TF-004 Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. After importing an AWS instance, the state file shows the resource. However, the configuration file (main.tf) does not yet contain the resource definition. What will happen when 'terraform plan' is run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It will show a plan to destroy the resource because it exists in state but not in configuration.. Terraform plan compares the state to the configuration. Since the resource exists in state but not in configuration, Terraform will plan to destroy the resource because it is no longer managed (configuration is the source of truth for what should exist).

Answer

It will show a plan to create the resource because the configuration is missing.

Answer

It will error because the configuration and state are out of sync.

Answer

It will show no changes because the resource is already in state.

Question 2

A team uses Terraform to manage multiple environments (dev, staging, prod) with a shared networking module. The module defines a variable 'cidr_block' with no default. In the root module, they have a file dev.tfvars containing 'cidr_block = "10.0.0.0/16"'. When running 'terraform plan' while in the dev workspace, they receive: 'Error: No value for required variable cidr_block'. They have already run 'terraform init' and confirmed the workspace is 'dev'. What is the most likely cause and correct action?

Accepted Answer

They forgot to include the -var-file flag; add -var-file='dev.tfvars' to the plan command.. The error indicates that the required variable 'cidr_block' has no value. Terraform does not automatically load .tfvars files; they must be explicitly specified with the -var-file flag. Since the team is in the 'dev' workspace but did not include '-var-file=dev.tfvars', the variable file is ignored. Option A correctly fixes this by adding the flag. Option B is incorrect because 'module.cidr_block' is not a valid reference; variables are passed to modules via module block inputs, not by referencing the variable name directly. Option C is incorrect because the workspace is confirmed as 'dev'. Option D is incorrect because the variable is already defined in the module; the issue is that the .tfvars file is not being loaded, not that the module input is missing.

Answer

The variable is defined in the child module; they need to reference it with module.cidr_block in the root module.

Answer

The workspace is not selected; run 'terraform workspace select dev' again.

Answer

The variable must be passed through the module block; they should add a module input assignment.

Question 3

Refer to the exhibit. A developer creates a new Terraform configuration with this backend block and runs terraform init. What will happen?

Accepted Answer

Terraform will return an error and fail to initialize.. The backend block is missing required arguments (like bucket and region). Terraform will return an error during initialization and will not proceed.

Answer

Terraform will initialize with a local backend because the remote backend configuration is incomplete.

Answer

Terraform will use default values for the missing arguments and initialize successfully.

Answer

Terraform will prompt the developer interactively for the missing arguments.

Question 4

A DevOps team accidentally deleted their Terraform state file. The actual infrastructure (EC2 instances, security groups, etc.) is still running and unchanged. They have the Terraform configuration files that were used to create the infrastructure. They want to re-establish management of the existing infrastructure without recreating it. Which course of action aligns with Terraform's purpose?

Accepted Answer

Use terraform import for each resource to bring them into the state file.. Terraform's purpose includes managing existing infrastructure through import. Using terraform import allows you to bring resources into state without recreation. Deleting and recreating is disruptive, and modifying config without state is risky.

Answer

Delete all existing infrastructure and run terraform apply to recreate it.

Answer

Manually edit the configuration to match the existing resources exactly, then run terraform apply.

Answer

Run terraform plan to generate a new state file automatically.

Question 5

During a terraform apply, the process crashes mid-way. The state file may be in an inconsistent state. What is the first recommended step to recover?

Accepted Answer

Run terraform plan.. Terraform plan will show the current state and pending changes, allowing you to diagnose the situation. Option A is wrong because force-unlock is only for lock issues, not state inconsistency. Option B is wrong because re-running apply may fail again or cause further issues. Option D is wrong because terraform destroy would remove all resources, not just the half-created ones.

Answer

Run terraform force-unlock.

Answer

Run terraform apply with -auto-approve.

Answer

Run terraform destroy.

Question 6

A team has been managing their AWS infrastructure using a collection of Bash scripts that create resources in a specific order. They frequently encounter issues where resources are created out of order or not properly cleaned up. They want to adopt a more reliable approach that ensures consistent provisioning and teardown. Which action best aligns with Terraform's purpose?

Accepted Answer

Convert the scripts into Terraform configuration files and use remote state.. Terraform's purpose is to manage infrastructure declaratively, handling dependencies and state. Converting to Terraform configs and using the plan/apply workflow ensures consistent provisioning. Continuing with scripts or using Ansible for provisioning are less effective.

Answer

Continue using the Bash scripts but add more error handling.

Answer

Use Terraform but only store state locally on the lead engineer's machine.

Answer

Rewrite the scripts as Ansible playbooks for provisioning.

Question 7

A company uses AWS CloudFormation for AWS resources and Azure Resource Manager for Azure resources. They want to standardize on a single tool that can manage resources across both clouds with a consistent workflow and support for infrastructure as code. They also want to ensure that their infrastructure can be version-controlled and reviewed. Which approach best fulfills Terraform's purpose?

Accepted Answer

Use Terraform with the AWS and Azure providers to manage all resources.. Terraform is purpose-built for multi-cloud infrastructure as code with a unified declarative language. Using separate tools per cloud increases complexity. Terraform's provider model allows managing both AWS and Azure in the same configuration.

Answer

Use a custom Python script that calls both cloud APIs.

Answer

Continue using CloudFormation for AWS and Resource Manager for Azure.

Answer

Migrate all resources to a single cloud provider to simplify management.

