AWS provider Practice Test 5 — 25 Questions

Question 1

A downstream workspace in HCP Terraform needs to automatically trigger a plan after a successful apply in an upstream workspace. How do you configure this?

Accepted Answer

Configuring Run Triggers in the downstream workspace. Run Triggers in HCP Terraform allow a downstream workspace to automatically queue a run when a specified upstream workspace completes a successful apply. This is the native mechanism for chaining workspaces, ensuring that dependent infrastructure is updated only after its dependencies are provisioned.

Answer

Enabling 'Auto-apply' in the upstream

Answer

Setting a 'TF_VAR' environment variable

Answer

Using a local variable

Question 2

Which of the following is a valid lifecycle meta-argument in Terraform?

Accepted Answer

create_before_destroy. create_before_destroy is a valid lifecycle meta-argument in Terraform, used to ensure that a new resource is created before the old one is destroyed during replacement. This is one of the four supported lifecycle meta-arguments: create_before_destroy, prevent_destroy, ignore_changes, and replace_triggered_by. The other options are not valid Terraform lifecycle meta-arguments.

Answer

delete_on_success

Answer

wait_for_completion

Answer

create_after_update

Question 3

You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?

Accepted Answer

input.resource_changes. OPA policies for Terraform evaluate a JSON document that Terraform sends to the policy engine, and the resource attributes live under input.resource_changes. Each entry in that array contains the address, type, and the planned change with after values, so a policy checks input.resource_changes[_].change.after.tags for the CostCenter tag. This is the correct path to access resource attributes.

Answer

terraform.tags

Answer

state.output

Answer

var.tags

Question 4

You are managing a production database instance. You want to ensure that if a developer accidentally removes the resource block from the Terraform configuration, Terraform will refuse to destroy the database. How do you implement this?

Accepted Answer

Set prevent_destroy = true in the lifecycle block.. The 'prevent_destroy' lifecycle meta-argument, when set to true, causes Terraform to reject any plan that would destroy the resource. This includes accidental removal of the resource block from configuration, which would otherwise trigger a destroy. It acts as a safety net for critical resources like production databases.

Answer

Set create_before_destroy = false.

Answer

Use the ignore_changes meta-argument for the lifecycle block.

Answer

Configure a provider-level block to disable deletions.

Question 5

When refactoring code, you rename a resource in your configuration. What happens if you run 'terraform plan' without updating the state?

Accepted Answer

Terraform will propose destroying the old resource and creating a new one.. Renaming a resource in configuration changes its address, so Terraform sees the old address as removed and the new address as added, resulting in a plan to destroy the old resource and create a new one. State still maps the old address to the real resource, so Terraform cannot associate the new name with the existing object. This is why terraform state mv is used to rename without destruction.

Answer

Terraform will do nothing.

Answer

Terraform will automatically rename it in the state.

Answer

Terraform will throw an error and stop.

Question 6

What is the primary difference between 'count' and 'for_each' regarding state management?

Accepted Answer

count uses index-based indexing, causing potential recreation when items are removed. The primary difference is that `count` uses index-based indexing, so removing an item from the middle of a list causes all subsequent resources to be re-indexed, potentially leading to unnecessary recreation. `for_each` uses key-based indexing, so removing an item only affects that specific resource, avoiding recreation of others.

Answer

for_each is only for maps

Answer

for_each does not support complex objects

Answer

count is faster than for_each

Question 7

You need to ensure that all workspaces use a specific set of tags. How can this be enforced?

Accepted Answer

Using an HCP Terraform Sentinel policy.. HCP Terraform Sentinel policies are policy-as-code rules that are evaluated during the plan phase of a run. Sentinel policies can inspect the planned state of resources and enforce constraints such as requiring specific tags on all taggable resources. Because Sentinel operates at the organization level and can be applied to all workspaces, it is the correct way to enforce a consistent tagging standard across every workspace.

Answer

Using a VCS branch protection rule.

Answer

Using a variable validation block.

Answer

Enabling 'Strict Mode' in the organization settings.

Question 8

When troubleshooting a failed plan in HCP Terraform, which THREE sources should you check?

Accepted Answer

Policy check results. In HCP Terraform, a failed plan is diagnosed primarily through the run's own telemetry: Policy check results (A) are correct because Sentinel or OPA policy evaluations run as part of the plan phase and can hard-fail or soft-fail a run, so their pass/fail output and violation messages must be reviewed. Terraform init output (B) is correct because provider and module initialization happens before the plan, and errors such as failed provider installation, registry/module download failures, or version constraint conflicts surface there and will abort the plan. Run logs (D) is correct because they contain the full terraform plan execution output, including the exact error messages, resource-level diagnostics, and exit codes needed to identify the failure cause. The provider source code (C) is not a troubleshooting source for a failed run—providers are consumed as compiled plugins, and you would inspect provider documentation or version changelogs instead. The organization billing page (E) is unrelated to plan execution failures, since billing issues affect account access or run availability, not the plan's diagnostic output.

Answer

The provider source code

Answer

Organization billing page

Question 9

You want to remove a resource from Terraform management without destroying the actual AWS resource. Which command accomplishes this?

Accepted Answer

terraform state rm. The `terraform state rm` command removes a resource from the Terraform state file without touching the actual infrastructure. This is the correct way to 'orphan' a resource so Terraform no longer manages it, while the real AWS resource continues to exist. It is commonly used when migrating resources to another state file or handing them off to manual management.

Answer

terraform destroy -target

Answer

terraform untrack

Answer

terraform apply -ignore

Question 10

Which THREE of these are benefits of using modules in Terraform?

