AWS provider Practice Test 3 — 25 Questions

Question 1

You need to ensure that a resource is always recreated if an associated data source value changes. Which meta-argument supports this?

Accepted Answer

replace_triggered_by. The replace_triggered_by meta-argument forces Terraform to destroy and recreate the resource whenever any of the referenced attributes or resources change, including data source values. It is designed exactly for the scenario where a resource must be replaced based on an external or computed value rather than a direct attribute reference. When the referenced value changes between plans, Terraform marks the resource for replacement.

Answer

create_before_destroy

Answer

lifecycle_hooks

Answer

prevent_destroy

Question 2

Your organization has a Sentinel policy with enforcement level 'soft-mandatory' that checks for required tags on AWS resources. During a run, the policy fails because an EC2 instance is missing the 'Environment' tag. The workspace allows users with write access to override policies. What is the immediate outcome of the run?

Accepted Answer

The run is paused and a user with appropriate permissions can choose to override the policy and continue the apply.. When a soft-mandatory Sentinel policy fails, the run pauses and users with override permissions can choose to bypass the policy and continue. This allows for exceptions while still enforcing governance. Hard-mandatory policies cannot be overridden, and advisory policies do not block. The scenario specifies soft-mandatory, so the run is paused for possible override.

Answer

The policy failure is logged as an advisory and the run continues automatically without any intervention.

Answer

The run fails immediately and cannot be overridden, requiring the configuration to be fixed and a new run to be queued.

Answer

The run is canceled and the workspace is locked until the policy is updated to pass.

Question 3

You want to trigger a run only when a specific file within a module path changes. How do you configure this?

Accepted Answer

Use the 'VCS Triggers' setting in the workspace.. HCP Terraform (formerly Terraform Cloud) workspaces support VCS Triggers, which let you specify file or directory paths so that a run is only queued when changes are detected in those paths. This is the native mechanism for path-based run triggering tied to version control commits.

Answer

Use a 'trigger_path' variable in the Terraform code.

Answer

Modify the '.terraform-version' file.

Answer

Use a Sentinel policy to filter changes.

Question 4

You have two resources, A and B. You want B to be replaced whenever A is updated. How do you configure B?

Accepted Answer

In resource B, set lifecycle { replace_triggered_by = [resource_a] }. The replace_triggered_by meta-argument in resource B's lifecycle block specifies that B should be replaced when resource A changes. This directly ties B's replacement to A's updates, ensuring B is recreated whenever A is updated.

Answer

In resource B, set lifecycle { create_before_destroy = [resource_a] }

Answer

In resource A, set lifecycle { triggers = [resource_b] }

Answer

In resource B, set depends_on = [resource_a]

Question 5

Which of the following are true regarding the .terraform.lock.hcl file? (Select TWO)

Accepted Answer

It is automatically generated by terraform init.. Option A is correct because the .terraform.lock.hcl dependency lock file is automatically created and updated by the `terraform init` command when it installs providers, recording the exact provider versions and checksums selected. Option E is correct because HashiCorp recommends committing the .terraform.lock.hcl file to version control so that all team members and CI/CD pipelines use the same provider versions and verified checksums, ensuring reproducible runs. Option B is incorrect because Terraform state is stored in the state file (terraform.tfstate or a configured remote backend), not in the lock file. Option C is incorrect because the lock file is normally generated and updated automatically by Terraform commands such as `terraform init` and `terraform providers lock`, though it can be edited manually if needed. Option D is incorrect because the lock file stores provider version constraints and cryptographic hashes, not secret credentials, which should never be placed in it.

Answer

It is used to store the state file.

Answer

It can only be edited manually.

Answer

It stores secret credentials.

Question 6

You want to use a module that is hosted in a private GitHub repository. Which authentication method should Terraform use to access it?

