TF-004 Practice Test 17 — 15 Questions

Question 1

During development, a Terraform user wants to check that their configuration is syntactically valid and internally consistent before running 'terraform plan'. Which command should they use?

Accepted Answer

terraform validate. The `terraform validate` command checks that a Terraform configuration is syntactically valid and internally consistent, such as verifying that resource names are unique and that references to other resources or data sources are correctly formed. It runs without requiring any cloud provider credentials or state, making it ideal for early-stage validation before `terraform plan`.

Answer

terraform init

Answer

terraform refresh

Answer

terraform fmt

Question 2

A team uses Terraform to manage AWS resources. They want to ensure that a security group is created before an EC2 instance that references it. What is the best practice?

Accepted Answer

Use `depends_on` meta-argument. `depends_on` is the explicit meta-argument in Terraform that allows you to define a hard dependency between resources. While Terraform often infers implicit dependencies when one resource directly references an attribute of another (e.g., an EC2 instance referencing a security group's ID), there are scenarios where an explicit dependency is required to ensure correct ordering. This is particularly true when references are indirect (e.g., via a variable or data source) or when a non-obvious ordering is critical. In such cases, `depends_on` is the best practice to explicitly ensure the security group is created before the EC2 instance, preventing plan/apply errors.

Answer

Use `for_each` to iterate over resources

Answer

Use `count` to create the security group first

Answer

Use `provisioner` to wait for the security group

Answer

Use a data source to reference the security group

Question 3

Which three of the following are true regarding Terraform state?

Accepted Answer

State can be stored in a local file or remotely.. Terraform state is the mechanism by which Terraform maps real-world resources to your configuration, and it can be stored either in a local file (e.g., terraform.tfstate) or remotely in a backend such as S3, Azure Storage, or Terraform Cloud. This flexibility allows teams to share state and enable collaboration, while local storage is suitable for single-user or testing scenarios.

Answer

State can be manually edited with a text editor without risk.

Answer

State must be stored in a file named terraform.tfstate.

Question 4

Which three characteristics are associated with immutable infrastructure as practiced by Terraform?

Accepted Answer

New versions are deployed by creating new instances. Immutable infrastructure in Terraform involves deploying new versions by creating entirely new instances rather than modifying existing ones. This aligns with Terraform's resource lifecycle, where changes to certain attributes trigger destruction and recreation, ensuring a consistent and reproducible state.

Answer

Configuration drift is accepted

Answer

In-place updates are preferred

Question 5

Which THREE of the following are necessary steps to configure OIDC (OpenID Connect) for authenticating Terraform in a CI/CD pipeline?

Accepted Answer

Set up an OIDC provider in the target cloud (e.g., AWS IAM OIDC provider).. To authenticate Terraform in a CI/CD pipeline using OIDC, you must first establish trust between the CI platform and the cloud provider by creating an OIDC identity provider (e.g., an AWS IAM OIDC provider). This provider validates the JSON Web Token (JWT) issued by the CI platform (e.g., GitHub Actions, GitLab CI) and maps it to an IAM role, enabling token-based authentication without long-lived secrets.

Answer

Generate a long-lived API token and store it as a secret.

Answer

Configure remote backend with static credentials.

Question 6

Which TWO of the following are required when configuring a Terraform backend for remote state storage?

Accepted Answer

A backend type (e.g., s3, azurerm, gcs). Every Terraform backend configuration must specify a backend type (e.g., s3, azurerm, gcs) to define where state is stored. Option E is correct because authentication credentials are required to access the remote backend; without valid credentials, Terraform cannot read or write state to the configured storage location.

Answer

Encryption at rest configuration

Answer

State locking support

Answer

Workspace configuration

Question 7

Which TWO statements about Terraform data sources are correct?

Accepted Answer

Data sources can be used in count and for_each.. Terraform data sources are regular resources that support the `count` and `for_each` meta-arguments, allowing you to dynamically fetch data for multiple instances or conditional logic. This enables patterns like iterating over a list of external IDs to retrieve corresponding data from a provider, such as fetching multiple AMI IDs for different regions.

Answer

Data sources are only available after applying the configuration.

Answer

Data sources are used to create new infrastructure.

Answer

Data sources cannot be used inside modules.

Question 8

You are a DevOps engineer at a company that uses Terraform to manage infrastructure in AWS. The team recently adopted Terraform Cloud for remote state management and collaboration. They have a single workspace named 'production' that manages all production resources. Currently, the state file is stored in Terraform Cloud's default backend. The team wants to implement a disaster recovery strategy where they can restore the state file if Terraform Cloud experiences an outage. They also want to ensure that state file backups are taken automatically before every apply. Which approach should they recommend?

