TF-004 Practice Test 18 — 15 Questions

Question 1

A developer runs `terraform apply` and gets the error: 'Error: No configuration files'. What is the most likely cause?

Accepted Answer

The working directory does not contain any `.tf` files. The error 'No configuration files' occurs when Terraform cannot find any `.tf` files in the current working directory. Terraform requires at least one configuration file with a `.tf` extension to define resources, data sources, or providers. Without these files, Terraform has no instructions to execute, so it fails immediately during the initialization or planning phase.

Answer

The state file is missing

Answer

The user does not have permissions to read the directory

Answer

The provider plugin is not installed

Answer

The backend configuration is incomplete

Question 2

Refer to the exhibit. An engineer runs terraform plan and sees this output. Which statement about the planned change is true?

Accepted Answer

The change will replace the existing ingress rule with a new one.. The plan output shows a -/+ next to the ingress rule, indicating that Terraform will destroy the existing rule and create a new one with the updated CIDR block. This replacement occurs because the `cidr_blocks` attribute change for an ingress rule forces resource recreation. Thus, the existing ingress rule is replaced with a new one, matching option A.

Answer

The security group will be destroyed and recreated.

Answer

Terraform will add a new ingress rule without removing the old one.

Answer

The security group will be updated but the ingress rule will remain unchanged.

Question 3

An organization uses Terraform with multiple workspaces to manage different environments (dev, staging, prod). They want to ensure that sensitive variables for prod are not exposed in the plan output. What should they do?

Accepted Answer

Mark the variable as `sensitive = true` in the variable definition. Marking a variable as `sensitive = true` in the variable definition prevents Terraform from displaying its value in CLI output, including plan and apply summaries. This is the direct and intended mechanism to protect sensitive data from exposure during Terraform operations, without affecting how the variable is stored or used.

Answer

Use an output block to display the variable only when needed

Answer

Store the variable in the state file

Answer

Store the variable in an environment variable instead of a .tfvars file

Answer

Use a data source to retrieve the secret at runtime

Question 4

Which TWO of the following commands can be used to read and inspect the current Terraform state? (Select TWO.)

Accepted Answer

terraform state show. `terraform state show` is correct because it displays the attributes and metadata of a specific resource within the Terraform state file, allowing you to inspect the current state of that resource. `terraform state list` is correct because it lists all resources tracked in the state file, providing a high-level overview of what Terraform is managing. Both commands directly read and inspect the state without modifying it.

Answer

terraform validate

Answer

terraform output

Answer

terraform plan

Question 5

Which THREE of the following are best practices for Terraform state management?

Accepted Answer

Use workspaces to manage different environments.. Terraform workspaces allow you to manage multiple distinct state files for the same configuration, enabling environment separation (e.g., dev, staging, prod) without duplicating code or backends. Each workspace maintains its own state, preventing cross-environment interference and simplifying infrastructure lifecycle management.

Answer

Manually edit state files to fix configuration drift.

Answer

Commit state files to version control.

Question 6

Refer to the exhibit. A developer updates the network state and runs terraform apply. The aws_instance.web is not recreated. Which statement explains this behavior?

Accepted Answer

The instance resource does not reference the remote state data source, so changes to the remote state do not trigger recreation.. The data source data.terraform_remote_state.network is read during planning and is not stored in state. If the remote state changes, Terraform will see the new vpc_id and may update the security group, but the instance resource does not depend on the remote state, so it is not affected.

Answer

Terraform automatically locks the remote state to prevent changes during apply.

Answer

The security group resource depends on the remote state, and it was updated, but the instance was not affected.

Answer

The remote state data source is cached and only refreshes every hour.

Question 7

Which TWO of the following are true about Terraform workspaces?

Accepted Answer

The default workspace is named 'default'. The default workspace is named 'default'. Option E is correct because each Terraform workspace maintains its own separate state file, allowing state isolation for different environments. Option A is incorrect because workspaces do not manage provider configurations; they only separate state. Option B is false because each workspace has its own state file, not shared. Option C is false because the default workspace cannot be deleted.

Answer

Workspaces can be used to manage different provider configurations

Answer

All workspaces share the same state file

Answer

The default workspace can be deleted

Question 8

A team uses Terraform to manage infrastructure in AWS. They have a single workspace and store state in an S3 bucket with DynamoDB locking. After a recent apply, the state file became corrupted due to a network interruption during the state write. The team needs to recover the state and prevent future corruption. They have not enabled any backup or versioning. What should they do?

Accepted Answer

Delete the state file and run terraform import for all resources.. Since versioning was not enabled before the corruption, no previous state versions exist in S3. Enabling it now (Option A) does not recover the corrupted state. `terraform state pull` retrieves the *current* state, not a previous version, making Option A ineffective. Manually editing the S3 state (C) is risky and discouraged. `force-unlock` (B) only releases the lock without fixing corruption. Deleting the corrupted state and running `terraform import` for all resources (D) is the only reliable way to recover when no backup is available, though it requires knowing all resource IDs. After recovery, enable S3 versioning and DynamoDB point-in-time recovery to prevent future incidents.

Answer

Enable S3 bucket versioning and DynamoDB point-in-time recovery, then use terraform state pull to retrieve a previous state version.

Answer

Use terraform force-unlock to release the lock and reapply the configuration.

Answer

Manually edit the state file in S3 to fix the corruption.

