TF-004 Practice Test 14 — 15 Questions

Question 1

A Terraform configuration includes a variable for a database password marked as sensitive. When a user runs 'terraform apply', the password appears as (sensitive) in the plan output. However, they want to pass this password to a provisioner as an environment variable. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the nonsensitive() function around the variable when assigning.. The `nonsensitive()` function explicitly marks a sensitive value as safe to use in contexts where Terraform would otherwise block its usage, such as passing it to a provisioner's environment variable. Even though the variable is marked as sensitive, Terraform still prevents it from being used in certain contexts unless you explicitly override that protection with `nonsensitive()`. This ensures the password is available to the provisioner while still hiding it from CLI output.

Answer

Use the variable directly; sensitive only affects CLI output.

Answer

Store the password in a local value with sensitive = false.

Answer

Remove the sensitive flag from the variable.

Question 2

Refer to the exhibit. Which command was most likely executed?

Accepted Answer

terraform init. The exhibit shows Terraform downloading and installing provider plugins (e.g., hashicorp/aws) and initializing the backend configuration. This is the exact behavior of `terraform init`, which prepares the working directory for other commands by ensuring all required providers and modules are available.

Answer

terraform apply

Answer

terraform plan

Answer

terraform get

Question 3

A developer is new to Terraform and wants to understand the purpose of the terraform init command. Which statement correctly describes its primary function?

Accepted Answer

It initializes the local environment by downloading the required provider plugins and modules.. `terraform init` is the first command to run in any Terraform project. Its primary function is to initialize the working directory by downloading and installing the required provider plugins (e.g., from the Terraform Registry) and modules specified in the configuration. It also sets up the backend for state storage and locks, ensuring the local environment is ready for subsequent commands like `plan` and `apply`.

Answer

It checks the syntax of all configuration files.

Answer

It compares the state file with real infrastructure.

Answer

It creates the initial configuration for a new Terraform project.

Question 4

An organization uses Terraform Cloud with a VCS-backed workspace connected to a GitHub repository. They want to trigger a speculative plan without creating a run (i.e., without costing compute resources or being displayed in the workspace). Which approach is appropriate?

Accepted Answer

Run 'terraform plan' from a local CLI configured with the same workspace and a remote backend.. Running 'terraform plan' from a local CLI configured with the same workspace and a remote backend triggers a speculative plan that is computed on Terraform Cloud but does not create a run record or consume run credits. This allows the user to preview changes without affecting the workspace's run history or incurring costs.

Answer

Push a new commit to the GitHub repository with a 'plan' label.

Answer

Use the 'plan -out' flag with a special path to avoid creating a run.

Answer

Use the Terraform Cloud API to queue a plan with 'auto-apply' disabled.

Question 5

A team is using Terraform to manage infrastructure across multiple environments (dev, staging, prod). They want to reuse the same root module configuration but with different variable values. Which approach is the most efficient?

Accepted Answer

Use Terraform workspaces. Terraform workspaces allow you to manage multiple distinct sets of infrastructure resources (e.g., dev, staging, prod) from the same root module configuration by maintaining separate state files for each workspace. This avoids duplicating code or manually managing state file switching, making it the most efficient approach for reusing configuration with different variable values across environments.

Answer

Use environment variables to switch between configurations

Answer

Use a single state file that includes all environments

Answer

Copy the entire configuration into separate directories for each environment

Question 6

Refer to the exhibit. A team is using this S3 backend configuration. During a deployment, they receive an error that the state file is locked. What is the most likely cause?

Accepted Answer

The DynamoDB table is not provisioned or the IAM role lacks permissions. The error message 'state file is locked' directly indicates that Terraform is attempting to acquire a lock on the state using DynamoDB, but the lock table either does not exist or the IAM role used by Terraform lacks the required permissions (dynamodb:PutItem, dynamodb:GetItem, dynamodb:DeleteItem, dynamodb:DescribeTable). Without a properly provisioned DynamoDB table or sufficient IAM permissions, the locking mechanism fails, producing this specific error.

Answer

The S3 bucket does not exist

Answer

The region is incorrect

Answer

The key path is incorrect

Question 7

Which TWO actions are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform plan. The core Terraform workflow consists of three main steps: `terraform init` to initialize the working directory, `terraform plan` to preview changes, and `terraform apply` to execute those changes. Option B (`terraform plan`) is correct because it creates an execution plan showing what actions Terraform will take to reach the desired state defined in configuration files. Option D (`terraform apply`) is correct because it applies the changes required to reach the desired state, either by using a previously generated plan or by creating a new plan and prompting for approval.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform destroy

Question 8

Refer to the exhibit. A developer runs the commands shown. The Terraform configuration defines a `random_pet` resource. The developer expects the plan to show a new resource to be created, but it says "No changes." What is the most likely reason?

Accepted Answer

The random_pet resource was already created in a previous apply and is still in the state. The `random_pet` resource was already created and recorded in the Terraform state file during a previous `terraform apply`. When the developer runs `terraform plan` again without any changes to the configuration, Terraform compares the current state to the configuration and finds no differences, resulting in 'No changes.' The resource already exists in the state, so no new resource is planned.

