TF-004 Practice Test 13 — 15 Questions

Question 1

A team is using a remote backend for Terraform state. After merging a pull request that modifies the configuration, the pipeline runs `terraform plan` and sees an unexpected diff for a resource that was not changed in the code. The state file is up-to-date with the infrastructure. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The actual infrastructure was modified outside of Terraform. When infrastructure is modified outside of Terraform (e.g., via the cloud console, CLI, or another tool), the next `terraform plan` will detect a drift between the actual infrastructure state and the desired configuration in the code. Since the state file is up-to-date with the infrastructure, the unexpected diff indicates that the remote state accurately reflects the live environment, but the configuration no longer matches due to external changes. This is a classic case of configuration drift, which Terraform surfaces as a plan diff even when no code changes were made.

Answer

The provider version has been updated and includes a change to the resource schema

Answer

A previous `terraform state rm` command removed the resource from state

Answer

The state file is stale and needs to be refreshed

Question 2

A team uses Terraform to manage AWS resources. After a manual change to an S3 bucket policy through the AWS console, Terraform's next plan shows that it will revert the policy to the configuration. This is an example of which concept?

Accepted Answer

Configuration drift and correction. This scenario describes configuration drift, where a manual change to an S3 bucket policy via the AWS console creates a difference between the actual state of the resource and the desired state defined in Terraform code. Terraform's next plan detects this drift and will revert the policy to match the configuration, demonstrating its correction mechanism. This is a core principle of declarative IaC tools like Terraform, which enforce the desired state and automatically remediate any out-of-band changes.

Answer

Immutable infrastructure

Answer

Resource tagging

Answer

Imperative provisioning

Question 3

Refer to the exhibit. A developer runs terraform plan and sees the above output. What will happen when terraform apply is executed?

Accepted Answer

The existing EC2 instance's instance_type is changed to t2.small in-place.. Terraform's plan output shows an in-place update (indicated by the tilde `~` symbol) for the `instance_type` attribute of the existing EC2 instance. When `terraform apply` is executed, Terraform will modify the instance's type to `t2.small` without destroying and recreating the resource, as the change is supported by the AWS provider for EC2 instances.

Answer

The existing EC2 instance is replaced due to a change in instance_type.

Answer

A new EC2 instance is created with instance_type t2.small, and the old one is destroyed.

Answer

No changes will be made because the plan shows an update.

Question 4

A team wants to reuse a VPC module across multiple environments. They need to pass outputs from one module as inputs to another. Which configuration is correct?

Accepted Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.subnet_id }. In Terraform, module outputs are accessed using the syntax `module..`, not `module..outputs.` or `vpc.output.`. The `outputs` attribute is not a valid path; Terraform automatically exposes all declared outputs of a module as attributes of the module object. Therefore, `module.vpc.subnet_id` correctly references the `subnet_id` output from the `vpc` module.

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.outputs.subnet_id }

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = vpc.output.subnet_id }

Answer

module "app" { source = "./app" subnet_id = module.vpc.subnet_id }

Question 5

Refer to the exhibit. After applying this configuration, a team member manually changes the instance type to 't2.small' via the AWS console. The next `terraform plan` shows a change to revert to 't2.micro'. What does this demonstrate?

Accepted Answer

Terraform's desired state reconciliation. Terraform operates on a desired state model: the configuration file defines the target state (t2.micro), and `terraform plan` detects that the actual state (t2.small) has diverged from it. The plan proposes to revert the instance type to t2.micro, demonstrating Terraform's reconciliation of the actual infrastructure back to the declared desired state. This is not merely drift detection (which only reports differences) but active enforcement of the desired configuration.

Answer

Terraform's drift detection only

Answer

Immutable infrastructure pattern

Answer

A misconfiguration in the Terraform code

Question 6

An organization is evaluating IaC tools and wants to minimize configuration drift. Which characteristic of a declarative IaC approach is most effective in preventing drift?

Accepted Answer

Periodic state comparison and correction. A declarative IaC approach defines the desired end state of infrastructure, and tools like Terraform use periodic state comparison (e.g., `terraform plan` and `terraform apply`) to detect and correct any configuration drift. This automated reconciliation ensures the actual infrastructure matches the declared configuration, directly preventing drift without manual intervention.

Answer

Manual approval gates

Answer

Tagging resources

Answer

Using modules

Question 7

A team wants to manage infrastructure across multiple cloud providers using a single tool that supports infrastructure as code. Which tool is best suited for this purpose?

Accepted Answer

Terraform. Terraform is the best choice because it is a cloud-agnostic Infrastructure as Code (IaC) tool that uses a declarative configuration language (HCL) to manage resources across multiple providers (e.g., AWS, Azure, GCP) through a single workflow. Unlike provider-specific tools, Terraform's provider plugin architecture allows it to abstract away API differences, enabling consistent state management and provisioning across heterogeneous environments.

Answer

Ansible

Answer

AWS CloudFormation

Answer

Chef

Question 8

An operator runs `terraform apply` and receives an error that the state file is locked. What is the most likely cause?

