AWS provider Practice Test 4 — 25 Questions

Question 1

How can you protect a module's inputs from receiving incorrect types of data?

Accepted Answer

Use a 'validation' block with a condition inside the variable declaration.. Terraform's variable validation block, introduced in Terraform 0.13, allows you to define a condition expression that must evaluate to true for the variable value to be accepted. When placed inside a variable declaration, it can check the type, format, or range of the input and produce a custom error message if the condition fails. This is the native, declarative way to enforce input constraints at plan time, preventing invalid data from propagating into the module.

Answer

Use the 'provider' block to enforce input types.

Answer

Write a custom bash script to check the inputs.

Answer

Terraform automatically validates all inputs as strings.

Question 2

When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?

Accepted Answer

Resource naming collisions.. With create_before_destroy, Terraform creates the new resource before destroying the old one. If the resource has a unique name or identifier (e.g., an AWS resource with a fixed name), the new resource may conflict with the existing one, causing the plan to fail due to naming collisions.

Answer

Terraform will delete the state file.

Answer

Provider credentials will expire.

Answer

All other resources will be destroyed.

Question 3

Which THREE of the following are valid ways to transform data for Terraform configuration?

Accepted Answer

flatten(). Option A, flatten(), is correct because it is a built-in Terraform function that takes a list of lists and transforms it into a single flat list, which is a valid data transformation for configuration. Option B, merge(), is correct because it is a built-in Terraform function that combines multiple maps or objects into one map, a common way to transform and consolidate data in Terraform. Option E, for expressions, is correct because Terraform's for expressions iterate over lists, sets, maps, or objects to produce a new transformed list or map, making them a core transformation mechanism. Option C, split_map(), is not a valid Terraform function, so it cannot transform data. Option D, loop(), is not a Terraform construct; iteration is handled by for expressions, count, or for_each, not a loop() function.

Answer

split_map()

Answer

loop()

Question 4

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

Accepted Answer

In a Variable Set.. In HCP Terraform (formerly Terraform Cloud), a Variable Set is a named collection of variables that can be applied to multiple workspaces across an organization. Variable Sets are designed specifically to share variables globally or across selected workspaces, making them the correct mechanism for organization-wide variable definitions. They can contain both Terraform variables and environment variables, and can be scoped to all workspaces or a subset.

Answer

In the Private Module Registry.

Answer

In the individual workspace configuration.

Answer

In the organization settings directly.

Question 5

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'Read' and 'Queue Plan' permissions allow a user to view workspaces and trigger runs, but not modify variables. This follows the principle of least privilege for the required actions.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.

Question 6

You need to output a complex object from a child module to be used by the root module. What is the best practice for defining the output?

Accepted Answer

Define an output block in the child module and reference it in the root module using the module prefix.. Using explicit output blocks in the child module makes the data available for access via 'module..'.

Answer

Assign the output to a global variable in the root module.

Answer

Use a data source to read the child module's internal state.

Answer

Write the output to a local file inside the module and read it in the root.

Question 7

You are attempting to use a conditional expression to set a variable, but the types returned by the true and false results differ. What happens?

Accepted Answer

A type mismatch error is returned. In Terraform, a conditional expression requires both the true and false results to be of the same type. If they differ, Terraform returns a type mismatch error during evaluation. This is because Terraform's type system is strict and does not perform implicit type coercion in conditional expressions.

Answer

The result is coerced to a string

Answer

It defaults to the true result type

Answer

Terraform automatically casts to the most flexible type

Question 8

In a workspace, you define a variable named 'region'. How can you override this value for a specific run without changing the workspace configuration?

Accepted Answer

Using -var flag in terraform apply. The '-var' flag allows you to override a variable's value for a specific Terraform run without modifying the workspace configuration. For example, 'terraform apply -var='region=us-west-2'' sets the value for that run only. Other options do not provide a way to override variables per run.

Answer

By editing the state file

Answer

By modifying the provider block

Answer

By adding a new workspace

Question 9

When refactoring a large infrastructure configuration, you move a resource into a child module. How do you handle the existing state to prevent Terraform from destroying and recreating the resource?

