AWS provider Timed Practice Test 2 — 10 Questions

Question 1

You manage an Amazon RDS instance with Terraform. During an unrelated deployment, a junior engineer runs `terraform apply` and the instance is unexpectedly destroyed and recreated, causing a brief outage. You need to ensure that future `terraform apply` runs fail before any destructive change can be planned for this database. Which configuration should you add to the `aws_db_instance` resource?

10 minute time limit — choose an answer to begin.

Accepted Answer

Add `lifecycle { prevent_destroy = true }` to the `aws_db_instance` resource.. The prevent_destroy lifecycle argument is the only mechanism that makes Terraform refuse to execute a plan containing the destruction of that specific resource. It acts as a guardrail during the plan phase, so the apply fails before any destructive API call is made. ignore_changes, create_before_destroy, and state rm all address different concerns and none of them block a replacement.

Answer

Add `lifecycle { create_before_destroy = true }` to the `aws_db_instance` resource.

Answer

Run `terraform state rm aws_db_instance.main` to detach the instance from state.

Answer

Add `lifecycle { ignore_changes = [engine] }` to the `aws_db_instance` resource.

Question 2

A team wants to pass a variable "allowed_ports" to a module and guarantee at apply time that every value is an integer between 1024 and 65535, rejecting invalid plans with a clear message. They prefer the validation to live in the variable block so callers get immediate feedback. Which declaration accomplishes this?

Accepted Answer

variable "allowed_ports" { type = list(number) validation { condition = alltrue([for p in var.allowed_ports : p >= 1024 && p <= 65535]) error_message = "Ports must be between 1024 and 65535." } }. A variable validation block with alltrue() over a per-element for expression evaluates the range predicate for every port and fails the plan when any element falls outside 1024–65535. Placing it in the variable block gives callers immediate, clearly worded feedback, and the list(number) type constraint handles element typing before the range check executes.

Answer

variable "allowed_ports" { type = list(number) validation { condition = can(regex("^[0-9]+$", join(",", var.allowed_ports))) error_message = "Ports must be between 1024 and 65535." } }

Answer

variable "allowed_ports" { type = list(number) validation { condition = length(var.allowed_ports) > 0 error_message = "Ports must be between 1024 and 65535." } }

Answer

variable "allowed_ports" { type = list(number) validation { condition = contains(var.allowed_ports, 1024) && contains(var.allowed_ports, 65535) error_message = "Ports must be between 1024 and 65535." } }

Question 3

Your team maintains a shared Terraform configuration in a GitHub repository. A developer opens a pull request that changes the instance type of a production EC2 instance. You want the change to be automatically validated by running a speculative plan before any human reviews the code. Which HCP Terraform feature should you configure to achieve this?

Accepted Answer

VCS-driven speculative plans. VCS-driven speculative plans are automatically queued by HCP Terraform when a pull request is opened against a connected repository, running a plan without applying. This provides early feedback and validation before merge. Run Triggers orchestrate runs between workspaces, CLI-driven runs are manual, and Sentinel policies only enforce rules during an existing run.

Answer

CLI-driven runs with remote backend

Answer

Run Triggers

Answer

Policy as Code with Sentinel

Question 4

Which of the following is an advantage of using HCP Terraform over local state for team collaboration?

Accepted Answer

It provides state locking and run history. HCP Terraform (formerly Terraform Cloud) provides remote state management with built-in state locking and run history, which are critical for team collaboration. State locking prevents concurrent runs from corrupting the state file, while run history allows teams to audit changes and roll back if needed. These features are not available with local state, making HCP Terraform a superior choice for teams.

Answer

It converts HCL to JSON

Answer

It eliminates the need for AWS providers

Answer

It is always free

Question 5

A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?

Accepted Answer

terraform init -upgrade. The 'terraform init -upgrade' command forces Terraform to re-evaluate and download the latest versions of providers that meet the version constraints, even if a provider is already present in the local cache. This is the correct way to update providers or re-download a missing provider binary. It also updates the dependency lock file.

Answer

terraform plan -refresh-only

Answer

terraform providers install

Answer

terraform refresh

Question 6

You are building a module that needs to be consumed by multiple teams. How should you structure your module to ensure that the root module can provide values for variable definitions without hardcoding them in the module itself?

Accepted Answer

Define variables in a variables.tf file within the module directory.. Using input variables allows the module to be generic and reusable by accepting values defined in the calling configuration.

Answer

Hardcode the values into the resource blocks directly.

Answer

Use terraform.tfvars files inside the module folder.

Answer

Define all values in a locals.tf file within the module.

Question 7

Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?

Accepted Answer

Workspaces. HCP Terraform workspaces provide isolated environments for infrastructure management, each with its own state, variables, and run history. By using the same configuration files across multiple workspaces, you can deploy to development, staging, and production with environment-specific variables and separate state, achieving the required isolation. This is the standard pattern for multi-environment deployments in HCP Terraform.

Answer

Modules

Answer

Sentinel Policies

Answer

Run Triggers

Question 8

Which of the following is an advantage of using Variable Sets?

Accepted Answer

They centralize variable management to avoid duplication across workspaces.. Variable Sets allow you to define variables once and apply them across multiple workspaces, eliminating duplication and ensuring consistency. They are ideal for shared credentials, common tags, or provider configurations that many workspaces need. This centralization reduces drift and simplifies updates.

Answer

They allow for secret rotation in AWS.

Answer

They automatically run Terraform plans.

Answer

They provide encryption for state files.

Question 9

If a developer wants to use a provider that is not in the public registry, can they still use it?

Accepted Answer

Yes, by using a local registry or filesystem mirror.. Terraform supports provider installation from local filesystem mirrors or a local registry, not just the public Terraform Registry. A filesystem mirror is a directory containing provider packages in the expected layout, and a local registry can serve providers over HTTP. This allows developers to use custom or private providers without publishing them publicly.

Answer

No, only registry providers are supported.

Answer

Yes, by setting the env var TF_IN_AUTOMATION.

Answer

Yes, by recompiling Terraform binary.

Question 10

You have defined a resource and set 'prevent_destroy = true'. If you perform a 'terraform destroy', what will happen?

Accepted Answer

Terraform will return an error and abort the destroy operation.. When a resource has `prevent_destroy = true` in its lifecycle block, Terraform treats any plan that would destroy that resource as invalid. During `terraform destroy`, Terraform first generates a destroy plan; because that plan includes deleting the protected resource, Terraform immediately returns an error and aborts the entire operation before any resource is destroyed. This is a safety mechanism to prevent accidental deletion of critical infrastructure.

Answer

Terraform will destroy all resources except the one with the rule.

Answer

Terraform will ignore the rule and destroy the resource anyway.

Answer

Terraform will prompt for confirmation twice.