TF-004 Practice Test 15 — 15 Questions

Question 1

A developer wants to use Terraform in a CI pipeline where the pipeline runs on pull requests. They need to preview infrastructure changes without applying them. Which command should be used?

Accepted Answer

terraform plan. `terraform plan` creates an execution plan that shows what actions Terraform will take to change infrastructure to match the configuration, without actually applying any changes. This is the standard command for previewing infrastructure changes in a CI pipeline triggered by pull requests, enabling developers to review proposed modifications before merging.

Answer

terraform validate

Answer

terraform init

Answer

terraform apply

Question 2

Which TWO of the following are valid ways to reference a resource attribute in Terraform?

Accepted Answer

`module.vpc.vpc_id`. `module.vpc.vpc_id` directly references an output attribute from a module. In Terraform, module outputs are accessed using the syntax `module..`, and `vpc_id` is a common output from VPC modules that exposes the ID of the created VPC resource.

Answer

`module.vpc.output`

Answer

`data.aws_ami.ubuntu.id`

Answer

`var.instance_type`

Question 3

An organization has a multi-cloud strategy using Terraform. They need to ensure that secrets such as API keys are not stored in plaintext in the configuration files. Which Terraform feature should they use to securely manage sensitive data?

Accepted Answer

Integration with a secrets management tool like Vault. Integrating Terraform with a dedicated secrets management tool like HashiCorp Vault allows sensitive data (e.g., API keys, passwords) to be stored securely and retrieved at runtime via data sources, rather than being hardcoded in plaintext in configuration files. This approach ensures secrets are never written to disk in plaintext, are encrypted in transit and at rest, and can be dynamically rotated without modifying Terraform code.

Answer

Terraform variable definitions with environment variables

Answer

Terraform workspaces

Answer

Terraform state file encryption

Answer

Terraform's sensitive parameter in output blocks

Question 4

A developer wants to conditionally create a resource based on a variable that is a boolean. Which syntax should they use?

Accepted Answer

Use 'count = var.create ? 1 : 0'. In Terraform, the `count` meta-argument accepts a number, and the ternary expression `var.create ? 1 : 0` evaluates to 1 (true) to create one instance of the resource or 0 (false) to create none. This is the standard pattern for conditionally creating a single resource based on a boolean variable.

Answer

Use 'if var.create' inside the resource block

Answer

Use 'for_each = var.create ? [1] : []'

Answer

Use 'count = var.create'

Question 5

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 6

An operator wants to test an expression used in a Terraform configuration without running a plan or apply. Which command allows interactive evaluation of expressions?

Accepted Answer

terraform console. The `terraform console` command opens an interactive Read-Eval-Print Loop (REPL) that allows operators to evaluate Terraform expressions, including interpolations and functions, using the current state and configuration without executing a plan or apply. This is the only command designed specifically for ad-hoc expression testing in a live context.

Answer

terraform validate

Answer

terraform plan -out=test.tfplan

Answer

terraform output

Question 7

A module requires an input variable named 'vpc_id'. How should the calling configuration pass the VPC ID from another module's output?

Accepted Answer

vpc_id = module.vpc.vpc_id. In Terraform, when you need to reference an output from a child module, the syntax is `module..`. The `.outputs.` prefix is not used; Terraform automatically exposes module outputs as direct attributes of the module resource. Therefore, `module.vpc.vpc_id` correctly retrieves the `vpc_id` output from the module named `vpc`.

Answer

vpc_id = module.vpc.outputs.vpc_id

Answer

vpc_id = var.vpc_id

Answer

vpc_id = vpc.module.vpc_id

Question 8

A team wants to use Terraform to provision infrastructure across multiple cloud providers. Which configuration approach best supports this goal?

Accepted Answer

Define multiple provider blocks, one for each cloud provider.. Terraform uses multiple provider blocks to manage resources from different cloud providers within a single configuration. Each provider block configures a separate provider (e.g., aws, azurerm, google) with its own authentication and region settings, allowing Terraform to provision and manage infrastructure across AWS, Azure, GCP, and others in the same state file and execution plan.

