TF-004 Practice Test 20 — 15 Questions

Question 1

Refer to the exhibit. After applying the plan, the state serial number is 2. What was the serial number before the apply?

Accepted Answer

1. The serial number increments by 1 each time state is modified. Initially the state had serial 1 (or 0 if fresh). After the apply adding one resource, serial becomes 2, so previous serial was 1.

Answer

0

Answer

3

Answer

2

Question 2

Which THREE of the following are valid methods to manage Terraform state in a team environment? (Choose three.)

Accepted Answer

Using a remote backend like S3 with DynamoDB locking. Options B, C, and E are all valid methods for managing Terraform state in a team environment. Option B uses a remote backend like S3 with DynamoDB locking to centralize state and prevent concurrent modifications. Option C leverages Terraform workspaces with a remote backend to isolate state for different environments while maintaining a single backend configuration. Option E uses Terraform Cloud, which provides a managed state backend with built-in locking and versioning, simplifying team collaboration. Option A is incorrect because version control systems lack state locking and can lead to corruption. Option D is incorrect because storing state locally on a network drive introduces consistency and locking issues, making it unsuitable for concurrent team access.

Answer

Storing state in a version control system

Answer

Storing state locally and sharing via network drive

Question 3

Refer to the exhibit. An engineer runs terraform state list and sees these resources. The engineer wants to remove the aws_eip.web_ip resource from state without destroying the actual resource. Which command should be used?

Accepted Answer

terraform state rm aws_eip.web_ip. To remove a resource from state without destroying it, use terraform state rm.

Answer

terraform destroy -target=aws_eip.web_ip

Answer

terraform refresh -target=aws_eip.web_ip

Answer

terraform import aws_eip.web_ip <id>

Question 4

What is the primary purpose of Terraform's state file?

Accepted Answer

Map configurations to real-world resources. The state file maps Terraform configurations to real-world resources, allowing Terraform to track resource metadata and detect drift.

Answer

Provide a GUI

Answer

Execute scripts

Answer

Store secrets

Question 5

A company uses Terraform with multiple workspaces (dev, staging, prod) and a remote backend in an S3 bucket with a DynamoDB lock table. The backend configuration is defined in the main.tf with partial configuration. Developers are required to provide the backend configuration via command-line flags during 'terraform init'. One developer accidentally ran 'terraform init' without the required flags on a Monday morning. The init succeeded and created a local state file in the project directory. Over the next few days, other team members made changes to the workspace and pushed updates to the remote state. The developer who ran local init then runs 'terraform plan' and sees a plan that would recreate all resources. They realize their mistake. How can this situation be prevented in the future?

Accepted Answer

Implement a CI/CD pipeline that runs 'terraform init' with the correct backend config and enforces that only pipeline-initiated runs are allowed.. Implementing a CI/CD pipeline that runs 'terraform init' with the correct backend configuration ensures that all developers use the same remote backend and prevents accidental local inits. This enforces consistency and avoids the scenario where a developer creates a local state file that diverges from the remote state. Option A is incorrect because state locking prevents concurrent modifications but does not prevent the use of a local backend. Option C is incorrect because there is no 'terraform plan -check' flag; even if there were, it would not detect a local state at plan time if the state was already initialized locally. Option D is incorrect because 'terraform workspace' commands manage workspaces but do not enforce that the backend is remote; a local backend still works with workspaces.

Answer

Enable state locking on the local backend to prevent conflicts.

Answer

Add a 'terraform plan -check' step that warns if state is not remote.

Answer

Use 'terraform workspace' commands to switch to the correct workspace before running init.

Question 6

What does Terraform's declarative model mean for infrastructure changes?

Accepted Answer

You describe the desired end state. In a declarative model, you describe the desired end state, and Terraform determines the steps to achieve that state, handling dependencies and changes automatically.

Answer

You manually approve each step

Answer

You must specify the order of creation

Answer

You write scripts to create resources

Question 7

Refer to the exhibit. A user applies this configuration and then runs 'terraform state list'. Which resource addresses would appear in the output?

Accepted Answer

aws_instance.web and aws_eip.web. The configuration defines two resources: aws_instance.web and aws_eip.web. Both will be in the state after apply. Option A lists both correct addresses.

Answer

aws_instance.web only

Answer

aws_instance.web and aws_eip.web (but aws_eip.web might not appear if the EIP fails to associate)

Answer

aws_eip.web only

Question 8

Refer to the exhibit. A developer runs `terraform apply` but receives an error that the state file is locked. Which of the following is a likely cause?

