AWS provider Practice Test 3 — 30 Questions

Question 1

What is the impact of using 'sensitive = true' in a module output?

Accepted Answer

It prevents the value from being printed in the CLI output.. Marking an output as 'sensitive = true' tells Terraform to redact the value from CLI output, including plan and apply logs, so credentials are not displayed on screen. The value is still stored in state and can still be consumed by other modules or resources. It is a display-level protection, not an encryption or access-control mechanism.

Answer

It disables the ability to use that output in other modules.

Answer

It encrypts the data in the state file.

Answer

It automatically rotates the sensitive credentials.

Question 2

When should you use the 'for_each' meta-argument within a module?

Accepted Answer

To instantiate multiple copies of a module based on a map or set.. The for_each meta-argument is used to instantiate multiple copies of a resource or module based on a map or set of values, giving each instance a stable key. When applied to a module block, it creates one module instance per element in the map or set, and each instance can be referenced by its key. This is the correct use case for for_each within a module.

Answer

To iterate over a list of variables inside a resource block.

Answer

To replace the 'count' meta-argument when you only need one instance.

Answer

To speed up the execution of the provider.

Question 3

You want to optionally create an S3 bucket only if a specific variable 'create_bucket' is set to true. Which HCL feature is best for this?

Accepted Answer

conditional expression (ternary). The conditional expression (ternary) in HCL uses the syntax `condition ? true_val : false_val` and can be applied to a resource's `count` argument, e.g., `count = var.create_bucket ? 1 : 0`. This is the idiomatic way to conditionally create a resource based on a boolean variable. When `create_bucket` is true, one instance is created; when false, zero instances are created.

Answer

try()

Answer

dynamic block

Answer

for_each

Question 4

Which of these is a valid use case for a dynamic block?

Accepted Answer

Defining nested repeatable blocks. A dynamic block in Terraform generates nested repeatable blocks within a resource, data source, provider, or module — for example, multiple `ingress` blocks in an `aws_security_group` or multiple `tag` blocks. It iterates over a collection and produces one nested block per element, using an iterator to reference each item. This is its sole purpose.

Answer

Conditional module inclusion

Answer

Changing the provider configuration dynamically

Answer

Defining multiple separate resources

Question 5

Which THREE factors influence the choice of using an HCP Terraform Agent?

Accepted Answer

Need for private network connectivity. Option A is correct because HCP Terraform Agents are self-hosted workers that run inside your own network, allowing Terraform runs to reach private endpoints, private VCS systems, and private module registries that the hosted HCP Terraform workers cannot access. Option C is correct because agents execute the plan and apply operations on infrastructure you control, so sensitive state, variables, and provider credentials never leave your environment, satisfying data residency and compliance mandates. Option D is correct because accessing internal APIs (for example, on-premises or non-internet-facing services) requires an agent that has network line-of-sight to those APIs, which hosted runners lack. Option B is not a valid factor: provider download speed depends on registry/CDN performance and caching, not on whether an agent is used, and agents can even be slower if their egress is constrained. Option E is not a valid factor: agents do not eliminate the need for a VCS connection; HCP Terraform still requires a linked VCS repository (or CLI/API-driven uploads) to obtain configuration, and the agent only changes where runs execute.

Answer

To increase the speed of the provider download

Answer

To remove the need for a VCS

Question 6

You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?

Accepted Answer

for expression. A for expression is the correct tool to transform a list of objects into a map, using the syntax { for item in list : key => value }, which is exactly what for_each requires (a map or set of strings). Functions like merge() combine existing maps but cannot reshape a list of objects into a map keyed by an attribute. The for expression is the idiomatic Terraform construct for this transformation.

Answer

tolist()

Answer

flatten()

Answer

merge()

Question 7

You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?

Accepted Answer

To access resources in a private network. HCP Terraform agents run Terraform operations inside your own infrastructure, so they can reach private endpoints such as internal VPCs, on-prem databases, and private APIs that the hosted public execution environment cannot route to. The public runners only have internet-facing egress, so any resource behind a firewall or private DNS is unreachable. Choosing an agent is therefore about network reachability, not speed or cost.

Answer

To increase execution speed

Answer

To bypass OPA policies

Answer

To avoid paying for HCP Terraform

Question 8

What is the result of a 'soft-mandatory' Sentinel policy failing during a run?

Accepted Answer

The run pauses and waits for an override.. A soft-mandatory Sentinel policy, when it fails, causes the run to pause and wait for an override. This allows an authorized user to manually approve the run and continue, providing a balance between enforcement and flexibility. This is in contrast to hard-mandatory, which aborts the run immediately.

Answer

The run is immediately aborted.

Answer

The policy is skipped automatically.

Answer

The run completes but triggers an alert.

Question 9

Where are providers physically stored by default when running 'terraform init'?

Accepted Answer

.terraform/providers/. Terraform downloads providers into the .terraform/providers directory within your project working directory.

Answer

The root module directory

Answer

~/.terraformrc

Answer

/usr/local/bin/terraform

Question 10

Which block is used to configure provider-level settings like region or profile?

Accepted Answer

provider "aws" {}. The 'provider' block is used to configure the provider itself.

Answer

module {}

Answer

terraform {}

Answer

resource "aws_instance" {}

Question 11

What is the purpose of the 'terraform init' command when working with modules?

Accepted Answer

It downloads and installs the modules specified in the configuration.. 'terraform init' downloads and installs the modules specified in the configuration into the '.terraform/modules' directory.

