TF-004 Practice Test 15 — 15 Questions

Question 1

Drag and drop the steps to manage Terraform state locking with a backend in the correct order.

Accepted Answer

Configure backend with locking, then run terraform init, then run terraform apply, then run terraform destroy.. Backend config must include locking mechanism; init sets up backend, apply uses lock.

Answer

Run terraform init, then configure backend with locking, then run terraform apply, then run terraform destroy.

Answer

Configure backend with locking, then run terraform apply, then run terraform init, then run terraform destroy.

Answer

Run terraform apply, then configure backend with locking, then run terraform init, then run terraform destroy.

Question 2

A DevOps team is integrating Terraform into a CI/CD pipeline using Jenkins. They want to ensure that the pipeline fails if the Terraform plan contains destructive changes. Which approach best achieves this?

Accepted Answer

Run terraform plan -detailed-exitcode and fail pipeline if exit code is 2.. `terraform plan -detailed-exitcode` returns exit code 2 when there are any changes, including destructive changes. While it does not specifically detect only destructive changes, failing on any changes ensures that destructive changes are caught before apply, which is a common safety practice in CI/CD pipelines. Options A, B, and C are incorrect because A requires applying changes first, B does not detect changes, and C would actually destroy resources.

Answer

Run terraform apply and parse the output for destroy messages.

Answer

Run terraform validate and check output for errors.

Answer

Run terraform destroy --target and fail if any resources are destroyed.

Question 3

What is the primary purpose of 'terraform init'?

Accepted Answer

To initialize the working directory, download providers, and set up the backend.. The 'terraform init' command is the first step in the core Terraform workflow. Its primary purpose is to initialize the working directory containing Terraform configuration files, download and install the required provider plugins (e.g., AWS, Azure, GCP), and configure the backend (e.g., local, S3, Terraform Cloud) for state storage. Without running 'terraform init', subsequent commands like 'terraform plan' or 'terraform apply' will fail because the providers and backend are not set up.

Answer

To format the Terraform configuration files.

Answer

To apply changes to the infrastructure.

Answer

To preview infrastructure changes before applying them.

Question 4

A developer wants to use Terraform in a CI pipeline where the pipeline runs on pull requests. They need to preview infrastructure changes without applying them. Which command should be used?

Accepted Answer

terraform plan. `terraform plan` creates an execution plan that shows what actions Terraform will take to change infrastructure to match the configuration, without actually applying any changes. This is the standard command for previewing infrastructure changes in a CI pipeline triggered by pull requests, enabling developers to review proposed modifications before merging.

Answer

terraform validate

Answer

terraform init

Answer

terraform apply

Question 5

Which TWO of the following are valid ways to reference a resource attribute in Terraform?

Accepted Answer

`module.vpc.vpc_id`. `module.vpc.vpc_id` directly references an output attribute from a module. In Terraform, module outputs are accessed using the syntax `module..`, and `vpc_id` is a common output from VPC modules that exposes the ID of the created VPC resource.

Answer

`module.vpc.output`

Answer

`data.aws_ami.ubuntu.id`

Answer

`var.instance_type`

Question 6

An organization has a multi-cloud strategy using Terraform. They need to ensure that secrets such as API keys are not stored in plaintext in the configuration files. Which Terraform feature should they use to securely manage sensitive data?

Accepted Answer

Integration with a secrets management tool like Vault. Integrating Terraform with a dedicated secrets management tool like HashiCorp Vault allows sensitive data (e.g., API keys, passwords) to be stored securely and retrieved at runtime via data sources, rather than being hardcoded in plaintext in configuration files. This approach ensures secrets are never written to disk in plaintext, are encrypted in transit and at rest, and can be dynamically rotated without modifying Terraform code.

Answer

Terraform variable definitions with environment variables

Answer

Terraform workspaces

Answer

Terraform state file encryption

Answer

Terraform's sensitive parameter in output blocks

Question 7

A developer wants to conditionally create a resource based on a variable that is a boolean. Which syntax should they use?

Accepted Answer

Use 'count = var.create ? 1 : 0'. In Terraform, the `count` meta-argument accepts a number, and the ternary expression `var.create ? 1 : 0` evaluates to 1 (true) to create one instance of the resource or 0 (false) to create none. This is the standard pattern for conditionally creating a single resource based on a boolean variable.