Answer

Use a single provider block that supports multiple clouds.

Answer

Terraform cannot manage multiple clouds in one configuration.

Answer

Create separate workspaces for each cloud provider.

Question 9

A Terraform configuration uses `count` to create multiple EC2 instances. After adding a new variable for instance type, the user runs `terraform plan` and sees that all instances are marked for recreation. What is the most likely cause?

Accepted Answer

The variable change triggers a new value for each resource, causing Terraform to see differences. When you change a variable that is referenced within a resource's configuration (such as `instance_type`), Terraform sees a diff between the current state and the new configuration for every resource created by `count`. Since `count` resources are identified by their index in the state, and the new variable value changes the desired configuration for each instance, Terraform plans to recreate all of them to apply the new instance type.

Answer

The `count` index changed, causing all resources to be re-indexed

Answer

The user forgot to run `terraform refresh` after changing the variable

Answer

The state file is corrupt and needs to be refreshed

Answer

The provider version is incompatible with the new variable type

Question 10

A user wants to see the current state of resources in a human-readable format without making changes. Which command should they use?

Accepted Answer

terraform show. `terraform show`, is correct because it displays the current state of managed resources in a human-readable format (defaulting to plain text) without making any changes. This command reads the state file directly and presents its contents, making it ideal for inspection and debugging. Unlike `terraform plan`, it does not generate an execution plan or propose modifications.

Answer

terraform output

Answer

terraform state list

Answer

terraform plan

Question 11

A company uses Terraform Cloud and wants to enforce policies that all EC2 instances must be of type t2.micro or t2.small. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies are HashiCorp's policy-as-code framework integrated with Terraform Cloud. They allow organizations to define fine-grained, logic-based rules that are enforced during the plan phase, such as restricting EC2 instance types to t2.micro or t2.small. This is the correct feature because it provides mandatory, automated policy enforcement across all workspaces, ensuring compliance before any infrastructure is provisioned.

Answer

Run tasks

Answer

Cost estimation

Answer

Terraform validate

Question 12

A developer wants to use a module from the Terraform Registry in their configuration. Which block is required in the root module?

Accepted Answer

module "my-module" { source = "..." }. To use a module from the Terraform Registry, you must declare a `module` block in your root configuration. The `source` argument inside that block specifies the module's location (e.g., a registry path like `hashicorp/consul/aws`). This is the only way Terraform knows to fetch, version, and instantiate the module's resources.

Answer

resource "my-module" { ... }

Answer

provider "my-module" { source = "..." }

Answer

data "my-module" { ... }

Question 13

A user wants to remove a specific resource from Terraform state without destroying the actual infrastructure. Which command should they use?

Accepted Answer

terraform state rm resource. The `terraform state rm` command is the correct choice because it removes a specified resource from the Terraform state file without making any API calls to the actual infrastructure provider. This allows the resource to be detached from Terraform management while leaving the real-world resource running, which is exactly what the user wants.

Answer

terraform taint resource

Answer

terraform state mv resource

Answer

terraform destroy -target=resource

Question 14

A developer wants to see the list of resources currently managed by Terraform in the state file. Which command should they use?

Accepted Answer

terraform state list. `terraform state list` is the dedicated command to list all resources tracked in the Terraform state file. It reads the state directly and outputs the resource addresses (e.g., `aws_instance.web`), giving the developer a clear view of what Terraform currently manages.

Answer

terraform graph

Answer

terraform output

Answer

terraform show

Question 15

A team is defining their Infrastructure as Code strategy. Which two of the following are key benefits of using IaC compared to manual configuration?

Accepted Answer

Faster deployment and provisioning.. IaC automates the provisioning and configuration of infrastructure through code, eliminating the need for manual, error-prone steps. This enables rapid deployment of resources, often reducing setup times from hours to minutes by leveraging tools like Terraform to apply declarative configurations in parallel across multiple providers.

Answer

Reduced need for monitoring.

Answer

Elimination of all security vulnerabilities.

Answer

Automatic recovery from any infrastructure failure.