Answer

It compiles the modules into machine code.

Answer

It pushes your local modules to the registry.

Answer

It updates the state file to match the modules.

Question 12

You are developing a Terraform module that creates an AWS EC2 instance. You want to expose the instance's private IP address to the caller. How should you define this in the module?

Accepted Answer

Add an output block in the module that references the instance's private_ip attribute.. Outputs are the mechanism for a module to return values to its caller. By defining an output that references the EC2 instance's private_ip attribute, the parent module can access it using module... This is the intended and most efficient way to expose resource attributes from a child module. Other options either do not work or are overly complicated.

Answer

Define a local value in the module and reference it in the root module.

Answer

Use a variable in the module to pass the private IP address to the caller.

Answer

Use a data source in the root module to look up the EC2 instance by its tags.

Question 13

When using 'for_each' on a list of strings, what must you do to ensure the configuration is stable?

Accepted Answer

Convert the list to a set. for_each requires a map or set of strings, not a list, because list indices are positional and unstable — inserting or removing an element shifts every subsequent index, causing Terraform to destroy and recreate resources. Converting the list to a set (e.g., toset(var.list)) gives each element a stable key based on its value, so resource addresses remain consistent across changes.

Answer

Use count instead

Answer

Use the index

Answer

Nothing, it's always stable

Question 14

When using multiple provider instances with different regions, what must be defined in the provider configuration?

Accepted Answer

A unique alias identifier.. When you declare multiple instances of the same provider (e.g., two `aws` providers for different regions), each non-default instance must have a unique `alias` argument. Resources then select the desired instance using the `provider = aws.<alias>` meta-argument. Without an alias, Terraform cannot distinguish the instances and errors on duplicate provider configuration.

Answer

A unique project ID.

Answer

A credentials object.

Answer

A version constraint in each block.

Question 15

Your team requires a custom module to be versioned strictly to prevent breaking changes during deployments. What is the recommended way to reference a module from a private Git repository?

Accepted Answer

Use the 'ref' parameter in the source URL string.. For modules sourced from a private Git repository, Terraform does not support a separate 'version' argument; instead, you pin to a specific commit, tag, or branch using the 'ref' query parameter appended to the source URL (e.g., 'git::https://example.com/module.git?ref=v1.2.0'). This locks the module to an immutable Git reference, preventing unexpected breaking changes when the repository's default branch moves forward. The 'ref' parameter is the only supported mechanism for version pinning with Git-based module sources.

Answer

Set the 'version' block inside the module definition.

Answer

Copy the module code locally every time a new version is released.

Answer

Use the 'module_version' argument in the module block.

Question 16

How can you protect a module's inputs from receiving incorrect types of data?

Accepted Answer

Use a 'validation' block with a condition inside the variable declaration.. Terraform's variable validation block, introduced in Terraform 0.13, allows you to define a condition expression that must evaluate to true for the variable value to be accepted. When placed inside a variable declaration, it can check the type, format, or range of the input and produce a custom error message if the condition fails. This is the native, declarative way to enforce input constraints at plan time, preventing invalid data from propagating into the module.

Answer

Use the 'provider' block to enforce input types.

Answer

Write a custom bash script to check the inputs.

Answer

Terraform automatically validates all inputs as strings.

Question 17

When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?

Accepted Answer

Resource naming collisions.. With create_before_destroy, Terraform creates the new resource before destroying the old one. If the resource has a unique name or identifier (e.g., an AWS resource with a fixed name), the new resource may conflict with the existing one, causing the plan to fail due to naming collisions.

Answer

Terraform will delete the state file.

Answer

Provider credentials will expire.

Answer

All other resources will be destroyed.

Question 18

Which THREE of the following are valid ways to transform data for Terraform configuration?

Accepted Answer

flatten(). Option A, flatten(), is correct because it is a built-in Terraform function that takes a list of lists and transforms it into a single flat list, which is a valid data transformation for configuration. Option B, merge(), is correct because it is a built-in Terraform function that combines multiple maps or objects into one map, a common way to transform and consolidate data in Terraform. Option E, for expressions, is correct because Terraform's for expressions iterate over lists, sets, maps, or objects to produce a new transformed list or map, making them a core transformation mechanism. Option C, split_map(), is not a valid Terraform function, so it cannot transform data. Option D, loop(), is not a Terraform construct; iteration is handled by for expressions, count, or for_each, not a loop() function.

Answer

split_map()

Answer

loop()

Question 19

Where can you define variables that apply to all workspaces within an organization in HCP Terraform?

Accepted Answer

In a Variable Set.. In HCP Terraform (formerly Terraform Cloud), a Variable Set is a named collection of variables that can be applied to multiple workspaces across an organization. Variable Sets are designed specifically to share variables globally or across selected workspaces, making them the correct mechanism for organization-wide variable definitions. They can contain both Terraform variables and environment variables, and can be scoped to all workspaces or a subset.

Answer

In the Private Module Registry.

Answer

In the individual workspace configuration.

Answer

In the organization settings directly.

Question 20

You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?

Accepted Answer

Grant 'Read' and 'Queue Plan' permissions.. The 'Read' and 'Queue Plan' permissions allow a user to view workspaces and trigger runs, but not modify variables. This follows the principle of least privilege for the required actions.

Answer

Grant Admin access.

Answer

Grant 'Manage Variables' permission.

Answer

Grant 'Write' permission to the workspace.