Accepted Answer

Use the same credentials that 'git clone' would use for that repository.. Terraform's module source supports Git URLs and delegates authentication to the underlying Git client. For a private GitHub repository, Terraform uses the same credentials that 'git clone' would use, such as SSH keys, a credential helper, or a personal access token configured in '~/.netrc' or Git config.

Answer

The module must be public for Terraform to access it.

Answer

Terraform requires a special 'git_token' variable in the module block.

Answer

Embed your GitHub password in the source URL.

Question 7

Which function is most useful when you have a nested list of objects and want to create a single flat list to iterate over with for_each?

Accepted Answer

flatten(). The flatten() function takes a nested list (list of lists) and returns a single flat list containing all elements. When you have a nested list of objects and want to iterate with for_each, flatten() collapses the nesting so each object becomes a top-level element that for_each can key on. This is the idiomatic Terraform pattern for iterating over nested collections.

Answer

concat()

Answer

lookup()

Answer

merge()

Question 8

When a module is updated, how do you ensure that all environments using this module get the update?

Accepted Answer

Run 'terraform init -upgrade' to fetch the latest version allowed by the constraints.. Terraform modules sourced from a registry or VCS are cached locally after the first 'terraform init'. To pull a newer version that satisfies the version constraint in the module block, you must run 'terraform init -upgrade', which re-resolves the version and downloads the latest allowed release. Without this flag, Terraform reuses the cached module even if a newer version exists, so environments won't pick up the update.

Answer

The module updates automatically on every 'apply'.

Answer

Delete the state file and re-run apply.

Answer

Restart the Terraform CLI process.

Question 9

You are defining an input variable for a Terraform module that will accept a list of AWS subnet IDs. You want to ensure that the variable only accepts a list of strings and that it is required. Which variable declaration correctly achieves this?

Accepted Answer

variable "subnet_ids" { type = list(string) }. The correct variable declaration uses type = list(string) and does not provide a default, making it a required variable. This ensures that callers must supply a list of strings. The other options either make the variable optional, use a different collection type, or use a scalar type, all of which fail to meet the specified requirements.

Answer

variable "subnet_ids" { type = set(string) }

Answer

variable "subnet_ids" { type = list(string) default = [] }

Answer

variable "subnet_ids" { type = string }

Question 10

What is the recommended approach for managing a module that has grown too large?

Accepted Answer

Break the module into smaller, focused sub-modules.. Breaking a large module into smaller, focused sub-modules is the recommended approach because it improves reusability, testability, and blast-radius control. Each sub-module encapsulates a single logical concern (e.g., networking, compute, IAM), making plans faster and state operations safer. Terraform's module composition model is designed for this kind of decomposition, and refactoring can be done with 'moved' blocks to avoid destroying resources.

Answer

Use 'terraform import' to split the resources.

Answer

Combine all files into a single 'main.tf'.

Answer

Rename the module to something more generic.

Question 11

What is the impact of using 'sensitive = true' in a module output?

Accepted Answer

It prevents the value from being printed in the CLI output.. Marking an output as 'sensitive = true' tells Terraform to redact the value from CLI output, including plan and apply logs, so credentials are not displayed on screen. The value is still stored in state and can still be consumed by other modules or resources. It is a display-level protection, not an encryption or access-control mechanism.

Answer

It disables the ability to use that output in other modules.

Answer

It encrypts the data in the state file.

Answer

It automatically rotates the sensitive credentials.

Question 12

When should you use the 'for_each' meta-argument within a module?

Accepted Answer

To instantiate multiple copies of a module based on a map or set.. The for_each meta-argument is used to instantiate multiple copies of a resource or module based on a map or set of values, giving each instance a stable key. When applied to a module block, it creates one module instance per element in the map or set, and each instance can be referenced by its key. This is the correct use case for for_each within a module.

Answer

To iterate over a list of variables inside a resource block.

Answer

To replace the 'count' meta-argument when you only need one instance.

Answer

To speed up the execution of the provider.

Question 13

You want to optionally create an S3 bucket only if a specific variable 'create_bucket' is set to true. Which HCL feature is best for this?

