TF-004 Practice Test 12 — 15 Questions

Question 1

A team is using Terraform for infrastructure as code. They want to ensure that the state file is stored securely and can be accessed by multiple team members. Which backend type should they use?

Accepted Answer

Remote backend such as Amazon S3 with DynamoDB state locking. A remote backend like Amazon S3 with DynamoDB state locking provides secure, centralized storage for the Terraform state file and enables state locking to prevent concurrent modifications. This setup ensures that multiple team members can safely access and update the state without conflicts, while S3 offers encryption and access control. Local backends or network shares lack these locking and security features, making them unsuitable for team collaboration.

Answer

The -state flag pointing to a network share

Answer

Using the -lock=false flag

Answer

Local backend with .terraform directory version-controlled

Question 2

An organization uses Terraform with a remote backend in Azure. After a network outage, a developer attempts to run `terraform apply` and receives the error: "Error: Failed to get existing workspaces: blob (key) not found". What is the most likely cause?

Accepted Answer

The state file for the current workspace was deleted or corrupted. The error 'blob (key) not found' indicates that Terraform cannot locate the state file for the current workspace in the Azure storage container. After a network outage, the state file may have been deleted or corrupted, preventing Terraform from reading the existing state. This error is specific to the missing blob key, not to authentication or storage account availability.

Answer

The Terraform backend configuration has incorrect access key

Answer

The Azure storage account was deleted

Answer

The workspace was not created via `terraform workspace new`

Question 3

You are a platform engineer at a large e-commerce company that uses Terraform Enterprise to manage thousands of infrastructure resources across multiple teams. The company has a central 'networking' workspace that provisions shared VPCs and subnets, and several application workspaces that consume these networking resources via remote state data sources. Recently, the networking team changed the CIDR block of a shared subnet from '10.0.1.0/24' to '10.0.2.0/24' and applied the change successfully. However, the application teams are now reporting that their Terraform runs are failing with errors indicating that the subnet ID they reference does not exist. The application workspaces use the following configuration to consume the subnet:

```hcl
data "terraform_remote_state" "networking" {
  backend = "remote"
  config = {
    organization = "mycompany"
    workspaces = {
      name = "networking"
    }
  }
}

resource "aws_instance" "app" {
  subnet_id = data.terraform_remote_state.networking.outputs.subnet_id
  ...
}
```

The application workspaces have not been modified recently. The networking workspace output 'subnet_id' now contains the ID of the updated subnet. What is the most likely cause of the failures?

Accepted Answer

The application workspaces are using a cached version of the remote state outputs and need to run 'terraform plan' to refresh.. Terraform caches remote state data during the planning phase, and the `terraform_remote_state` data source only fetches the latest state when `terraform plan` or `terraform apply` is executed. Since the application workspaces have not been modified or re-planned, they are using a stale cached version of the networking workspace's outputs, which still contains the old subnet ID. Running `terraform plan` forces a refresh of the remote state data, retrieving the updated `subnet_id` and resolving the error.

Answer

The application workspaces do not have permission to read the networking workspace's state.

Answer

The networking workspace output variable 'subnet_id' was removed or renamed.

Answer

The application workspaces need to update the remote state data source to reference the new subnet ID.

Question 4

An organization uses Terraform with the AzureRM backend. The team recently split a large configuration into multiple smaller configurations, each with its own state file. They want to share outputs from one configuration (networking) as inputs to another (compute). Which approach should they use to reference the networking state from the compute configuration without duplicating data?

Accepted Answer

Use a 'data' 'terraform_remote_state' block in the compute configuration to read the networking state.. The `terraform_remote_state` data source allows one Terraform configuration to read the root-level output values from another configuration's state file stored in the AzureRM backend. This enables sharing of networking outputs (e.g., subnet IDs) into the compute configuration without duplicating data or manually exporting values. The data source retrieves the state directly from the configured backend, ensuring the compute configuration always uses the latest networking outputs.

Answer

Define output values in the networking configuration and they will be automatically available in the compute configuration.

Answer

Run 'terraform output' on the networking state and save the values to a JSON file, then use 'terraform_remote_state' to read them.

Answer

Hardcode the subnet IDs from the networking configuration into the compute configuration.

Question 5

A team has been manually modifying cloud resources outside of Terraform. They now find that Terraform plans show changes that don't match their expectations. What core concept of Terraform's purpose does this situation violate?

Accepted Answer

Declarative configuration with desired state. Terraform's core purpose is to manage infrastructure through a declarative configuration that defines the desired state. When users manually modify cloud resources outside of Terraform, the actual state diverges from the desired state defined in the configuration. Terraform detects this drift and plans changes to reconcile the actual state back to the desired state, which may include unexpected modifications or deletions. This violates the fundamental principle that Terraform should be the single source of truth for infrastructure state.

Answer

Idempotency

Answer

Immutable infrastructure

Answer

Procedural scripting

Question 6

A team is using a module from the Terraform Registry. They want to ensure that changes to the module's source version are tested in a non-production environment before being applied to production. Which approach best supports this workflow?

Accepted Answer

Use a version constraint like ~> 1.0 in the module configuration and test the module in a non-production workspace before promoting to production.. Using a version constraint like `~> 1.0` allows Terraform to automatically select the latest compatible patch version within the specified minor version range. This enables safe, incremental updates that can be tested in a non-production workspace first, and then promoted to production by simply applying the same configuration. The constraint ensures that breaking changes (major version bumps) are not automatically pulled in, giving the team control over when to adopt them.

Answer

Fork the module repository and manage the module internally as a private module.

Answer

Pin the module to an exact version (e.g., version = "1.2.3") and update it manually after testing in isolation.

Answer

Configure the module source to reference the latest commit from the default branch of the repository.

