TF-004 Practice Exam 4 — 20 Questions

Question 1

A team is using Terraform with multiple environments (dev, staging, prod) and wants to use separate state files. They are considering workspaces. A senior engineer suggests using separate directory structures instead of workspaces for prod. What is the strongest reason for this recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Workspaces share the same backend configuration, increasing the risk of accidental changes to production.. Workspaces share the same backend configuration, meaning all workspaces (including prod) use the same state storage location and access controls. This increases the risk of accidental changes to production because a single backend misconfiguration or a mistaken workspace switch can lead to unintended modifications to the production state file. Separate directory structures allow for independent backend configurations, enabling stricter access controls and isolation for production.

Answer

Workspaces cannot isolate state files.

Answer

Workspaces make it harder to refactor configurations.

Answer

Workspaces do not support state locking.

Question 2

During a deployment, a user runs `terraform apply` but the command fails because the state lock cannot be acquired. They suspect the lock was released after the previous `apply` but is still held. What command can they use to force unlock the state?

Accepted Answer

`terraform force-unlock <lock_id>`. When Terraform cannot acquire a state lock because it was not properly released (e.g., after a crash or interrupted apply), the `force-unlock` command is the only built-in way to manually break the lock. You must provide the lock ID (obtained from the error message or backend) to override the lock, which is stored in the backend (e.g., DynamoDB, Consul) and prevents concurrent modifications. This command is designed for recovery scenarios where the lock holder is known to be dead.

Answer

`terraform init -force-copy`

Answer

`terraform state unlock`

Answer

`terraform break-lock`

Question 3

A company wants to manage its infrastructure as code using Terraform. The team has a mix of on-premises servers and cloud resources in AWS and Azure. Which of the following best describes Terraform's purpose in this scenario?

Accepted Answer

Terraform is an infrastructure-as-code tool for provisioning and managing any infrastructure across multiple providers.. Terraform is explicitly designed as an infrastructure-as-code tool that uses declarative configuration files to provision and manage resources across multiple providers, including on-premises servers (via providers like vSphere or Hyper-V) and cloud platforms like AWS and Azure. Its provider model allows it to abstract away the underlying APIs, making it provider-agnostic and suitable for hybrid environments.

Answer

Terraform is a configuration management tool for installing software on existing servers.

Answer

Terraform is a cloud-specific orchestration tool that only works with AWS.

Answer

Terraform is a monitoring and logging tool for cloud resources.

Question 4

A DevOps engineer runs terraform plan and sees that a resource will be destroyed and recreated, but they expected an in-place update. The resource is an AWS EC2 instance with a specific AMI. Which attribute change is most likely causing the destruction?

Accepted Answer

The AMI ID was changed.. Changing the AMI ID of an AWS EC2 instance is a force-new attribute in Terraform. Because the AMI defines the root block device and operating system, Terraform cannot perform an in-place update; it must destroy the existing instance and create a new one with the new AMI. This behavior is hardcoded in the Terraform AWS provider for the `aws_instance` resource.

Answer

The security group list was modified.

Answer

The tags were updated.

Answer

The instance type was reduced from large to micro.

Question 5

Which version of the module was downloaded and why?

Accepted Answer

3.19.0, because it is the latest version matching the constraint ~> 3.0, which allows any 3.x version.. The constraint `~> 3.0` in Terraform's version constraint syntax allows only the rightmost element to increment. Since `3.0` is a two-part version, the constraint permits any version in the `3.x` range (i.e., `3.0.0` up to but not including `4.0.0`). Therefore, the latest version matching that constraint is `3.19.0`, which is the highest available 3.x version.

Answer

3.0.0, because ~> 3.0 only allows the exact version 3.0.0.

Answer

3.19.0, because it is the latest version and version constraints are ignored.

Answer

3.0.0, because ~> 3.0 is limited to patch updates within 3.0.x.

Question 6

Drag and drop the steps to use Terraform modules from the registry in the correct order.

Accepted Answer

Write the module block in main.tf, then run terraform init, then set input variables in terraform.tfvars, then run terraform plan and terraform apply.. Registry modules are sourced; init downloads, variables configure, plan/apply deploy.

Answer

Run terraform init, then write the module block, then set input variables, then run terraform plan and apply.

Answer

Write the module block, then set input variables, then run terraform init, then run terraform plan and apply.

Answer

Write the module block, then run terraform plan and apply, then run terraform init, then set input variables.

Question 7

A team wants to use Terraform to manage their AWS infrastructure. They have existing resources created manually. What is the recommended approach to bring these resources under Terraform management?