Accepted Answer

Another user is running a Terraform operation. Terraform uses a state locking mechanism (typically via a backend like S3 with DynamoDB, or Consul) to prevent concurrent operations from corrupting the state file. When another user or process is running a Terraform operation (e.g., `apply`, `plan`, `destroy`), the lock is held, and any subsequent `terraform apply` will fail with a 'state file is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The state file is outdated and needs refresh

Answer

The configuration has a syntax error

Answer

The user lacks write permissions to the state file

Question 9

A root module uses a module that creates an AWS EC2 instance. The module outputs the instance ID. The root module then uses this output in a null_resource provisioner. After modifying the module, terraform plan shows that the EC2 instance will be destroyed and recreated. What is the impact on the null_resource?

Accepted Answer

The null_resource will be destroyed and recreated alongside the EC2 instance.. The null_resource's triggers typically depend on the module's output (the instance ID). When the EC2 instance is destroyed and recreated, its ID changes, which updates the trigger value. Terraform interprets this change as a need to destroy and recreate the null_resource along with its provisioner, ensuring the provisioner runs again with the new instance ID.

Answer

The null_resource prompts the user to confirm before any changes.

Answer

The null_resource will remain unchanged because it is not directly attached to the module.

Answer

The null_resource will fail to run because the output is temporarily unavailable during destroy.

Question 10

Refer to the exhibit. What does this output show?

Accepted Answer

Resources managed by Terraform. The output shows a list of resources that Terraform is currently tracking in its state file. This indicates which resources are under Terraform's management, not just those defined in the configuration or those that are out of sync. Option D is correct because the `terraform state list` command (or similar output) displays all resources that Terraform is actively managing, regardless of their current state relative to the configuration.

Answer

Resources to be created

Answer

Resources in the configuration

Answer

Resources that are out of sync

Question 11

A junior engineer cloned a Terraform repository from GitHub and ran terraform init inside the project directory. The command downloaded the required provider plugins successfully. Next, they ran terraform plan and received the following error: 'Error: No configuration files found in the current directory.' The engineer checked and confirmed that the main.tf file exists in the current directory. What is the most likely cause of this error?

Accepted Answer

The file is named main.tf.txt instead of main.tf. Terraform requires configuration files to have the `.tf` extension to be recognized. If the file is named `main.tf.txt` (e.g., due to Windows hiding known file extensions or accidental renaming), Terraform will not parse it as a configuration file, resulting in the 'No configuration files found' error even though the file exists in the directory. The `terraform init` command succeeded because it only downloads providers and modules, not requiring `.tf` files to be present.

Answer

The terraform init command was not run with -upgrade flag

Answer

The main.tf file contains syntax errors

Answer

The terraform plan command requires the -out flag

Question 12

An organization uses Terraform workspaces to manage multiple environments (dev, staging, prod) with the same configuration. What is the primary benefit of using workspaces for state management?

Accepted Answer

Each workspace has its own independent state file, preventing environment conflicts. Terraform workspaces allow each environment (dev, staging, prod) to maintain its own independent state file within the same backend configuration. This isolation prevents state conflicts, such as one environment's resources being accidentally overwritten or destroyed by operations intended for another environment, which is critical for safe multi-environment management.

Answer

Workspaces reduce the number of Terraform configurations needed

Answer

Workspaces automatically synchronize state across team members

Answer

Workspaces enable role-based access control to state

Question 13

Which command displays the output values defined in the configuration after apply?

Accepted Answer

terraform output. The `terraform output` command is specifically designed to display the output values defined in the configuration after an apply. These outputs are declared in the `output` blocks of the root module and are stored in the state file; running `terraform output` retrieves and prints them in a human-readable format, optionally with `-json` for machine parsing.

Answer

terraform state

Answer

terraform plan

Answer

terraform show

Question 14

A company is managing multiple cloud environments (dev, test, prod) using Terraform. They want to ensure consistent configurations across environments while allowing environment-specific values. Which IaC practice best supports this?

Accepted Answer

Using variables and workspaces. Using variables and workspaces allows you to define a single set of Terraform configurations while dynamically injecting environment-specific values via variable definitions (e.g., terraform.tfvars or -var-file) and isolating state per environment using workspaces (terraform workspace). This avoids duplication and ensures consistent resource definitions across dev, test, and prod, with only the variable values differing.

Answer

Using data sources only

Answer

Hardcoding values

Answer

Duplicating configuration files

Question 15

During a terraform apply, the state file becomes corrupted. What is the recommended recovery method?

Accepted Answer

Restore from backup. The recommended recovery method for a corrupted Terraform state file is to restore it from a known good backup. Terraform does not have built-in corruption repair mechanisms, so maintaining regular backups of the state file (e.g., using remote backends with versioning like S3 versioning or Terraform Cloud) is the standard operational practice. Restoring from backup ensures the state accurately reflects the real-world infrastructure without manual intervention.

Answer

Re-run apply

Answer

Delete the state and re-import all resources

Answer

Use terraform state pull