Question 9

A DevOps team manages Terraform configurations for a multi-environment infrastructure (dev, staging, prod). They maintain a central repository of reusable modules stored in a Git repository. Developers often update modules in the master branch to add features or fix bugs. Recently, after a developer updated the 'vpc' module in the master branch, the staging environment's infrastructure was destroyed and recreated during a terraform apply, causing an outage. The team needs to prevent such unintended changes across environments. They currently reference modules using the source argument with a git URL pointing to the master branch: source = "git::https://github.com/org/terraform-modules//vpc?ref=master". The team is looking for a solution that allows controlled updates and ensures each environment uses a fixed version of a module until explicitly upgraded.

Accepted Answer

Use module version constraints in the configuration, such as source = "git::https://github.com/org/terraform-modules//vpc?ref=v1.0.0" and update the ref tag when ready.. Referencing a specific Git tag (e.g., v1.0.0) ensures that each environment uses a fixed version of the module until the tag is explicitly updated. This prevents unintended changes from the master branch affecting environments. Option B is incorrect because separate branches can still receive updates that may cause unintended changes; it does not solve the version pinning problem. Option C is incorrect because Terragrunt is an additional tool that manages dependencies but does not inherently enforce module version pinning without additional configuration, and it adds complexity. Option D is incorrect in this context because the team already uses a Git repository; migrating to the Terraform Registry is not an immediate solution and may not be feasible, whereas using Git tags is a straightforward native approach.

Answer

Create separate Git branches for each environment and reference the branch in the module source.

Answer

Use Terragrunt to manage module dependencies and lock versions.

Answer

Use the Terraform Registry to host modules with semantic versioning and pin versions.

Question 10

Which TWO of the following are valid ways to use Terraform outside the core workflow (i.e., in automation or CI/CD pipelines)?

Accepted Answer

Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.. The Terraform CLI's `-auto-approve` flag is designed for non-interactive environments like CI/CD pipelines, allowing automated execution of `terraform apply` after a successful plan without manual confirmation. This bypasses the interactive approval step, making it suitable for automation where human input is not possible.

Answer

Using 'terraform state mv' to reorganize state files.

Answer

Using 'terraform init -from-module' to force module re-download.

Answer

Using 'terraform graph' to generate visual output.

Question 11

A user runs 'terraform plan' and it shows 'No changes. Infrastructure is up-to-date.' However, the user knows they added a new resource block to the configuration. What could explain this?

Accepted Answer

The resource block has a count parameter set to 0.. When a resource block has `count = 0`, Terraform evaluates the count meta-argument and determines that zero instances of that resource should be created. As a result, the resource is effectively absent from the state, and `terraform plan` sees no changes because there is nothing to add, modify, or remove. This is a common cause of a 'No changes' result despite adding a new resource block.

Answer

The resource block is inside an output block.

Answer

The user ran terraform validate before plan.

Answer

The resource block was added after running terraform fmt.

Question 12

Refer to the exhibit. A user runs terraform init and receives an error about state data content. The state file in S3 has not been manually modified. What is the most likely cause?

Accepted Answer

The state file was written by a different Terraform workspace.. The error indicates that the state file content does not match what Terraform expects. This can happen when the state file has a different serial number (e.g., if another process wrote to it) or if the state file is corrupted. However, since the user hasn't manually modified it, the most likely cause is that the state file was modified by a different Terraform process (perhaps from another workspace or different version) that changed the state structure. Option D is correct because a conflicting workspace can write state with a different serial, causing the error.

Answer

The S3 bucket policy denies access to the state file.

Answer

Terraform version mismatch between local and state file.

Answer

The state file is locked by another process.

Question 13

Which two commands are part of the standard Terraform workflow for provisioning infrastructure?

Accepted Answer

terraform init. `terraform init` is correct because it initializes a working directory containing Terraform configuration files, downloading the required providers and modules. `terraform apply` is correct because it executes the actions proposed in a Terraform plan to provision or change infrastructure resources. These two commands form the core of the standard workflow: initialize, plan, and apply.

Answer

terraform fmt

Answer

terraform import

Answer

terraform taint

Question 14

A company manages multiple AWS accounts using Terraform. They have a central repository where all Terraform configurations are stored. Recently, a developer accidentally ran terraform destroy on a production workspace and deleted critical resources. The team wants to implement safeguards to prevent such incidents while still allowing developers to test changes in non-production environments. They currently use Terraform Cloud for remote state management and runs. Which course of action should the team take to minimize risk?

Accepted Answer

Implement run tasks in Terraform Cloud that require approval for any destroy operation on workspaces tagged as 'production'.. Terraform Cloud run tasks can enforce approval workflows for destroy operations on production workspaces, providing a safeguard against accidental deletions while still allowing developers to test in non-production environments. Option A is wrong because storing state locally is insecure and eliminates the benefits of remote state management. Option B is wrong because `prevent_destroy` blocks all destroy operations, including intentional ones, and is not a flexible safeguard. Option D is wrong because removing API access entirely is too restrictive and hinders legitimate operations; instead, proper permissions and approval workflows should be used.

Answer

Store the production Terraform state file locally and restrict access to it.

Answer

Use Terraform's built-in lifecycle prevent_destroy on all production resources.

Answer

Remove all developers' access to the Terraform Cloud API and only allow operations via pull requests.

Question 15

Match each Terraform provisioner to its typical use case.

Accepted Answer

file: Copies files or directories to the remote machine.. The correct matches are: file provisioner for copying files to the remote machine, remote-exec for running commands on the remote machine, and local-exec for running commands locally. Common confusions include swapping the roles of file and remote-exec.

Answer

file: Runs commands on the remote resource.

Answer

remote-exec: Copies files to the local machine.