Accepted Answer

Use terraform import to bring each resource into state.. `terraform import` is the recommended approach to bring existing manually created resources under Terraform management. It maps the real-world resource ID into your Terraform state file, allowing Terraform to track and manage it without deleting or recreating it. This preserves the existing infrastructure while enabling future updates via configuration.

Answer

Delete the existing resources and recreate them using Terraform configuration.

Answer

Use terraform plan to detect existing resources and automatically adopt them.

Answer

Write Terraform configuration that matches existing resources and run terraform apply.

Question 8

A Terraform configuration includes a resource block with a 'lifecycle' block that has 'create_before_destroy = true'. During an apply, the create step succeeds but the destroy step fails. What is the resulting state?

Accepted Answer

Both the old and new resources are in state.. When `create_before_destroy = true` is set, Terraform creates the new resource first, then destroys the old one. If the destroy step fails after the new resource is created, both resources exist in the state file because Terraform does not remove the old resource from state until the destroy operation completes successfully. The state retains both resource instances at the same address, which is why option D is correct.

Answer

Only the new resource remains in state, old resource is destroyed.

Answer

The state is empty for that resource address.

Answer

Only the old resource remains in state.

Question 9

A company uses Terraform Cloud and wants to ensure that only approved modules from the private registry are used in configurations. How can they enforce this?

Accepted Answer

Use Sentinel policies to check module sources. Sentinel is HashiCorp's policy-as-code framework that can enforce governance rules on Terraform Cloud runs. By writing a Sentinel policy that inspects the `module` block's `source` attribute, you can restrict configurations to only use modules from the approved private registry, rejecting any run that references external or unapproved sources.

Answer

Restrict module sources in VCS

Answer

Configure workspace variables to limit module paths

Answer

Use run tasks to scan for module types

Question 10

A DevOps engineer needs to generate multiple similar AWS EC2 instances from a single resource block. They want each instance to have a unique name tag based on an index. Which approach should they use?

Accepted Answer

Use `count` and reference `count.index` for the name tag. The `count` meta-argument creates multiple resources from a single resource block, and `count.index` provides a zero-based index for each instance. This index can be used directly in the name tag, such as `"instance-${count.index}"`, to generate unique names. `count` is the simplest and most appropriate mechanism when you need a fixed number of similar resources differentiated by an index.

Answer

Use a `locals` block to define multiple resources

Answer

Use `for_each` and reference `each.key` for the name tag

Answer

Use a `terraform_data` resource to loop

Question 11

An organization uses a remote backend (S3) with DynamoDB for state locking. A developer runs `terraform plan` and gets the error: "Error acquiring the state lock: ConditionalCheckFailedException". What is the most likely cause?

Accepted Answer

Another Terraform process is currently holding the state lock. The error 'ConditionalCheckFailedException' occurs when Terraform attempts to acquire a lock in DynamoDB but the conditional write fails because the lock item already exists with a different lock ID. This indicates another Terraform process (or a stale lock) is currently holding the state lock, preventing concurrent operations to protect state integrity.

Answer

The S3 bucket does not exist

Answer

The DynamoDB table is not yet created

Answer

The Terraform version is incompatible with the backend

Question 12

A company has a Terraform configuration that works correctly in us-east-1 but fails in us-west-2 due to resource availability. What is the best way to handle this?

Accepted Answer

Use data sources. Data sources allow Terraform to query the target region for available resources at plan time, enabling dynamic configuration that adapts to regional differences. By using a data source to filter or validate resource availability, the configuration can fail gracefully or select an alternative resource without hardcoding region-specific values.

Answer

Hardcode region in resources

Answer

Use count

Answer

Use provisioners

Question 13

Refer to the exhibit. A user runs `terraform plan` and receives this error. The user is using a local backend. Which of the following is the most likely cause?

Accepted Answer

The configured state file path's directory does not exist.. With a local backend, Terraform stores state in a local file, typically `terraform.tfstate`. The error indicates that the directory specified for the state file path does not exist. Terraform requires the parent directory to exist before it can write the state file; if it is missing, the plan fails with this error.

Answer

The workspace is not selected correctly.

Answer

The state file is corrupted.

Answer

The backend is misconfigured for remote state.

Question 14

A developer is new to Terraform and wants to understand the core workflow. Which sequence of commands correctly represents the basic Terraform workflow?

Accepted Answer

terraform init, terraform plan, terraform apply. The basic Terraform workflow follows a strict three-step sequence: `terraform init` to initialize the working directory and download required providers/modules, `terraform plan` to preview the changes Terraform will make against the current state, and `terraform apply` to execute the planned changes. Skipping `init` or `plan` would either fail due to missing providers or apply changes without a reviewable execution plan, violating the standard workflow.