Accepted Answer

Use the 'terraform state mv' command to move the resource address.. When a resource is moved into a child module, its address in state changes from something like 'aws_instance.web' to 'module.child.aws_instance.web'. Terraform sees these as different resources and would plan a destroy/create. The 'terraform state mv' command updates the state address in place, preserving the existing resource without any API calls.

Answer

Run 'terraform refresh' to automatically detect the move.

Answer

Rename the resource in the configuration to match the old state.

Answer

Delete the state file and run 'terraform apply'.

Question 10

Which TWO of the following are true regarding OPA/Sentinel policies?

Accepted Answer

They can be set to advisory mode. Option C is correct because both OPA and Sentinel policies support an advisory (soft-mandatory) enforcement mode, which reports policy violations without blocking the run, unlike hard-mandatory mode that fails the run. Option D is correct because policies can be scoped to specific workspaces, allowing different policy sets to apply only to designated workspaces rather than globally. Option A is incorrect because OPA/Sentinel policies are evaluated during the plan phase (pre-apply), not after apply. Option B is incorrect because these policies are cloud-agnostic and work with any provider, not just AWS. Option E is incorrect because policies govern Terraform configuration compliance and do not replace IAM, which controls authentication and authorization to cloud resources.

Answer

They run after the apply phase

Answer

They can only be used with AWS

Answer

They replace the need for IAM

Question 11

Which THREE of the following are components of the 'source' string when using the Terraform Registry?

Accepted Answer

Provider.. The Terraform Registry module source string follows the format //, so option B (Provider) is correct because the provider segment (e.g., aws, azurerm, google) identifies which provider the module targets. Option D (Module name) is correct because it is the middle segment that names the specific module being referenced. Option E (Namespace) is correct because it is the first segment, identifying the organization or user that publishes the module. Option A (Git branch name) is not part of the Registry source string; branch/ref syntax (e.g., ?ref=) applies to generic Git sources, not the Registry's three-part address. Option C (Operating system) is irrelevant, as the Registry source string does not encode any OS information.

Answer

Git branch name.

Answer

Operating system.

Question 12

Which THREE items should be included in a well-documented Terraform module?

Accepted Answer

Clear documentation for each output.. Option B is correct because documenting each output (its name, type, and meaning) lets consumers know what values the module returns and how to reference them, which is essential for reusable module interfaces. Option C is correct because every input variable should have a description so users understand its purpose, expected type, default, and whether it is required, making the module self-explanatory. Option E is correct because providing a usage example showing how to call the module with realistic inputs demonstrates correct invocation and accelerates adoption. Option A is not appropriate because listing all possible provider configurations is impractical and unnecessary; provider requirements should instead be declared via required_providers and documented as constraints. Option D is wrong because raw state files contain sensitive data and environment-specific resource mappings, should be stored remotely with locking, and are never part of module documentation.

Answer

A list of all possible provider configurations.

Answer

The raw state file of the module's resources.

Question 13

Which THREE of the following are consequences of drifting from the Terraform state?

Accepted Answer

The plan may show changes even if the config hasn't changed.. Option A is correct because Terraform compares the configuration against the recorded state to build the plan; if real infrastructure has drifted from that state, the refresh will detect differences and the plan can show changes even though the .tf configuration itself was never modified. Option B is correct because if someone manually deletes a resource that still exists in the state file, the next refresh/plan will fail to find it and Terraform reports an error such as 'Resource Not Found' (or removes it from state depending on version), breaking the expected mapping between state and reality. Option D is correct because when drift is detected, Terraform's plan will propose actions to bring the real infrastructure back in line with the configuration, so the next apply may revert the out-of-band manual changes. Option C is not correct because lifecycle meta-arguments (create_before_destroy, prevent_destroy, ignore_changes, replace_triggered_by) are configuration-level features and are not disabled by state drift. Option E is not correct because Terraform never rewrites your configuration files automatically; drift only affects the state and the plan, not the .tf source code.

Answer

It disables the use of lifecycle meta-arguments.

Answer

It automatically updates the configuration file.

Question 14

Which THREE of the following are true about 'lifecycle' blocks?