Accepted Answer

conditional expression (ternary). The conditional expression (ternary) in HCL uses the syntax `condition ? true_val : false_val` and can be applied to a resource's `count` argument, e.g., `count = var.create_bucket ? 1 : 0`. This is the idiomatic way to conditionally create a resource based on a boolean variable. When `create_bucket` is true, one instance is created; when false, zero instances are created.

Answer

try()

Answer

dynamic block

Answer

for_each

Question 14

Which of these is a valid use case for a dynamic block?

Accepted Answer

Defining nested repeatable blocks. A dynamic block in Terraform generates nested repeatable blocks within a resource, data source, provider, or module — for example, multiple `ingress` blocks in an `aws_security_group` or multiple `tag` blocks. It iterates over a collection and produces one nested block per element, using an iterator to reference each item. This is its sole purpose.

Answer

Conditional module inclusion

Answer

Changing the provider configuration dynamically

Answer

Defining multiple separate resources

Question 15

Which THREE factors influence the choice of using an HCP Terraform Agent?

Accepted Answer

Need for private network connectivity. Option A is correct because HCP Terraform Agents are self-hosted workers that run inside your own network, allowing Terraform runs to reach private endpoints, private VCS systems, and private module registries that the hosted HCP Terraform workers cannot access. Option C is correct because agents execute the plan and apply operations on infrastructure you control, so sensitive state, variables, and provider credentials never leave your environment, satisfying data residency and compliance mandates. Option D is correct because accessing internal APIs (for example, on-premises or non-internet-facing services) requires an agent that has network line-of-sight to those APIs, which hosted runners lack. Option B is not a valid factor: provider download speed depends on registry/CDN performance and caching, not on whether an agent is used, and agents can even be slower if their egress is constrained. Option E is not a valid factor: agents do not eliminate the need for a VCS connection; HCP Terraform still requires a linked VCS repository (or CLI/API-driven uploads) to obtain configuration, and the agent only changes where runs execute.

Answer

To increase the speed of the provider download

Answer

To remove the need for a VCS

Question 16

You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?

Accepted Answer

for expression. A for expression is the correct tool to transform a list of objects into a map, using the syntax { for item in list : key => value }, which is exactly what for_each requires (a map or set of strings). Functions like merge() combine existing maps but cannot reshape a list of objects into a map keyed by an attribute. The for expression is the idiomatic Terraform construct for this transformation.

Answer

tolist()

Answer

flatten()

Answer

merge()

Question 17

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Accepted Answer

To access resources in a private network. HCP Terraform agents run Terraform operations inside your own infrastructure, so they can reach private endpoints such as internal VPCs, on-prem databases, and private APIs that the hosted public execution environment cannot route to. The public runners only have internet-facing egress, so any resource behind a firewall or private DNS is unreachable. Choosing an agent is therefore about network reachability, not speed or cost.

Answer

To increase execution speed

Answer

To bypass OPA policies

Answer

To avoid paying for HCP Terraform

Question 18

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Accepted Answer

The run pauses and waits for an override.. A soft-mandatory Sentinel policy, when it fails, causes the run to pause and wait for an override. This allows an authorized user to manually approve the run and continue, providing a balance between enforcement and flexibility. This is in contrast to hard-mandatory, which aborts the run immediately.

Answer

The run is immediately aborted.

Answer

The policy is skipped automatically.

Answer

The run completes but triggers an alert.

Question 19

Where are providers physically stored by default when running 'terraform init'?

Accepted Answer

.terraform/providers/. Terraform downloads providers into the .terraform/providers directory within your project working directory.

Answer

The root module directory

Answer

~/.terraformrc

Answer

/usr/local/bin/terraform

Question 20

Which block is used to configure provider-level settings like region or profile?

Accepted Answer

provider "aws" {}. The 'provider' block is used to configure the provider itself.

Answer

module {}

Answer

terraform {}

Answer

resource "aws_instance" {}