Question 8

A developer is new to infrastructure as code and wants to deploy a simple web server on AWS using a tool that allows them to define the infrastructure in a reusable and version-controlled manner. They are considering using the AWS Management Console, AWS CLI, or Terraform. Which course of action aligns best with Terraform's purpose?

Accepted Answer

Use Terraform to define the web server in a .tf file and run terraform apply.. Terraform is designed for infrastructure as code, allowing declarative configuration, version control, and automation. The console is manual, CLI is imperative and not idempotent. Terraform's purpose is to provision infrastructure as code.

Answer

Use the AWS Management Console to manually create the web server.

Answer

Write a shell script using the AWS CLI to provision resources.

Answer

Use Terraform but only with local state and no version control.

Question 9

An organization uses Terraform Cloud workspaces to manage multiple environments. They notice that after promoting a configuration change from development to production workspace, the production workspace's state file contains references to resources that were only created in development. What is the most likely cause?

Accepted Answer

The user ran `terraform state mv` to move resource instances from development to production workspace.. The `terraform state mv` command can move resource instances from one workspace's state file to another, which explains why production state contains references to development resources. Option A (same backend/prefix) could cause state corruption but would not selectively move resources. Option C is unlikely and error-prone. Option D would allow reading outputs but not modify production state.

Answer

The workspaces were configured to use the same S3 backend and prefix, causing state overlap.

Answer

A user manually edited the production state file to include development resources.

Answer

The development workspace's output values were used in production via `terraform_remote_state`.

Question 10

Refer to the exhibit. After running terraform apply, the output shows:

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

instance_id = "i-1234567890abcdef0"

However, the engineer notices that the instance type is t2.micro, but the expected instance type was t2.medium. What is the most likely reason for this discrepancy?

Accepted Answer

The configuration file specified t2.micro, so Terraform created the instance accordingly.. The configuration explicitly sets instance_type to t2.micro, so Terraform will use that value. The engineer may have expected a different value but the configuration is authoritative.

Answer

The engineer applied a different configuration file by mistake.

Answer

Terraform ignored the instance_type argument because it is not supported for the given AMI.

Answer

The instance_type was overridden by a default value in the provider.

Question 11

What is the most likely cause of this error?

Accepted Answer

The module source path does not exist.. The error message indicates that the module source path does not exist. Terraform cannot find the specified local path for the module. Option A is incorrect because version constraints are not required for local module sources; they are used for registry modules. Option C is incorrect because the `required_version` setting in Terraform configuration controls the Terraform version, not module sourcing. Option D is incorrect because the error is about locating the module source, not about an undefined input variable.

Answer

The module requires a version constraint.

Answer

The required_version is incompatible with the module.

Answer

The module input variable 'vpc_id' is not defined in the module.

Question 12

A team uses an S3 backend for Terraform state. During a `terraform apply`, another team member accidentally runs a plan that also modifies the same state. Which feature prevents state corruption in this scenario?

Accepted Answer

State locking via DynamoDB. State locking via DynamoDB prevents concurrent modifications to the state file, ensuring that only one operation can modify the state at a time. Option A (-lock=false) disables locking, which would allow concurrent modifications and risk corruption. Option B (Terraform Cloud remote operations) is not directly related to state locking in this S3 backend scenario. Option D (state versioning) helps recover from corruption but does not prevent simultaneous writes.

Answer

The `-lock=false` flag

Answer

Terraform Cloud remote operations

Answer

State versioning in S3

Question 13

Refer to the exhibit. An engineer runs the commands shown in sequence. After executing 'terraform state rm', the next 'terraform plan' shows that the resource will be created. What is the most likely reason?

Accepted Answer

The 'terraform state rm' command only removes the resource from the state file, not the actual infrastructure. The next plan sees the configuration and attempts to create a new resource.. The 'terraform state rm' command removes the resource from the state file but does not destroy the actual infrastructure. The resource still exists in AWS. The next 'terraform plan' sees that the resource is not in state but the configuration still exists, so it plans to create a new resource with the same configuration.

Answer

The 'terraform state rm' command triggers an automatic recreation of the resource.

Answer

The resource was destroyed by a separate process.

Answer

The state file was corrupted after removal.

Question 14

A company wants to integrate Terraform with their CI/CD pipeline to automatically deploy infrastructure. Which Terraform feature should they use to ensure state files are stored securely and accessible by the pipeline?

Accepted Answer

Terraform Cloud remote state. Using a remote state backend (like Terraform Cloud) ensures state is stored securely and can be accessed by pipeline runs. Local state with .gitignore is not secure or accessible. Terraform import is for adding existing resources, not state storage. terraform state push is used to manually upload state.

Answer

Terraform import

Answer

Local state with .gitignore

Answer

terraform state push

Question 15

Refer to the exhibit. An engineer receives this error when running terraform apply. What is the most likely cause?

Accepted Answer

The Action element should be an array, not a string.. The error indicates a malformed policy JSON. In IAM policy syntax, the `Action` element must be an array of strings, even if only one action is specified. The provided policy has `"Action": "ec2:DescribeInstances"` (a string), which is invalid; it should be `"Action": ["ec2:DescribeInstances"]`. This is the most likely cause of the error.

Answer

The policy JSON is missing a required field like "Sid".

Answer

The Resource ARN is incorrect because it lacks a region.

Answer

The policy exceeds the maximum size limit.