Answer

The `-auto-approve` flag prevents showing changes in the plan

Answer

The `random_pet` resource is not supported by the Terraform version

Answer

The backend is local, so changes are not persisted across runs

Question 9

A team is reviewing the Terraform configuration shown in the exhibit. Which statement best describes the relationship between the two resources?

Accepted Answer

The two resources have no dependencies and can be created in any order.. Terraform resources are independent by default unless an explicit or implicit dependency is declared. In the exhibit, the S3 bucket and EC2 instance are defined without any `depends_on` argument or attribute reference (e.g., `aws_s3_bucket.example.arn` used in the EC2 instance configuration). Therefore, Terraform can create them in parallel or any order, as there is no directed acyclic graph (DAG) edge enforcing a creation sequence.

Answer

The S3 bucket cannot be created until the EC2 instance is running.

Answer

The S3 bucket depends on the EC2 instance because it is defined after it.

Answer

The EC2 instance depends on the S3 bucket because the instance uses the bucket name.

Question 10

A new user is learning Terraform. They write a configuration file and run terraform apply expecting to provision resources. However, they forgot to run terraform init first. What will happen?

Accepted Answer

Terraform will return an error stating that the working directory is not initialized.. Terraform requires the working directory to be initialized with `terraform init` before any plan or apply can be executed. The `init` command downloads the necessary provider plugins and sets up the backend state storage. Without it, Terraform has no knowledge of the providers or state configuration, so it returns an error stating that the working directory is not initialized.

Answer

Terraform will successfully apply the configuration because validate is enough.

Answer

Terraform will automatically run init before applying.

Answer

Terraform will prompt to run init and then continue.

Question 11

A team is new to Terraform and wants to manage their cloud infrastructure. They have written configuration files but have not yet run any commands. What is the correct sequence of initial steps to deploy their infrastructure?

Accepted Answer

Run terraform init, then terraform plan, then terraform apply. The correct sequence is `terraform init`, `terraform plan`, then `terraform apply`. `terraform init` must be run first to initialize the working directory, download required provider plugins (e.g., AWS, Azure), and set up the backend state storage. Without initialization, subsequent commands like `plan` and `apply` will fail because Terraform cannot locate providers or configure the state backend. After initialization, `terraform plan` creates an execution plan showing what resources will be created, modified, or destroyed, and `terraform apply` executes that plan to deploy the infrastructure.

Answer

Run terraform plan, then terraform apply, then terraform init

Answer

Run terraform validate, then terraform plan, then terraform apply

Answer

Run terraform apply, then terraform plan, then terraform init

Question 12

Based on the exhibit, what will happen to the existing Elastic IP (aws_eip.web_eip) when this plan is applied?

Accepted Answer

It will be destroyed. The Terraform configuration shows that the `aws_eip.web_eip` resource is no longer defined in the configuration after the plan is applied. Terraform will detect that the resource exists in the state but is absent from the configuration, and by default, it will destroy the Elastic IP to reconcile the state with the configuration. This is standard Terraform behavior for resources removed from `.tf` files.

Answer

It will remain unchanged

Answer

It will be updated in-place

Answer

It will be created

Question 13

Drag and drop the steps to manage Terraform state locking with a backend in the correct order.

Accepted Answer

Configure backend with locking, then run terraform init, then run terraform apply, then run terraform destroy.. Backend config must include locking mechanism; init sets up backend, apply uses lock.

Answer

Run terraform init, then configure backend with locking, then run terraform apply, then run terraform destroy.

Answer

Configure backend with locking, then run terraform apply, then run terraform init, then run terraform destroy.

Answer

Run terraform apply, then configure backend with locking, then run terraform init, then run terraform destroy.

Question 14

A DevOps team is integrating Terraform into a CI/CD pipeline using Jenkins. They want to ensure that the pipeline fails if the Terraform plan contains destructive changes. Which approach best achieves this?

Accepted Answer

Run terraform plan -detailed-exitcode and fail pipeline if exit code is 2.. `terraform plan -detailed-exitcode` returns exit code 2 when there are any changes, including destructive changes. While it does not specifically detect only destructive changes, failing on any changes ensures that destructive changes are caught before apply, which is a common safety practice in CI/CD pipelines. Options A, B, and C are incorrect because A requires applying changes first, B does not detect changes, and C would actually destroy resources.

Answer

Run terraform apply and parse the output for destroy messages.

Answer

Run terraform validate and check output for errors.

Answer

Run terraform destroy --target and fail if any resources are destroyed.

Question 15

What is the primary purpose of 'terraform init'?

Accepted Answer

To initialize the working directory, download providers, and set up the backend.. The 'terraform init' command is the first step in the core Terraform workflow. Its primary purpose is to initialize the working directory containing Terraform configuration files, download and install the required provider plugins (e.g., AWS, Azure, GCP), and configure the backend (e.g., local, S3, Terraform Cloud) for state storage. Without running 'terraform init', subsequent commands like 'terraform plan' or 'terraform apply' will fail because the providers and backend are not set up.

Answer

To format the Terraform configuration files.

Answer

To apply changes to the infrastructure.

Answer

To preview infrastructure changes before applying them.