Accepted Answer

Use Terraform Cloud's API to download the state file before each apply and store it in a secure S3 bucket with versioning enabled. It leverages the Terraform Cloud API to programmatically download the state file before each apply, storing it in a customer-managed S3 bucket with versioning enabled. This creates automatic, auditable backups independent of Terraform Cloud's availability, satisfying the disaster recovery requirement without changing the remote execution model. Options A and C are either manual or incompatible with Terraform Cloud's remote state management, and option B is not possible as Terraform Cloud does not expose its internal storage for replication.

Answer

Manually download the state file from Terraform Cloud UI after each apply

Answer

Enable S3 replication on Terraform Cloud's internal state storage

Answer

Switch to an S3 backend with DynamoDB locking and configure Terraform Cloud to run remotely but store state locally

Question 9

Which TWO scenarios require the use of the depends_on argument?

Accepted Answer

When a provisioner creates resources that other resources depend on.. When a provisioner (such as a local-exec or remote-exec) creates resources outside of Terraform's state, Terraform cannot automatically detect the dependency. The depends_on argument explicitly tells Terraform to wait for that provisioner-created resource before proceeding. Option C is correct because depends_on is the mechanism to declare a dependency when Terraform's resource graph analysis cannot infer an implicit dependency from attribute references.

Answer

When a resource uses the output of another resource in its arguments.

Answer

When a resource uses the output of a data source in its arguments.

Answer

When a resource uses a module output as an input.

Question 10

Which TWO statements accurately describe the purpose of Terraform? (Choose two.)

Accepted Answer

Terraform allows users to define infrastructure resources in a declarative configuration language.. Terraform uses HashiCorp Configuration Language (HCL) to define infrastructure as code in a declarative manner, meaning users specify the desired end state of resources without scripting the step-by-step process. This declarative approach allows Terraform to automatically determine the necessary actions to reach that state, making infrastructure management predictable and repeatable.

Answer

Terraform is designed to work exclusively with AWS.

Answer

Terraform is a configuration management tool used for installing software on existing servers.

Answer

Terraform is a continuous integration and deployment tool.

Question 11

Which TWO of the following are benefits of using Terraform Cloud Run Tasks?

Accepted Answer

Integrate with third-party tools for security scanning.. Terraform Cloud Run Tasks allow integration with third-party tools for security scanning, policy enforcement, or other validations during the plan/apply lifecycle. This is achieved by configuring run tasks that call external services via webhooks, enabling automated checks before provisioning proceeds.

Answer

Simplify state management by offloading to Terraform Cloud.

Answer

Provide an approval gate for manual intervention.

Answer

Automatically reduce costs by identifying unused resources.

Question 12

A developer runs `terraform apply` and gets the error: 'Error: No configuration files'. What is the most likely cause?

Accepted Answer

The working directory does not contain any `.tf` files. The error 'No configuration files' occurs when Terraform cannot find any `.tf` files in the current working directory. Terraform requires at least one configuration file with a `.tf` extension to define resources, data sources, or providers. Without these files, Terraform has no instructions to execute, so it fails immediately during the initialization or planning phase.

Answer

The state file is missing

Answer

The user does not have permissions to read the directory

Answer

The provider plugin is not installed

Answer

The backend configuration is incomplete

Question 13

An organization uses Terraform with multiple workspaces to manage different environments (dev, staging, prod). They want to ensure that sensitive variables for prod are not exposed in the plan output. What should they do?

Accepted Answer

Mark the variable as `sensitive = true` in the variable definition. Marking a variable as `sensitive = true` in the variable definition prevents Terraform from displaying its value in CLI output, including plan and apply summaries. This is the direct and intended mechanism to protect sensitive data from exposure during Terraform operations, without affecting how the variable is stored or used.

Answer

Use an output block to display the variable only when needed

Answer

Store the variable in the state file

Answer

Store the variable in an environment variable instead of a .tfvars file

Answer

Use a data source to retrieve the secret at runtime

Question 14

Which TWO of the following commands can be used to read and inspect the current Terraform state? (Select TWO.)

Accepted Answer

terraform state show. `terraform state show` is correct because it displays the attributes and metadata of a specific resource within the Terraform state file, allowing you to inspect the current state of that resource. `terraform state list` is correct because it lists all resources tracked in the state file, providing a high-level overview of what Terraform is managing. Both commands directly read and inspect the state without modifying it.

Answer

terraform validate

Answer

terraform output

Answer

terraform plan

Question 15

Which THREE of the following are best practices for Terraform state management?

Accepted Answer

Use workspaces to manage different environments.. Terraform workspaces allow you to manage multiple distinct state files for the same configuration, enabling environment separation (e.g., dev, staging, prod) without duplicating code or backends. Each workspace maintains its own state, preventing cross-environment interference and simplifying infrastructure lifecycle management.

Answer

Manually edit state files to fix configuration drift.

Answer

Commit state files to version control.