Answer

terraform init, terraform apply

Answer

terraform plan, terraform init, terraform apply

Answer

terraform validate, terraform plan, terraform destroy

Question 15

An organization has a policy that all AWS S3 buckets must have versioning enabled. They want to ensure that even if someone removes the `versioning` block from the configuration, the bucket still has versioning enabled after `terraform apply`. Which lifecycle configuration should they add to the `aws_s3_bucket` resource?

Accepted Answer

`ignore_changes = [versioning]`. `ignore_changes = [versioning]` tells Terraform to disregard any changes to the `versioning` block in the configuration during `terraform apply`. This ensures that even if someone removes the `versioning` block from the HCL, the existing versioning state on the S3 bucket (enabled) remains unchanged, enforcing the organization's policy.

Answer

`replace_triggered_by = [aws_s3_bucket_versioning.this]`

Answer

`prevent_destroy`

Answer

`create_before_destroy`

Question 16

A user runs 'terraform plan' and the output includes a change that adds a new resource. However, the user expected the change to modify an existing resource. What is the most likely cause?

Accepted Answer

The resource name or type was changed in the configuration.. When a resource's name or type is changed in the configuration, Terraform interprets it as a request to destroy the old resource and create a new one, because Terraform maps each resource block to a state entry using its resource type and name (e.g., `aws_instance.web`). The plan output will show a `+` (create) for the new resource and a `-` (destroy) for the old one, rather than a `~` (update in-place). This matches the user's observation of a new resource being added instead of the expected modification.

Answer

The provider version was updated.

Answer

A required attribute was added to the resource block.

Answer

The state file was manually deleted.

Question 17

A developer runs `terraform plan` and it fails with a provider plugin error. Which command should they run first to resolve the issue?

Accepted Answer

terraform init. The `terraform init` command is the correct first step because it initializes the working directory, downloads the required provider plugins, and sets up the backend configuration. A provider plugin error typically indicates that the provider plugins are missing, outdated, or not properly installed, and `terraform init` resolves this by fetching the correct versions from the Terraform registry.

Answer

terraform validate

Answer

terraform apply

Answer

terraform fmt

Question 18

An organization uses Terraform Cloud and wants to automate run triggers when a new version of a module is published in a private module registry. What is the recommended method?

Accepted Answer

Configure a webhook in the private module registry to notify Terraform Cloud.. Terraform Cloud supports webhook notifications from private module registries. When a new module version is published, the registry can send an HTTP POST payload to a configured webhook URL in Terraform Cloud, which triggers a run in the associated workspace. This eliminates the need for polling or manual intervention, aligning with Terraform Cloud's event-driven automation model.

Answer

Create a Git repository with versioned modules and use GitOps.

Answer

Schedule terraform plan to run periodically via cron.

Answer

Use the Terraform Cloud API to poll the registry for new versions.

Question 19

A developer runs `terraform plan` and sees that Terraform will create a new S3 bucket and modify a security group. Which Terraform feature allows the developer to review these changes before applying them?

Accepted Answer

The `terraform plan` command. The `terraform plan` command creates an execution plan that shows what actions Terraform will take to achieve the desired state defined in the configuration. It compares the current state with the configuration and outputs a diff-like summary of resources to be created, modified, or destroyed, allowing the developer to review changes before applying them with `terraform apply`.

Answer

The `terraform apply` command

Answer

The `terraform validate` command

Answer

The `terraform state` command

Question 20

Your organization manages a multi-cloud infrastructure using Terraform. The infrastructure includes an AWS VPC with subnets and EC2 instances, and an Azure resource group with virtual networks and VMs. The Terraform configuration is stored in a Git repository, and state is stored in an S3 bucket with DynamoDB locking. Recently, a developer updated the configuration to add a new security group rule in AWS, but after running `terraform apply`, the rule was not created. The developer verified that the configuration file contains the rule. Additionally, the developer noticed that the state file shows the security group exists but without the new rule. The developer ran `terraform plan` again, and it shows that the rule will be created. However, when applying, it fails with a 'timeout' error. The operations team suspects network connectivity issues to the S3 backend. What is the best course of action to resolve this issue?

Accepted Answer

Migrate the state backend to Terraform Cloud, and use remote operations for applies.. The timeout error when applying, despite a successful plan, indicates that the issue is not with the configuration or state locking but with the network connectivity to the S3 backend during the apply operation. Migrating to Terraform Cloud with remote operations moves the execution environment to Terraform Cloud's infrastructure, which has reliable connectivity to the S3 backend, bypassing the local network issues. This resolves the timeout without altering the configuration or compromising state integrity.

Answer

Run `terraform init` again to reinitialize the backend.

Answer

Increase the timeout value in the Terraform provider configuration.

Answer

Disable state locking by removing the DynamoDB table reference.