Question 7

A company has a monolithic Terraform configuration that manages all of its AWS infrastructure. They want to break it into smaller, manageable configurations without causing downtime or resource duplication. Which approach best follows the core Terraform workflow?

Accepted Answer

Use `terraform state mv` to move resources from the monolithic state to new state files for the smaller configurations. `terraform state mv` allows you to move resources from the monolithic state file into separate state files for the new, smaller configurations without destroying or recreating resources. This adheres to the core Terraform workflow by preserving the existing infrastructure state, avoiding downtime, and preventing resource duplication. The command updates the state mapping so that Terraform continues to manage the same real-world resources under the new configuration structure.

Answer

Create separate configurations from scratch and manually recreate all resources by running `terraform apply`

Answer

Import all existing resources into the new configurations before removing the old configuration

Answer

Delete the monolithic state and apply all new configurations at once

Question 8

Refer to the exhibit. The user runs 'terraform plan' and sees that Terraform wants to create the instance. However, the instance already exists in the AWS account with the same configuration. What is the most likely reason?

Accepted Answer

The instance is not in the Terraform state. Terraform determines whether to create, update, or destroy resources by comparing the desired configuration in the .tf files against the current state stored in the state file. If the instance already exists in AWS but is not recorded in the Terraform state, Terraform has no knowledge of it and will plan to create a new resource. This is the most likely reason because the instance is present in the account but absent from the state, causing Terraform to treat it as a new resource.

Answer

The instance type has changed

Answer

The AMI ID has changed

Answer

The provider version is different

Question 9

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Accepted Answer

The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. Even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.

Answer

The instance type chosen does not support public IP addresses.

Answer

The terraform init command failed and the apply did not actually create resources.

Answer

The subnet is configured as private and does not have a route to the internet.

Question 10

A company uses Terraform to manage multi-cloud infrastructure. They have separate Terraform configurations for AWS and Azure, each with its own state file. They want to share a common set of networking variables (e.g., allowed IP ranges) between these configurations without duplicating data. Which approach best achieves this?

Accepted Answer

Use a remote state data source to read the outputs from a dedicated 'globals' workspace.. Using a remote state data source allows you to read outputs from a dedicated 'globals' Terraform workspace that stores shared networking variables. This approach avoids data duplication and ensures that both AWS and Azure configurations can dynamically consume the same canonical set of values without manual copying or file sharing. It leverages Terraform's native remote state mechanism to securely and consistently share data across separate configurations.

Answer

Create a module that contains the variable definitions and reference it in both configurations.

Answer

Define the variables in a 'terraform.tfvars' file and copy it to each configuration directory.

Answer

Store the variables in a JSON file and use the 'jsondecode' function in each configuration.

Question 11

A team uses remote state stored in an S3 bucket with DynamoDB locking. A developer wants to read the current state outputs locally without making changes. Which command should they use?

Accepted Answer

terraform output. The `terraform output` command retrieves and displays the values of output variables from the current state file. When using remote state with S3 and DynamoDB locking, this command reads the state from the backend without acquiring a lock or modifying the state, making it the safe, read-only option for viewing outputs.

Answer

terraform state pull

Answer

terraform console

Answer

terraform plan

Question 12

A company is using Terraform to manage secrets in AWS Secrets Manager. They want to ensure that sensitive values are not exposed in logs, the console, or plan output. Which two practices should they implement? (Choose two.)

Accepted Answer

Use the sensitive flag in variable definitions. Marking a variable with `sensitive = true` in its definition block tells Terraform to redact its value in CLI output, logs, and plan output. This prevents the secret from being displayed in plaintext during `terraform plan` or `terraform apply`, even if the variable is used in a resource argument. Option E is correct because setting `sensitive = true` on an output value instructs Terraform to suppress that output in the CLI and in any logs or console displays, ensuring the secret value is not exposed after apply.

Answer

Use a remote backend with encryption

Answer

Use a data source to fetch secrets at runtime instead of hardcoding

Answer

Store variable values in terraform.tfvars file

Question 13

Which TWO module source types support version constraints in Terraform?

Accepted Answer

Terraform Public Registry. The Terraform Public Registry supports version constraints via the `source` argument using the `registry.terraform.io` namespace, allowing you to specify a version range (e.g., `~> 1.0`) in the module block. Option E is correct because the Terraform Cloud Private Registry also supports version constraints, enabling you to pin or constrain module versions from private repositories using the same syntax as the public registry.

Answer

HTTP URL to a zip archive

Answer

Local file path

Answer

Git URL with a branch reference

Question 14

A developer accidentally deleted a resource from the Terraform state file using 'terraform state rm'. The resource still exists in the cloud provider. How can the developer re-import the resource without affecting other resources?

Accepted Answer

Use 'terraform import' with the resource address and ID.. `terraform import` is the designated command to bring an existing cloud resource back under Terraform management without affecting other resources. It requires the resource address (as defined in the configuration) and the provider-specific resource ID, allowing Terraform to write the current state into the state file without modifying the actual infrastructure.

Answer

Re-run 'terraform apply' to recreate the resource.

Answer

Use 'terraform state push' with a previous state backup.

Answer

Run 'terraform refresh' to discover and add the resource.

Question 15

A team needs to share a Terraform module across multiple projects within their organization. What is the best practice?

Accepted Answer

Use a remote module source such as a Git repository.. Using a remote module source such as a Git repository is the best practice because it allows the module to be versioned, centrally maintained, and consumed by multiple projects without duplication. Terraform's module system supports sources like Git, Mercurial, and HTTP URLs, enabling teams to pin specific versions via tags or refs, ensuring consistency across environments.

Answer

Copy the module code into each project's directory.

Answer

Use 'terraform state push' to share state.

Answer

Use workspace variables to store module code.