AWS provider Practice Test 3 — 25 Questions

Question 1

You have a workspace configured for 'CLI-driven' workflow. What does this mean for how you apply changes?

Accepted Answer

The user triggers operations via the CLI. CLI-driven workflows require the user to trigger the plan/apply locally, while the state is managed remotely.

Answer

Operations are always automatic

Answer

It disables remote state

Answer

The plan happens locally, apply remotely

Question 2

Which of these is a valid use case for a dynamic block?

Accepted Answer

Defining nested repeatable blocks. Dynamic blocks are specifically intended to generate nested, repeatable blocks within a resource, such as 'ingress' rules in a security group or 'tags' in an instance.

Answer

Conditional module inclusion

Answer

Changing the provider configuration dynamically

Answer

Defining multiple separate resources

Question 3

In a dynamic block, you need to access the current iteration item. What is the default label assigned to the iterator object?

Accepted Answer

The name of the block. By default, the iterator name is the same as the name of the dynamic block, unless an 'iterator' argument is explicitly provided.

Answer

count.index

Answer

each.value

Answer

item

Question 4

You are using a dynamic block to define multiple 'tag' blocks inside an AWS resource. The dynamic block is failing because it expects a set of objects but receives a flat list. Which function best prepares your data?

Accepted Answer

toset(). The toset() function converts a list of strings or objects into a set, which is required by for_each to avoid index-based dependencies.

Answer

keys()

Answer

distinct()

Answer

compact()

Question 5

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

Accepted Answer

Configuring Run Triggers in the downstream workspace. Run triggers are configured in the downstream workspace settings to listen for successful outputs from an upstream workspace.

Answer

Enabling 'Auto-apply' in the upstream

Answer

Setting a 'TF_VAR' environment variable

Answer

Using a local variable

Question 6

You want to automate the approval process for non-production environments in HCP Terraform. Which setting enables this?

Accepted Answer

Enable Auto-apply. Auto-apply in workspace settings allows runs to proceed to completion without manual intervention.

Answer

Configure Run Triggers

Answer

Set Sentinel policy to advisory

Answer

Use API-driven workflows

Question 7

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Accepted Answer

It provides state locking and run history. HCP Terraform provides centralized state management, locking, and a history of runs, which are critical for teams.

Answer

It converts HCL to JSON

Answer

It eliminates the need for AWS providers

Answer

It is always free

Question 8

Which THREE factors influence the choice of using an HCP Terraform Agent?

Accepted Answer

Need for private network connectivity. Agents are used for private network connectivity, compliance requirements, and accessing resources that don't allow public internet access.

Answer

To increase the speed of the provider download

Answer

To remove the need for a VCS

Question 9

Which TWO types of variables can be set in HCP Terraform?

Accepted Answer

Environment variables. HCP Terraform supports both Terraform variables (HCL) and environment variables (for provider configuration).

Answer

Policy-level variables

Answer

State-level variables

Answer

Hardcoded module variables

Question 10

Which TWO factors must be considered when using 'replace_triggered_by' with multiple resources?

Accepted Answer

The trigger cannot cause a circular dependency loop.. You must ensure the resources exist and that you are not creating circular replacement dependencies.

Answer

The trigger only works on the 'tags' attribute.

Answer

The trigger requires 'create_before_destroy' to be false.

Answer

The trigger only works with AWS resources.

Question 11

When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?

Accepted Answer

each.value. The 'each.value' object is the standard way to access the value in the collection currently being processed by for_each.

Answer

each.key

Answer

item.value

Answer

count.index

Question 12

Which TWO actions can be taken to resolve issues where a resource must be replaced, but 'prevent_destroy' is enabled?

Accepted Answer

Run 'terraform state rm' to remove the resource from state and re-import.. You must either remove the meta-argument from the code or use the state management to remove the resource constraint before re-applying.

Answer

Use 'terraform apply -auto-approve'.

Answer

Use 'terraform refresh' to update the constraint.

Answer

Set the prevent_destroy argument to false in the CLI.

Question 13

Which THREE of these are reasons to use the 'ignore_changes' lifecycle meta-argument?

Accepted Answer

To ignore tags applied by external cost-allocation tools.. These are common scenarios for ignoring drifts or auto-populated fields in Terraform.

Answer

To force the creation of a new resource.

Answer

To prevent Terraform from destroying a database.

Question 14

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. Workspaces in HCP Terraform provide a way to maintain separate state files and variable sets for the same configuration.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 15

When implementing OPA policies, what is the 'soft-mandatory' enforcement level?

Accepted Answer

It allows the run if overridden. Soft-mandatory policies can be overridden by users with sufficient permissions after a warning is issued.

Answer

It blocks the run completely

Answer

It is a deprecated feature

Answer

It only logs the event

Question 16

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. 'terraform init' detects the backend configuration and initiates the migration process.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate

Question 17

Which THREE actions occur when you execute a Terraform run in HCP Terraform?

Accepted Answer

Policy evaluation. The process involves plan generation, policy evaluation, and then awaiting approval before applying.

Answer

Immediate infrastructure destruction

Answer

Local environment cleanup

Question 18

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

Accepted Answer

Using -var flag in terraform apply. CLI-driven runs or API overrides can pass different variables to a specific run execution.

Answer

By editing the state file

Answer

By modifying the provider block

Answer

By adding a new workspace

Question 19

You have accidentally committed a secret to your VCS repository. After rotating the secret, what is the best practice to ensure it is not used in your workspace?

Accepted Answer

Use HCP Terraform sensitive variables. You must remove the secret from the VCS and update the workspace variable to use a secure, non-version-controlled source.

Answer

Delete the repository

Answer

Disable VCS integration

Answer

Run terraform destroy

Question 20

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The 'read' permission allows viewing runs and state without modification capabilities.

Answer

Write

Answer

Admin

Answer

Cost Estimation