TF-003 Practice Test 10 — 10 Questions

Question 1

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. Option C is correct because the error indicates the state lock cannot be acquired because another process holds the lock. Options A and B are configuration issues that would cause different errors. Option D is unlikely; a corrupted state file would cause other errors.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.

Question 2

Which THREE of the following are best practices for Terraform state management?

Accepted Answer

Use workspaces to manage different environments.. Options A, C, and E are correct. A ensures state is shared and locked. C enables environment separation. E allows removing resources from state for import or drift correction. B is wrong because state files contain sensitive data and should not be in VCS. D is wrong because manual editing is error-prone.

Answer

Manually edit state files to fix configuration drift.

Answer

Commit state files to version control.

Question 3

A developer wants to use a module from the Terraform Registry in their configuration. Which block is required in the root module?

Accepted Answer

module "my-module" { source = "..." }. Option B is correct because modules are called using the 'module' block with a 'source' argument. Option A is a provider block used for providers. Option C is a data source. Option D is a resource block.

Answer

resource "my-module" { ... }

Answer

provider "my-module" { source = "..." }

Answer

data "my-module" { ... }

Question 4

A team uses Terraform with multiple workspaces and wants to automatically trigger a plan when a pull request is opened in their Git repository. They use Terraform Cloud. Which feature enables this?

Accepted Answer

VCS-driven workflow. Option B is correct because the VCS-driven workflow in Terraform Cloud automatically runs speculative plans on pull requests. Options A, C, and D are incorrect because they require manual triggering or are not workflows.

Answer

API-driven workflow

Answer

CLI-driven workflow

Answer

Registry-driven workflow

Question 5

Which TWO of the following are valid ways to use Terraform outside the core workflow (i.e., in automation or CI/CD pipelines)?

Accepted Answer

Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.. Options A and D are correct. A uses the CLI with -auto-approve in a pipeline. D uses the Terraform Cloud API to trigger runs. B is not a common pattern. C is for state migration. E is a tool for visualization, not automation.

Answer

Using 'terraform state mv' to reorganize state files.

Answer

Using 'terraform init -from-module' to force module re-download.

Answer

Using 'terraform graph' to generate visual output.

Question 6

Which TWO are valid methods to import existing infrastructure into Terraform?

Accepted Answer

Run 'terraform import' with the resource address and ID.. Options B and D are correct. B involves writing resource blocks manually and then using terraform import. D is the direct import command. A is not a command. C migrates state, not imports. E is not for import.

Answer

Use 'terraform state rm' to remove existing state before running apply.

Answer

Use 'terraform console' to inspect and import.

Answer

Use 'terraform init -migrate-state' to import from another backend.

Question 7

A company uses Terraform with a remote backend (AWS S3). They want to ensure that the state file is encrypted at rest. Which configuration approach guarantees this?

Accepted Answer

Configure the S3 backend with server-side encryption enabled (e.g., 'encrypt = true' and 'kms_key_id').. Option A is correct because S3 can be configured with server-side encryption, either via bucket policy or default encryption. Options B and D are not real Terraform commands. Option C is incorrect because provider block does not control state encryption.

Answer

Enable encryption in the AWS provider block.

Answer

Use 'terraform state encrypt' command.

Answer

Use 'terraform init -encrypt-state' flag.

Question 8

A Terraform configuration uses a module from the public registry. After a provider update, the module's resources fail to create. What is the most probable cause?

Accepted Answer

The module is incompatible with the new provider version. Provider updates often introduce breaking changes, and modules may rely on older provider features. Incompatibility with a new provider version can cause failures. Other options are less likely.

Answer

The provider binary is corrupted

Answer

The state file is corrupted

Answer

The backend configuration is incorrect

Question 9

A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies allow you to define rules that check configurations before they are applied. Workspace variables store values, cost estimation estimates costs, run tasks integrate third-party tools – none of them enforce tagging rules.

Answer

Cost estimation

Answer

Workspace variables

Answer

Run tasks

Question 10

An organization wants to use Terraform to manage resources across multiple accounts and regions, with different team members responsible for different environments. Which Terraform feature helps separate state and configuration for each environment?

Accepted Answer

Workspaces. Workspaces allow multiple state files within the same backend, isolating environments. Modules organize code but don't separate state. Providers define connectivity to cloud providers. Backends store state but don't inherently separate environments.

Answer

Providers

Answer

Modules

Answer

Backends