TF-004 Practice Test 17 — 15 Questions

Question 1

A user wants to inspect the current attributes of a specific resource in the Terraform state. Which command should they use?

Accepted Answer

terraform state show . The `terraform state show ` command is specifically designed to inspect the current attributes of a single resource within the Terraform state file. It reads the state directly and outputs the resource's attributes in a human-readable format, making it the correct tool for this task.

Answer

terraform state list <resource>

Answer

terraform output

Answer

terraform plan

Answer

terraform show

Question 2

Which three practices help maintain consistency and reduce configuration drift in IaC? (Choose three.)

Accepted Answer

Storing state files remotely and locking them. Storing state files remotely (e.g., in an S3 bucket with DynamoDB locking) prevents concurrent modifications and ensures that the state file reflects the true infrastructure state. This practice eliminates the risk of conflicting changes and configuration drift caused by local or stale state files.

Answer

Using manual changes to fix minor issues

Answer

Allowing multiple team members to run apply simultaneously

Question 3

A user receives the error shown in the exhibit when running `terraform init`. The user is behind a corporate proxy. Which environment variable should be set to resolve this issue?

Accepted Answer

HTTP_PROXY=http://proxy:8080. Terraform uses the standard `HTTP_PROXY` environment variable to route HTTP/HTTPS requests through a corporate proxy when downloading providers and modules. Setting `HTTP_PROXY=http://proxy:8080` instructs Terraform's underlying HTTP client to connect via the specified proxy, resolving the connectivity error during `terraform init`.

Answer

TF_VAR_proxy=http://proxy:8080

Answer

AWS_ACCESS_KEY_ID

Answer

TF_LOG=DEBUG

Question 4

During development, a Terraform user wants to check that their configuration is syntactically valid and internally consistent before running 'terraform plan'. Which command should they use?

Accepted Answer

terraform validate. The `terraform validate` command checks that a Terraform configuration is syntactically valid and internally consistent, such as verifying that resource names are unique and that references to other resources or data sources are correctly formed. It runs without requiring any cloud provider credentials or state, making it ideal for early-stage validation before `terraform plan`.

Answer

terraform init

Answer

terraform refresh

Answer

terraform fmt

Question 5

Which three of the following are true regarding Terraform state?

Accepted Answer

State can be stored in a local file or remotely.. Terraform state is the mechanism by which Terraform maps real-world resources to your configuration, and it can be stored either in a local file (e.g., terraform.tfstate) or remotely in a backend such as S3, Azure Storage, or Terraform Cloud. This flexibility allows teams to share state and enable collaboration, while local storage is suitable for single-user or testing scenarios.

Answer

State can be manually edited with a text editor without risk.

Answer

State must be stored in a file named terraform.tfstate.

Question 6

Which three characteristics are associated with immutable infrastructure as practiced by Terraform?

Accepted Answer

New versions are deployed by creating new instances. Immutable infrastructure in Terraform involves deploying new versions by creating entirely new instances rather than modifying existing ones. This aligns with Terraform's resource lifecycle, where changes to certain attributes trigger destruction and recreation, ensuring a consistent and reproducible state.

Answer

Configuration drift is accepted

Answer

In-place updates are preferred

Question 7

Which THREE of the following are necessary steps to configure OIDC (OpenID Connect) for authenticating Terraform in a CI/CD pipeline?

Accepted Answer

Set up an OIDC provider in the target cloud (e.g., AWS IAM OIDC provider).. To authenticate Terraform in a CI/CD pipeline using OIDC, you must first establish trust between the CI platform and the cloud provider by creating an OIDC identity provider (e.g., an AWS IAM OIDC provider). This provider validates the JSON Web Token (JWT) issued by the CI platform (e.g., GitHub Actions, GitLab CI) and maps it to an IAM role, enabling token-based authentication without long-lived secrets.

Answer

Generate a long-lived API token and store it as a secret.

Answer

Configure remote backend with static credentials.

Question 8

Which TWO of the following are required when configuring a Terraform backend for remote state storage?

Accepted Answer

A backend type (e.g., s3, azurerm, gcs). Every Terraform backend configuration must specify a backend type (e.g., s3, azurerm, gcs) to define where state is stored. Option E is correct because authentication credentials are required to access the remote backend; without valid credentials, Terraform cannot read or write state to the configured storage location.

Answer

Encryption at rest configuration

Answer

State locking support

Answer

Workspace configuration

Question 9

Which TWO statements about Terraform data sources are correct?

Accepted Answer

Data sources can be used in count and for_each.. Terraform data sources are regular resources that support the `count` and `for_each` meta-arguments, allowing you to dynamically fetch data for multiple instances or conditional logic. This enables patterns like iterating over a list of external IDs to retrieve corresponding data from a provider, such as fetching multiple AMI IDs for different regions.

Answer

Data sources are only available after applying the configuration.

Answer

Data sources are used to create new infrastructure.

Answer

Data sources cannot be used inside modules.

Question 10

An organization uses Terraform modules to provision multiple environments. They have a module 'vpc' that uses a for_each argument in the root module to create VPCs per environment. Each VPC requires a unique CIDR block passed via variable. What is the best practice to pass different CIDRs per instance?

Accepted Answer

Define a map variable with environment names as keys and CIDRs as values, then pass the entire map to the module.. Using a map variable with environment names as keys and CIDRs as values allows Terraform's `for_each` to iterate over the map, creating one VPC per environment with its specified CIDR. This approach is clear, scalable, and maintains a direct key-value association. Option B (hardcoding) is not scalable and violates infrastructure as code best practices. Option C uses `count.index` and `element()` on a list, which works but is less explicit and can lead to errors if list order changes. Option D is irrelevant because module outputs are read after creation and cannot be used to define input CIDRs.

