AWS provider Practice Test 5 — 25 Questions

Question 1

You are writing a module that accepts a list of objects. You want to validate that the 'port' attribute in each object is a number. How can you enforce this?

Accepted Answer

Use the type constraint. Using the 'type' constraint with an 'object' or 'list(object)' definition allows you to specify the expected type of every attribute.

Answer

Use a local variable

Answer

Use the any type

Question 2

You are attempting to use a conditional expression to set a variable, but the types returned by the true and false results differ. What happens?

Accepted Answer

A type mismatch error is returned. Terraform requires that both branches of a conditional expression return the same type, otherwise it will throw a type mismatch error during the planning phase.

Answer

The result is coerced to a string

Answer

It defaults to the true result type

Answer

Terraform automatically casts to the most flexible type

Question 3

Which meta-argument is best for deploying resources that are strictly dependent on the number of items in a configuration?

Accepted Answer

count. count is the simplest meta-argument for simple, index-based resource replication where individual resource identity is not critical.

Answer

for_each

Answer

provider

Answer

dynamic

Question 4

Which TWO of the following are valid ways to handle a resource that has become 'tainted'?

Accepted Answer

Run 'terraform apply' to recreate it.. You can either fix the taint by running a successful apply or manually untaint it using the CLI.

Answer

Run 'terraform refresh' to clear the taint.

Answer

Use 'terraform state rm' to fix the taint.

Answer

Use 'terraform plan -force-apply'.

Question 5

Which meta-argument is used to prevent a resource from being replaced when its configuration changes?

Accepted Answer

ignore_changes. Actually, there is no meta-argument that prevents replacement if the configuration changes; you would use 'ignore_changes' to prevent the *detection* of the change.

Answer

force_keep

Answer

keep_alive

Answer

prevent_replace

Question 6

Which of the following are true regarding the .terraform.lock.hcl file? (Select TWO)

Accepted Answer

It is automatically generated by terraform init.. It stores checksums for providers to ensure consistency and security across different environments.

Answer

It is used to store the state file.

Answer

It can only be edited manually.

Answer

It stores secret credentials.

Question 7

In the context of team permissions, what does the 'Admin' role on an organization allow?

Accepted Answer

Full control over all resources in the organization.. The organization Admin role provides full control over all projects, workspaces, and team memberships within the organization.

Answer

Permission to create new organizations.

Answer

Read access to logs only.

Answer

Access to view the billing credit card information.

Question 8

What is the effect of running 'terraform init -upgrade' on the '.terraform.lock.hcl' file?

Accepted Answer

It updates the file to reflect new provider versions.. The -upgrade flag causes Terraform to ignore existing lock file constraints and update to the latest compatible versions, updating the lock file accordingly.

Answer

It deletes the file.

Answer

It makes the file read-only.

Answer

It hides the file.

Question 9

When debugging provider issues, which commands are most useful? (Select THREE)

Accepted Answer

terraform providers. terraform providers, terraform init, and TF_LOG are the standard ways to troubleshoot provider issues.

Answer

terraform fmt

Answer

terraform taint

Question 10

Which of the following can be used to monitor costs in an HCP Terraform workspace?

Accepted Answer

Cost Estimation feature.. Cost Estimation is the specific feature for tracking the monetary impact of infrastructure changes.

Answer

Terraform State inspection.

Answer

Sentinel Policy sets.

Answer

VCS commit logs.

Question 11

In HCL, how do you handle a scenario where a variable might be null but you need to provide a non-null default value for a resource argument?

Accepted Answer

using coalesce(). The coalesce() function is ideal for providing a fallback value if the primary input is null.

Answer

using try()

Answer

using count

Answer

using for_each

Question 12

When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?

Accepted Answer

Resource naming collisions.. If the resource has a unique name or specific constraints (like an S3 bucket name), creating a new instance before destroying the old one will cause a naming collision.

Answer

Terraform will delete the state file.

Answer

Provider credentials will expire.

Answer

All other resources will be destroyed.

Question 13

You have two resources, A and B. You want B to be replaced whenever A is updated. How do you configure B?

Accepted Answer

In resource B, set lifecycle { replace_triggered_by = [resource_a] }. Using replace_triggered_by in B's lifecycle block, referencing resource A, forces the replacement of B when A changes.

Answer

In resource B, set lifecycle { create_before_destroy = [resource_a] }

Answer

In resource A, set lifecycle { triggers = [resource_b] }

Answer

In resource B, set depends_on = [resource_a]

Question 14

You have an AWS Lambda function that should be replaced whenever the source code S3 object changes. How do you trigger this replacement specifically based on the S3 object key change?

Accepted Answer

Use replace_triggered_by = [aws_s3_object.lambda_code.key]. The replace_triggered_by meta-argument allows forcing a resource to be replaced when another specified resource or attribute changes.

Answer

Use lifecycle { force_replace = true }

Answer

Use create_before_destroy.

Answer

Use ignore_changes = [source_code_hash]

Question 15

Which file is automatically generated to lock provider versions and their checksums?

Accepted Answer

.terraform.lock.hcl. .terraform.lock.hcl is the dependency lock file.

Answer

terraform.tfstate

Answer

terraform.tfvars

Answer

provider.tf

Question 16

Which TWO of the following are required to successfully integrate VCS with HCP Terraform?

Accepted Answer

An OAuth application created in the VCS provider.. A VCS connection requires an OAuth application authorized in your VCS provider and the connection setup in the HCP Terraform organization settings.

Answer

A direct peering link.

Answer

A VPN connection between AWS and HCP Terraform.

Answer

A static IP address for the organization.

Question 17

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'read' and 'write' permissions are distinct. Specifically, the 'Plan' permission allows triggering runs, while 'Manage' permissions are required for variables.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.

Question 18

Which function allows you to safely access a map value even if the key might not exist?

Accepted Answer

lookup(). The lookup() function allows you to provide a default value to return if the requested key is not found in the map.

Answer

try()

Answer

element()

Answer

coalesce()

Question 19

You have a list of strings that you want to convert into a set to use with for_each. Which function is preferred?

Accepted Answer

toset(). The toset() function is the correct way to convert a list of strings into a set, which is required for for_each to avoid index-based instability.

Answer

tomap()

Answer

distinct()

Answer

distinct()

Answer

tolist()

Question 20

Which THREE of the following are valid ways to pass data to a module dynamically?

Accepted Answer

Using variables. Passing variables, using for_each in the module block (if supported), or local variable composition are standard.

Answer

Directly editing the state

Answer

Using a dynamic block for module calling