Accepted Answer

They are defined inside the resource configuration block.. Option A is correct because lifecycle blocks are nested meta-arguments declared inside a resource block (e.g., resource "aws_instance" "example" { lifecycle { ... } }), not at the top level or in provider blocks. Option B is correct because a single lifecycle block can contain multiple arguments simultaneously, such as create_before_destroy, prevent_destroy, ignore_changes, and replace_triggered_by. Option E is correct because lifecycle settings are processed during the plan phase, where Terraform determines actions like replacement (create_before_destroy) and diffs to ignore (ignore_changes) before producing the execution plan. Option C is not correct because provider versions are constrained via the required_providers block and version arguments, not lifecycle. Option D is not correct because lifecycle is a resource-level meta-argument and is not inherited from provider blocks.

Answer

They allow changing the provider version dynamically.

Answer

They are inherited from the provider block.

Question 15

Which argument in a module block allows you to provide a custom name to the module instance?

Accepted Answer

The label immediately following the 'module' keyword.. In Terraform, a module block is declared as `module "<LABEL>" { ... }`, where the label immediately following the `module` keyword is the local name (instance name) used to reference the module within the configuration. This label is how you distinguish multiple instances of the same module source and how you reference module outputs (e.g., `module.my_module.output_name`).

Answer

'name'

Answer

'instance_name'

Answer

'alias'

Question 16

What is the correct way to specify a version constraint for a provider that must be at least 3.0 but less than 4.0?

Accepted Answer

version = "~> 3.0". The pessimistic constraint operator ~> 3.0 means '>= 3.0 and < 4.0', allowing any 3.x release while preventing upgrades to 4.0. This matches the requirement of at least 3.0 but less than 4.0 exactly. It is the idiomatic Terraform way to pin to a major version while accepting minor and patch updates.

Answer

version = ">= 3.0"

Answer

version = "3.0"

Answer

version = "> 3.0, < 4.0"

Question 17

You have a nested module structure. How can you pass a variable from the root module through an intermediate module to a leaf module?

Accepted Answer

You must define the variable in the intermediate module and pass it to the leaf module.. In Terraform, variables are not automatically inherited by child modules. To pass a variable from the root module to a leaf module through an intermediate module, you must explicitly define the variable in the intermediate module and pass it to the leaf module. This means declaring the variable in the intermediate module's variables.tf and then using it in the module block that calls the leaf module.

Answer

Define the variable only in the leaf module and refer to root by index.

Answer

You can use the 'global_vars' block in the root.

Answer

The intermediate module automatically inherits all root variables.

Question 18

What happens if two team members try to apply changes to the same workspace in HCP Terraform simultaneously?

Accepted Answer

The second run is queued. HCP Terraform (formerly Terraform Cloud) enforces a run queue per workspace. When two team members trigger runs simultaneously, the first run acquires the workspace lock and executes; the second run is placed in a queue and will start only after the first completes (or is canceled). This prevents concurrent state modifications and state corruption.

Answer

The state file will be corrupted

Answer

The latest one wins

Answer

Both runs will fail

Question 19

What is the primary risk of relying solely on 'create_before_destroy' without considering dependency chains?

Accepted Answer

It can lead to resource contention or naming conflicts.. 'create_before_destroy' makes Terraform create the replacement resource before destroying the old one. When resources have unique names, fixed IPs, or other globally unique identifiers, the new resource cannot be created while the old one still exists, causing naming conflicts or resource contention. This is the primary risk when dependency chains are not carefully considered.

Answer

It causes infinite loops in Terraform.

Answer

It increases the cost of the plan.

Answer

It creates a security risk.

Question 20

Which meta-argument is used to explicitly associate a resource with a non-default provider instance?

Accepted Answer

provider. The `provider` meta-argument is used within a resource block to explicitly specify which provider configuration to use, especially when multiple provider configurations exist (e.g., different regions or accounts). For example, `provider = aws.west` tells Terraform to use the `aws` provider instance with the alias `west`. This overrides the default provider configuration for that resource.

Answer

configuration

Answer

alias

Answer

instance