Answer

Hardcode the CIDR within each module block.

Answer

Use a list variable for CIDRs and reference them with count.index and element().

Answer

Use a module output to fetch the CIDR from a data source.

Question 11

You are a DevOps engineer at a company that uses Terraform to manage infrastructure in AWS. The team recently adopted Terraform Cloud for remote state management and collaboration. They have a single workspace named 'production' that manages all production resources. Currently, the state file is stored in Terraform Cloud's default backend. The team wants to implement a disaster recovery strategy where they can restore the state file if Terraform Cloud experiences an outage. They also want to ensure that state file backups are taken automatically before every apply. Which approach should they recommend?

Accepted Answer

Use Terraform Cloud's API to download the state file before each apply and store it in a secure S3 bucket with versioning enabled. It leverages the Terraform Cloud API to programmatically download the state file before each apply, storing it in a customer-managed S3 bucket with versioning enabled. This creates automatic, auditable backups independent of Terraform Cloud's availability, satisfying the disaster recovery requirement without changing the remote execution model. Options A and C are either manual or incompatible with Terraform Cloud's remote state management, and option B is not possible as Terraform Cloud does not expose its internal storage for replication.

Answer

Manually download the state file from Terraform Cloud UI after each apply

Answer

Enable S3 replication on Terraform Cloud's internal state storage

Answer

Switch to an S3 backend with DynamoDB locking and configure Terraform Cloud to run remotely but store state locally

Question 12

Which TWO scenarios require the use of the depends_on argument?

Accepted Answer

When a provisioner creates resources that other resources depend on.. When a provisioner (such as a local-exec or remote-exec) creates resources outside of Terraform's state, Terraform cannot automatically detect the dependency. The depends_on argument explicitly tells Terraform to wait for that provisioner-created resource before proceeding. Option C is correct because depends_on is the mechanism to declare a dependency when Terraform's resource graph analysis cannot infer an implicit dependency from attribute references.

Answer

When a resource uses the output of another resource in its arguments.

Answer

When a resource uses the output of a data source in its arguments.

Answer

When a resource uses a module output as an input.

Question 13

Which TWO statements accurately describe the purpose of Terraform? (Choose two.)

Accepted Answer

Terraform allows users to define infrastructure resources in a declarative configuration language.. Terraform uses HashiCorp Configuration Language (HCL) to define infrastructure as code in a declarative manner, meaning users specify the desired end state of resources without scripting the step-by-step process. This declarative approach allows Terraform to automatically determine the necessary actions to reach that state, making infrastructure management predictable and repeatable.

Answer

Terraform is designed to work exclusively with AWS.

Answer

Terraform is a configuration management tool used for installing software on existing servers.

Answer

Terraform is a continuous integration and deployment tool.

Question 14

A team manages a multi-tier application consisting of web servers, application servers, and databases deployed across AWS and Azure. Historically, they have provisioned infrastructure manually using cloud consoles and ad-hoc scripts. To improve consistency and reduce errors, they decide to adopt Terraform for Infrastructure as Code. After initial rollout, they encounter problems: some team members still make direct changes via the cloud console to quickly fix issues, causing configuration drift between the Terraform state and actual resources. They also need to manage three distinct environments (development, staging, production) with different configurations (e.g., instance sizes, database settings). The team consists of five people with a limited budget for additional tools. Which course of action best addresses these challenges while adhering to IaC principles?

Accepted Answer

Implement a CI/CD pipeline that runs terraform plan and apply automatically on merges to the main branch, and use Terraform Cloud's Sentinel policies to prevent drift.. Best addresses both challenges. Implementing a CI/CD pipeline that runs terraform plan and apply automatically on merges to the main branch ensures all infrastructure changes are made through version-controlled Terraform configurations, preventing configuration drift from manual console changes. Using Terraform Cloud's Sentinel policies adds an additional layer of governance to enforce compliance and prevent unauthorized changes. This approach also naturally supports environment management because different branches or configurations can represent the three environments (development, staging, production), and the pipeline can target different remote backends or workspaces. Option A (shared S3 with DynamoDB locking) improves state management and collaboration but does not prevent drift from direct console changes. Option B (workspaces and IAM policies) can help with environment separation and restrict console changes, but local applies still risk drift and the IAM approach may be overly restrictive. Option C (provider aliases) is not designed for environment management and manual planning does not prevent drift.

Answer

Store Terraform state in a shared S3 bucket with DynamoDB locking, and have each team member apply their own changes locally after review.

Answer

Use Terraform workspaces to manage environments and enforce that all changes go through version-controlled Terraform configs, disabling direct console changes via IAM policies.

Answer

Assign each environment to a different Terraform provider alias and use manual planning to ensure correctness.

Question 15

Which TWO of the following are benefits of using Terraform Cloud Run Tasks?

Accepted Answer

Integrate with third-party tools for security scanning.. Terraform Cloud Run Tasks allow integration with third-party tools for security scanning, policy enforcement, or other validations during the plan/apply lifecycle. This is achieved by configuring run tasks that call external services via webhooks, enabling automated checks before provisioning proceeds.

Answer

Simplify state management by offloading to Terraform Cloud.

Answer

Provide an approval gate for manual intervention.

Answer

Automatically reduce costs by identifying unused resources.