Answer

Use 'if var.create' inside the resource block

Answer

Use 'for_each = var.create ? [1] : []'

Answer

Use 'count = var.create'

Question 8

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 9

An operator wants to test an expression used in a Terraform configuration without running a plan or apply. Which command allows interactive evaluation of expressions?

Accepted Answer

terraform console. The `terraform console` command opens an interactive Read-Eval-Print Loop (REPL) that allows operators to evaluate Terraform expressions, including interpolations and functions, using the current state and configuration without executing a plan or apply. This is the only command designed specifically for ad-hoc expression testing in a live context.

Answer

terraform validate

Answer

terraform plan -out=test.tfplan

Answer

terraform output

Question 10

A module requires an input variable named 'vpc_id'. How should the calling configuration pass the VPC ID from another module's output?

Accepted Answer

vpc_id = module.vpc.vpc_id. In Terraform, when you need to reference an output from a child module, the syntax is `module..`. The `.outputs.` prefix is not used; Terraform automatically exposes module outputs as direct attributes of the module resource. Therefore, `module.vpc.vpc_id` correctly retrieves the `vpc_id` output from the module named `vpc`.

Answer

vpc_id = module.vpc.outputs.vpc_id

Answer

vpc_id = var.vpc_id

Answer

vpc_id = vpc.module.vpc_id

Question 11

A team wants to use Terraform to provision infrastructure across multiple cloud providers. Which configuration approach best supports this goal?

Accepted Answer

Define multiple provider blocks, one for each cloud provider.. Terraform uses multiple provider blocks to manage resources from different cloud providers within a single configuration. Each provider block configures a separate provider (e.g., aws, azurerm, google) with its own authentication and region settings, allowing Terraform to provision and manage infrastructure across AWS, Azure, GCP, and others in the same state file and execution plan.

Answer

Use a single provider block that supports multiple clouds.

Answer

Terraform cannot manage multiple clouds in one configuration.

Answer

Create separate workspaces for each cloud provider.

Question 12

A Terraform configuration uses `count` to create multiple EC2 instances. After adding a new variable for instance type, the user runs `terraform plan` and sees that all instances are marked for recreation. What is the most likely cause?

Accepted Answer

The variable change triggers a new value for each resource, causing Terraform to see differences. When you change a variable that is referenced within a resource's configuration (such as `instance_type`), Terraform sees a diff between the current state and the new configuration for every resource created by `count`. Since `count` resources are identified by their index in the state, and the new variable value changes the desired configuration for each instance, Terraform plans to recreate all of them to apply the new instance type.

Answer

The `count` index changed, causing all resources to be re-indexed

Answer

The user forgot to run `terraform refresh` after changing the variable

Answer

The state file is corrupt and needs to be refreshed

Answer

The provider version is incompatible with the new variable type

Question 13

A user wants to see the current state of resources in a human-readable format without making changes. Which command should they use?

Accepted Answer

terraform show. `terraform show`, is correct because it displays the current state of managed resources in a human-readable format (defaulting to plain text) without making any changes. This command reads the state file directly and presents its contents, making it ideal for inspection and debugging. Unlike `terraform plan`, it does not generate an execution plan or propose modifications.

Answer

terraform output

Answer

terraform state list

Answer

terraform plan

Question 14

Which TWO of the following are valid strategies to migrate Terraform state from a local backend to a remote backend?

Accepted Answer

Manually copy the local state file to the remote backend storage. The valid strategies for migrating state from local to remote backend are: manually copying the state file to the remote location (B) or using `terraform init -migrate-state` (D). Option C is incorrect because `terraform init -reconfigure` only reconfigures the backend without migrating the existing state.

Answer

Use terraform import for each resource

Answer

Change backend configuration and run terraform init -reconfigure

Answer

Use the terraform state push command

Question 15

A developer wants to use a module from the Terraform Registry in their configuration. Which block is required in the root module?

Accepted Answer

module "my-module" { source = "..." }. To use a module from the Terraform Registry, you must declare a `module` block in your root configuration. The `source` argument inside that block specifies the module's location (e.g., a registry path like `hashicorp/consul/aws`). This is the only way Terraform knows to fetch, version, and instantiate the module's resources.

Answer

resource "my-module" { ... }

Answer

provider "my-module" { source = "..." }

Answer

data "my-module" { ... }