry renders the README and auto-generates the input/output tables from the module's variables.tf and outputs.tf. So checking the registry website is the correct answer.

Answer

'terraform view-module'

Answer

'terraform show'

Answer

'terraform doc <module>'

Question 18

A resource has an attribute 'tags' that is managed by an external script. You want Terraform to ignore any changes made to 'tags' after the initial creation. How should you configure the 'lifecycle' block?

Accepted Answer

ignore_changes = [tags]. The 'ignore_changes' argument within a lifecycle block tells Terraform to ignore changes to the specified attributes after resource creation. Setting 'ignore_changes = [tags]' ensures that any external modifications to the tags attribute are not detected as drift, preventing Terraform from reverting them. This is the correct way to handle attributes managed outside of Terraform.

Answer

lifecycle { tags = ignore }

Answer

prevent_destroy = [tags]

Answer

ignore_changes = [all]

Question 19

A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?

Accepted Answer

The policy attempts to access cost data before the estimation has completed.. Cost estimation in Terraform Cloud runs asynchronously after the plan. If a Sentinel policy references cost data (e.g., 'tfrun.cost_estimate') before the estimation has completed, the policy will fail because the data is not yet populated. This is the most likely cause when cost estimation is enabled but the policy still fails.

Answer

The cost estimation provider is not configured for AWS.

Answer

The workspace does not have Sentinel enabled.

Answer

The API key for AWS is invalid.

Question 20

You are writing a Terraform configuration that uses a dynamic block to generate multiple ingress rules within an aws_security_group resource. The dynamic block iterates over a variable named ingress_rules. Inside the content block, you need to reference the current rule. Which expression correctly accesses the current element?

Accepted Answer

rule.value. Inside a dynamic block, the iterator object is named after the block's label unless an iterator argument is explicitly provided. With a dynamic block labeled rule, the current element is accessed via rule.value. This allows the content block to reference attributes of the current item. The other options confuse the iterator with other meta-argument contexts or with the variable name.

Answer

ingress_rules.value

Answer

each.value

Answer

dynamic.value