TF-004 Practice Test 14 — 15 Questions

Question 1

A company is managing multiple cloud environments (dev, test, prod) using Terraform. They want to ensure consistent configurations across environments while allowing environment-specific values. Which IaC practice best supports this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using variables and workspaces. Using variables and workspaces allows you to define a single set of Terraform configurations while dynamically injecting environment-specific values via variable definitions (e.g., terraform.tfvars or -var-file) and isolating state per environment using workspaces (terraform workspace). This avoids duplication and ensures consistent resource definitions across dev, test, and prod, with only the variable values differing.

Answer

Using data sources only

Answer

Hardcoding values

Answer

Duplicating configuration files

Question 2

During a terraform apply, the state file becomes corrupted. What is the recommended recovery method?

Accepted Answer

Restore from backup. The recommended recovery method for a corrupted Terraform state file is to restore it from a known good backup. Terraform does not have built-in corruption repair mechanisms, so maintaining regular backups of the state file (e.g., using remote backends with versioning like S3 versioning or Terraform Cloud) is the standard operational practice. Restoring from backup ensures the state accurately reflects the real-world infrastructure without manual intervention.

Answer

Re-run apply

Answer

Delete the state and re-import all resources

Answer

Use terraform state pull

Question 3

A Terraform configuration includes a variable for a database password marked as sensitive. When a user runs 'terraform apply', the password appears as (sensitive) in the plan output. However, they want to pass this password to a provisioner as an environment variable. What should they do?

Accepted Answer

Use the nonsensitive() function around the variable when assigning.. The `nonsensitive()` function explicitly marks a sensitive value as safe to use in contexts where Terraform would otherwise block its usage, such as passing it to a provisioner's environment variable. Even though the variable is marked as sensitive, Terraform still prevents it from being used in certain contexts unless you explicitly override that protection with `nonsensitive()`. This ensures the password is available to the provisioner while still hiding it from CLI output.

Answer

Use the variable directly; sensitive only affects CLI output.

Answer

Store the password in a local value with sensitive = false.

Answer

Remove the sensitive flag from the variable.

Question 4

Refer to the exhibit. A user applies this configuration. They then run 'terraform destroy' but the destroy fails with an error: 'Error deleting load balancer: DependencyViolation: The load balancer 'arn:aws:elasticloadbalancing:...' cannot be deleted because it is currently associated with another resource.' The user has not made any changes to the resources. What is the most likely cause?

Accepted Answer

The aws_lb_listener is missing an explicit depends_on for the aws_lb.. The destroy fails because Terraform attempts to delete the load balancer before the listener that is associated with it. The listener has an implicit dependency on the load balancer via the `load_balancer_arn` attribute, but Terraform may not always recognize this implicit dependency, especially if the reference is indirect. Therefore, an explicit `depends_on` from the listener to the load balancer is required to ensure the listener is destroyed first, releasing the association and allowing the load balancer to be deleted. Option D correctly identifies this missing dependency on the listener.

Answer

The aws_lb_listener does not have explicit depends_on for the aws_lb_target_group.

Answer

The aws_lb_target_group is missing an explicit depends_on for the aws_lb_listener.

Answer

The aws_lb_target_group is missing an explicit depends_on for the aws_lb.

Question 5

Refer to the exhibit. Which command was most likely executed?

Accepted Answer

terraform init. The exhibit shows Terraform downloading and installing provider plugins (e.g., hashicorp/aws) and initializing the backend configuration. This is the exact behavior of `terraform init`, which prepares the working directory for other commands by ensuring all required providers and modules are available.

Answer

terraform apply

Answer

terraform plan

Answer

terraform get

Question 6

A developer is new to Terraform and wants to understand the purpose of the terraform init command. Which statement correctly describes its primary function?

Accepted Answer

It initializes the local environment by downloading the required provider plugins and modules.. `terraform init` is the first command to run in any Terraform project. Its primary function is to initialize the working directory by downloading and installing the required provider plugins (e.g., from the Terraform Registry) and modules specified in the configuration. It also sets up the backend for state storage and locks, ensuring the local environment is ready for subsequent commands like `plan` and `apply`.

Answer

It checks the syntax of all configuration files.

Answer

It compares the state file with real infrastructure.

Answer

It creates the initial configuration for a new Terraform project.

Question 7

An organization uses Terraform Cloud with a VCS-backed workspace connected to a GitHub repository. They want to trigger a speculative plan without creating a run (i.e., without costing compute resources or being displayed in the workspace). Which approach is appropriate?

Accepted Answer

Run 'terraform plan' from a local CLI configured with the same workspace and a remote backend.. Running 'terraform plan' from a local CLI configured with the same workspace and a remote backend triggers a speculative plan that is computed on Terraform Cloud but does not create a run record or consume run credits. This allows the user to preview changes without affecting the workspace's run history or incurring costs.

Answer

Push a new commit to the GitHub repository with a 'plan' label.

Answer

Use the 'plan -out' flag with a special path to avoid creating a run.

Answer

Use the Terraform Cloud API to queue a plan with 'auto-apply' disabled.

Question 8

A team is using Terraform to manage infrastructure across multiple environments (dev, staging, prod). They want to reuse the same root module configuration but with different variable values. Which approach is the most efficient?