Accepted Answer

Another user has an active plan or apply running. A state lock error indicates that the state file is currently locked by another process. This commonly occurs when another user or an automated process is running a terraform plan or apply that holds the lock. Options such as a missing DynamoDB table, nonexistent S3 bucket, lack of s3:ListBucket permission, or incorrect encryption key would result in different error messages related to backend configuration or permissions, not a lock error.

Answer

The DynamoDB table for locking is not configured

Answer

The S3 bucket does not exist

Answer

The IAM user lacks s3:ListBucket permission

Answer

The encryption key is incorrect

Question 9

Which four of the following statements about Terraform state management are correct? (Choose all that apply. There are four correct answers.)

Accepted Answer

The `terraform import` command updates the state file to include an existing resource, enabling Terraform to manage it.. Remote state backends like S3 or Azure Storage support state locking (via DynamoDB or Azure Blob lease) to prevent concurrent modifications, ensuring consistency. The `terraform state rm` command removes a resource from state without destroying the real infrastructure, which is useful for detaching management. Encrypting the state backend at rest (e.g., S3 server-side encryption or Azure Storage encryption) protects sensitive data like passwords or keys stored in the state file. The `terraform import` command updates the state file to include an existing resource, allowing Terraform to take over its management without recreating it.

Answer

The `terraform state list` command can modify the state file to rename a resource.

Answer

Terraform automatically backs up the previous state file every time a new state is written.

Question 10

Which statement best describes 'immutable infrastructure' in the context of IaC?

Accepted Answer

Servers are never modified after deployment; new ones are created for updates. Immutable infrastructure means that servers are never modified after deployment; instead, new servers are created for any updates or changes. Option B correctly states this. Option A describes mutable infrastructure where configuration is changed via patches. Option C is about resource sharing, not immutable infrastructure. Option D is about version control, which is a separate IaC practice.

Answer

Configuration is changed via patches and updates

Answer

Resources are shared across environments

Answer

Infrastructure is version-controlled

Question 11

Which three of the following are required steps in the core Terraform workflow for managing infrastructure? (Choose three.)

Accepted Answer

Write Terraform configuration files that define the desired state of resources.. The core Terraform workflow consists of three essential steps: writing configuration files to define the desired state, running `terraform init` to initialize the working directory and download provider plugins, and running `terraform plan` to review the execution plan before applying changes. These steps form the fundamental 'write, plan, apply' cycle that Terraform uses to manage infrastructure declaratively. Without these, you cannot safely or correctly provision resources.

Answer

Run terraform validate to check configuration syntax before initializing the backend.

Answer

Run terraform fmt to automatically fix formatting issues in configuration files.

Answer

Run terraform destroy to remove all managed resources after every apply.

Question 12

Which three of the following are core characteristics of Terraform's execution plan? (Choose three.)

Accepted Answer

It is generated by the `terraform plan` command.. The `terraform plan` command generates an execution plan that shows exactly what actions Terraform will take to reach the desired state defined in the configuration. This plan can be saved to a file and later applied using `terraform apply` with that file, ensuring the exact same changes are executed. These three characteristics are fundamental to Terraform's workflow, providing a safe and predictable way to manage infrastructure changes.

Answer

It automatically applies changes to infrastructure without user confirmation.

Answer

It is a read-only view of the current state file with no indication of future actions.

Answer

It only shows changes for resources that were manually modified outside Terraform.

Question 13

Which TWO actions will cause Terraform to update the state file?

Accepted Answer

terraform destroy. `terraform apply` and `terraform destroy` both modify the state file. `plan`, `validate`, and `fmt` do not make changes to the state.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform plan

Question 14

Which TWO of the following are valid methods for importing existing infrastructure into Terraform management? (Choose two.)

Accepted Answer

Use a third-party tool like Terraformer to generate configuration. The typical method is to write configuration and run terraform import. Third-party tools can generate configuration from existing resources. terraform import requires configuration beforehand. terraform state push is not for importing; it pushes a state file. terraform apply would try to create new resources.

Answer

Use terraform apply directly on existing resources

Answer

Use terraform state push to manually add state entries

Answer

Use terraform import without any prior configuration

Question 15

Which two statements about Terraform state files are true? (Choose two.)

Accepted Answer

State files are used to map configuration to real-world resources.. Terraform state files serve as a mapping between configuration and real-world resources (C). They can contain sensitive data such as database passwords or resource attributes (E). However, state files are not automatically encrypted by all backends; encryption depends on the backend configuration (A false). State files should not be stored in version control due to potential sensitive content (B false). Concurrent writes to state files can cause corruption or conflicts, so sharing without locking is problematic (D false).

Answer

State files are automatically encrypted at rest by all backends.

Answer

State files should be stored in version control.

Answer

State files can be shared across multiple users simultaneously without issues.