Accepted Answer

Enforcing standardized configurations across teams.. Option C is correct because modules let platform teams publish a single, versioned implementation of a resource pattern (for example, a standard VPC or S3 bucket baseline) that every team consumes, so required tags, naming conventions, and security settings are applied consistently instead of being re-implemented per team. Option D is correct because a module is written once and then instantiated with different inputs for dev, staging, and production, eliminating the copy-paste of near-identical .tf resource blocks across environments. Option E is correct because a module exposes a small, typed interface of input variables and outputs while hiding the internal resource graph, so callers pass a few values and receive outputs without needing to understand every underlying resource and dependency. Option A is not a module benefit: Terraform still makes the same provider API calls, and module expansion happens at plan time, so execution speed is not inherently improved. Option B is not a module benefit: drift detection and remediation depend on state refresh and plan/apply behavior, and modules do not automatically prevent out-of-band changes to resources.

Answer

Increasing the execution speed of API calls.

Answer

Automatically preventing all resource drift.

Question 11

When using 'terraform state mv', what is the impact on the collaboration workflow?

Accepted Answer

It changes the state file, which affects subsequent runs. terraform state mv rewrites the state file, renaming or moving a resource from one address to another. Because state is the shared source of truth in a team workflow, this change affects every subsequent plan and apply run by any team member — they will see the resource under its new address. This is why state mv must be coordinated carefully in collaborative environments.

Answer

It is only possible in local state

Answer

It requires all team members to re-run init

Answer

It automatically updates the git repository

Question 12

You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?

Accepted Answer

Use the 'count' meta-argument with a ternary expression.. The `count` meta-argument accepts a numeric value, and combining it with a ternary expression (e.g., `count = var.enabled ? 1 : 0`) is the canonical Terraform pattern for conditionally creating a resource. When count evaluates to 0, no instances are created; when it evaluates to 1, a single instance is provisioned. This is the idiomatic way to implement conditional resource creation in Terraform.

Answer

Define multiple resources and use 'depends_on' to link them.

Answer

Use an 'if' block around the resource definition.

Answer

Use the 'module' meta-argument inside the resource.

Question 13

You are creating a custom provider. What is the standard language used to write Terraform providers?

Accepted Answer

Go. Terraform providers are written in Go, using the Terraform Plugin SDK (or the newer Plugin Framework). Go is the standard because Terraform itself is written in Go, and the plugin architecture relies on Go's support for building shared libraries and gRPC-based plugins. Providers implement CRUD operations for resources and data sources by conforming to the Terraform plugin protocol, which is defined and maintained in Go.

Answer

Python

Answer

Ruby

Answer

HCL

Question 14

You are managing state in a multi-region deployment. You need to ensure that simultaneous terraform apply operations do not corrupt the state file. Which backend configuration parameter primarily enables this functionality?

Accepted Answer

dynamodb_table. The dynamodb_table parameter in an S3 backend configuration enables state locking by having Terraform write a lock item to a DynamoDB table before any apply, preventing concurrent operations from corrupting the state file. Without it, two simultaneous applies could both read and write the same state object, causing lost updates or inconsistent resource tracking.

Answer

workspace_key_prefix

Answer

kms_key_id

Answer

acl

Question 15

When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?

Accepted Answer

each.value. When a resource uses for_each, Terraform iterates over a map or set and exposes the current element through the each object. each.value returns the value of the current map entry (or the set member itself when iterating a set), which is what you reference inside the resource block to configure per-instance attributes. This is the standard mechanism for deriving unique names, tags, or settings for each instance created by the loop.

Answer

each.key

Answer

item.value

Answer

count.index

Question 16

In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?

Accepted Answer

Read. The Read permission set in HCP Terraform grants team members the ability to view workspaces, runs, state, and variables, but it does not include the permission to apply runs or approve plans. Write permission is required to queue applies and approve plans, so Read is the correct choice to allow visibility without approval authority.

Answer

Write

Answer

Admin

Answer

Cost Estimation

Question 17

If you need to share output values between workspaces, what is the best practice in HCP Terraform?

Accepted Answer

Using the 'terraform_remote_state' data source. The `terraform_remote_state` data source is the canonical way to share outputs between workspaces (or separate state files) in HCP Terraform and Terraform OSS. It reads the remote state of another workspace and exposes its root-level outputs as attributes, so consumers always get the latest values without manual copying. This keeps state as the single source of truth and avoids drift.

Answer

Emailing the values

Answer

Hardcoding the IDs

Answer

Exporting to a flat file

Question 18

How can you debug the output of a complex 'for' expression in Terraform?

Accepted Answer

Use terraform console. terraform console launches an interactive REPL where you can evaluate HCL expressions — including complex for expressions, functions, and variable references — against the current configuration and state, printing the result immediately. This makes it the fastest way to inspect what a for expression actually produces without running a full plan. It's the standard debugging tool for expression logic in Terraform.

Answer

Check the state file

Answer

Use terraform plan

Answer

Use terraform debug

Question 19

Which function allows you to safely access a map value even if the key might not exist?

Accepted Answer

lookup(). The lookup() function is specifically designed to retrieve a value from a map by key while providing a fallback default if the key is absent, preventing errors. Its signature is lookup(map, key, default), so it safely handles missing keys without throwing an error. This makes it the idiomatic choice for optional map attributes in Terraform configurations.

Answer

try()

Answer

element()

Answer

coalesce()

Question 20

Why might someone use 'prevent_destroy = true' on a database resource while allowing it on smaller web server instances?

Accepted Answer

To protect critical data from accidental deletion.. prevent_destroy = true is used to protect resources whose loss would be catastrophic or unrecoverable, such as databases containing critical data. Web server instances are typically stateless and easily recreated, so the protection is unnecessary there — making option B correct.

Answer

To increase the speed of the destroy process.

Answer

To ensure create_before_destroy works.

Answer

To satisfy the AWS provider requirements.