Accepted Answer

Use Terraform workspaces. Terraform workspaces allow you to manage multiple distinct sets of infrastructure resources (e.g., dev, staging, prod) from the same root module configuration by maintaining separate state files for each workspace. This avoids duplicating code or manually managing state file switching, making it the most efficient approach for reusing configuration with different variable values across environments.

Answer

Use environment variables to switch between configurations

Answer

Use a single state file that includes all environments

Answer

Copy the entire configuration into separate directories for each environment

Question 9

Refer to the exhibit. A team is using this S3 backend configuration. During a deployment, they receive an error that the state file is locked. What is the most likely cause?

Accepted Answer

The DynamoDB table is not provisioned or the IAM role lacks permissions. The error message 'state file is locked' directly indicates that Terraform is attempting to acquire a lock on the state using DynamoDB, but the lock table either does not exist or the IAM role used by Terraform lacks the required permissions (dynamodb:PutItem, dynamodb:GetItem, dynamodb:DeleteItem, dynamodb:DescribeTable). Without a properly provisioned DynamoDB table or sufficient IAM permissions, the locking mechanism fails, producing this specific error.

Answer

The S3 bucket does not exist

Answer

The region is incorrect

Answer

The key path is incorrect

Question 10

Which TWO actions are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform plan. The core Terraform workflow consists of three main steps: `terraform init` to initialize the working directory, `terraform plan` to preview changes, and `terraform apply` to execute those changes. Option B (`terraform plan`) is correct because it creates an execution plan showing what actions Terraform will take to reach the desired state defined in configuration files. Option D (`terraform apply`) is correct because it applies the changes required to reach the desired state, either by using a previously generated plan or by creating a new plan and prompting for approval.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform destroy

Question 11

Refer to the exhibit. A developer runs the commands shown. The Terraform configuration defines a `random_pet` resource. The developer expects the plan to show a new resource to be created, but it says "No changes." What is the most likely reason?

Accepted Answer

The random_pet resource was already created in a previous apply and is still in the state. The `random_pet` resource was already created and recorded in the Terraform state file during a previous `terraform apply`. When the developer runs `terraform plan` again without any changes to the configuration, Terraform compares the current state to the configuration and finds no differences, resulting in 'No changes.' The resource already exists in the state, so no new resource is planned.

Answer

The `-auto-approve` flag prevents showing changes in the plan

Answer

The `random_pet` resource is not supported by the Terraform version

Answer

The backend is local, so changes are not persisted across runs

Question 12

A team is reviewing the Terraform configuration shown in the exhibit. Which statement best describes the relationship between the two resources?

Accepted Answer

The two resources have no dependencies and can be created in any order.. Terraform resources are independent by default unless an explicit or implicit dependency is declared. In the exhibit, the S3 bucket and EC2 instance are defined without any `depends_on` argument or attribute reference (e.g., `aws_s3_bucket.example.arn` used in the EC2 instance configuration). Therefore, Terraform can create them in parallel or any order, as there is no directed acyclic graph (DAG) edge enforcing a creation sequence.

Answer

The S3 bucket cannot be created until the EC2 instance is running.

Answer

The S3 bucket depends on the EC2 instance because it is defined after it.

Answer

The EC2 instance depends on the S3 bucket because the instance uses the bucket name.

Question 13

A new user is learning Terraform. They write a configuration file and run terraform apply expecting to provision resources. However, they forgot to run terraform init first. What will happen?

Accepted Answer

Terraform will return an error stating that the working directory is not initialized.. Terraform requires the working directory to be initialized with `terraform init` before any plan or apply can be executed. The `init` command downloads the necessary provider plugins and sets up the backend state storage. Without it, Terraform has no knowledge of the providers or state configuration, so it returns an error stating that the working directory is not initialized.

Answer

Terraform will successfully apply the configuration because validate is enough.

Answer

Terraform will automatically run init before applying.

Answer

Terraform will prompt to run init and then continue.

Question 14

A team is new to Terraform and wants to manage their cloud infrastructure. They have written configuration files but have not yet run any commands. What is the correct sequence of initial steps to deploy their infrastructure?

Accepted Answer

Run terraform init, then terraform plan, then terraform apply. The correct sequence is `terraform init`, `terraform plan`, then `terraform apply`. `terraform init` must be run first to initialize the working directory, download required provider plugins (e.g., AWS, Azure), and set up the backend state storage. Without initialization, subsequent commands like `plan` and `apply` will fail because Terraform cannot locate providers or configure the state backend. After initialization, `terraform plan` creates an execution plan showing what resources will be created, modified, or destroyed, and `terraform apply` executes that plan to deploy the infrastructure.

Answer

Run terraform plan, then terraform apply, then terraform init

Answer

Run terraform validate, then terraform plan, then terraform apply

Answer

Run terraform apply, then terraform plan, then terraform init

Question 15

Based on the exhibit, what will happen to the existing Elastic IP (aws_eip.web_eip) when this plan is applied?

Accepted Answer

It will be destroyed. The Terraform configuration shows that the `aws_eip.web_eip` resource is no longer defined in the configuration after the plan is applied. Terraform will detect that the resource exists in the state but is absent from the configuration, and by default, it will destroy the Elastic IP to reconcile the state with the configuration. This is standard Terraform behavior for resources removed from `.tf` files.

Answer

It will remain unchanged

Answer

It will be updated in-place

Answer

It will be created