AWS provider Hard Questions — 25 Difficult Questions

Question 1

When troubleshooting a failed plan in HCP Terraform, which THREE sources should you check?

Accepted Answer

Policy check results. Logs, policy evaluation results, and the terraform init output are essential for debugging.

Answer

The provider source code

Answer

Organization billing page

Question 2

Which HCP Terraform feature allows you to manage infrastructure across multiple cloud accounts using a single organization?

Accepted Answer

Projects. Organization structure in HCP Terraform supports centralized management of projects and workspaces across various cloud accounts.

Answer

Shared modules

Answer

Provider aliases

Answer

Remote execution

Question 3

Why would you use a 'locals' block within a module instead of passing everything through variables?

Accepted Answer

To reduce repetition and perform transformations on inputs.. 'locals' are ideal for transforming inputs, combining data, or creating complex naming conventions that the user shouldn't have to define.

Answer

To allow the user to override internal values easily.

Answer

To bypass input validation.

Answer

To store state data securely.

Question 4

If you have a module that creates an S3 bucket, and you want the bucket name to be prefixed by a value provided by the caller, how do you achieve this?

Accepted Answer

Use string interpolation in the bucket name attribute.. Concatenate the variable inside the resource block using string interpolation.

Answer

Use a local variable that reads from the provider config.

Answer

Define the bucket name in the root module and override the child resource.

Answer

Use the 'module_name' variable provided by Terraform.

Question 5

How can you protect a module's inputs from receiving incorrect types of data?

Accepted Answer

Use a 'validation' block with a condition inside the variable declaration.. Defining the 'type' constraint in the variable block ensures Terraform validates the input before applying changes.

Answer

Use the 'provider' block to enforce input types.

Answer

Write a custom bash script to check the inputs.

Answer

Terraform automatically validates all inputs as strings.

Question 6

You want to trigger a run only when a specific file within a module path changes. How do you configure this?

Accepted Answer

Use the 'VCS Triggers' setting in the workspace.. The VCS path filter in the workspace configuration allows you to define which directory changes trigger a new run.

Answer

Use a 'trigger_path' variable in the Terraform code.

Answer

Modify the '.terraform-version' file.

Answer

Use a Sentinel policy to filter changes.

Question 7

When using 'replace_triggered_by', what happens if the referenced resource is deleted?

Accepted Answer

The plan fails because the dependency cannot be evaluated.. If the referenced resource is deleted, the expression for replace_triggered_by becomes invalid, and Terraform will return an error during the plan phase.

Answer

The resource is destroyed as well.

Answer

The resource is kept as is.

Answer

The trigger is ignored.

Question 8

Which THREE of these are benefits of using modules in Terraform?

Accepted Answer

Enforcing standardized configurations across teams.. Modules improve code reuse, organization, and standardization.

Answer

Increasing the execution speed of API calls.

Answer

Automatically preventing all resource drift.

Question 9

You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?

Accepted Answer

Use the 'count' meta-argument with a ternary expression.. The 'count' meta-argument is commonly used to toggle resource creation based on a boolean value.

Answer

Define multiple resources and use 'depends_on' to link them.

Answer

Use an 'if' block around the resource definition.

Answer

Use the 'module' meta-argument inside the resource.

Question 10

Which TWO of the following are valid ways to pass a provider configuration to a child module?

Accepted Answer

Using the 'providers' meta-argument inside the module block.. Providers are either inherited from the root or passed explicitly using the 'providers' map in the module block.

Answer

Defining the provider inside the module's 'main.tf'.

Answer

Passing the provider as a string input variable.

Answer

Using a global variable for provider credentials.

Question 11

Which THREE items should be included in a well-documented Terraform module?

Accepted Answer

Clear documentation for each output.. Documentation should cover how to use the module, its inputs, and its outputs.

Answer

A list of all possible provider configurations.

Answer

The raw state file of the module's resources.

Question 12

When should you use the 'for_each' meta-argument within a module?

Accepted Answer

To instantiate multiple copies of a module based on a map or set.. 'for_each' is used to create multiple instances of a module based on a map or set of strings.

Answer

To iterate over a list of variables inside a resource block.

Answer

To replace the 'count' meta-argument when you only need one instance.

Answer

To speed up the execution of the provider.

Question 13

Which THREE actions are best practices when publishing a module to a private registry?

Accepted Answer

Use Semantic Versioning (SemVer) for all releases.. Best practices include versioning, documentation, and specific naming conventions.

Answer

Keep all files in the root folder, including tests.

Answer

Prefix the repository name with 'terraform-provider-'.

Question 14

You have a workspace configured for 'CLI-driven' workflow. What does this mean for how you apply changes?

Accepted Answer

The user triggers operations via the CLI. CLI-driven workflows require the user to trigger the plan/apply locally, while the state is managed remotely.

Answer

Operations are always automatic

Answer

It disables remote state

Answer

The plan happens locally, apply remotely

Question 15

You are using a dynamic block to define multiple 'tag' blocks inside an AWS resource. The dynamic block is failing because it expects a set of objects but receives a flat list. Which function best prepares your data?

Accepted Answer

toset(). The toset() function converts a list of strings or objects into a set, which is required by for_each to avoid index-based dependencies.

Answer

keys()

Answer

distinct()

Answer

compact()

Question 16

Which THREE factors influence the choice of using an HCP Terraform Agent?

Accepted Answer

Need for private network connectivity. Agents are used for private network connectivity, compliance requirements, and accessing resources that don't allow public internet access.

Answer

To increase the speed of the provider download

Answer

To remove the need for a VCS

Question 17

Which TWO factors must be considered when using 'replace_triggered_by' with multiple resources?

Accepted Answer

The trigger cannot cause a circular dependency loop.. You must ensure the resources exist and that you are not creating circular replacement dependencies.

Answer

The trigger only works on the 'tags' attribute.

Answer

The trigger requires 'create_before_destroy' to be false.

Answer

The trigger only works with AWS resources.

Question 18

Which TWO actions can be taken to resolve issues where a resource must be replaced, but 'prevent_destroy' is enabled?

Accepted Answer

Run 'terraform state rm' to remove the resource from state and re-import.. You must either remove the meta-argument from the code or use the state management to remove the resource constraint before re-applying.

Answer

Use 'terraform apply -auto-approve'.

Answer

Use 'terraform refresh' to update the constraint.

Answer

Set the prevent_destroy argument to false in the CLI.

Question 19

When implementing OPA policies, what is the 'soft-mandatory' enforcement level?

Accepted Answer

It allows the run if overridden. Soft-mandatory policies can be overridden by users with sufficient permissions after a warning is issued.

Answer

It blocks the run completely

Answer

It is a deprecated feature

Answer

It only logs the event

Question 20

When migrating from local state to HCP Terraform, which command is used to initialize the migration?

Accepted Answer

terraform init. 'terraform init' detects the backend configuration and initiates the migration process.

Answer

terraform login

Answer

terraform push

Answer

terraform migrate