TF-004 Practice Test 21 — 15 Questions

Question 1

Which TWO statements about Terraform state locking are correct?

Accepted Answer

State locking prevents concurrent modifications to the same state file.. State locking prevents concurrent modifications to the same state file, ensuring consistency. Option E is correct because state locking relies on backend support; for example, S3 requires a DynamoDB table to enable locking. Option B is false because local state backends do not support locking; it is not enabled by default. Option C is false because Terraform Cloud fully supports state locking automatically. Option D is false because state locking is necessary for any operation that modifies state, even with a single user, to prevent corruption.

Answer

State locking is enabled by default when using a local state backend.

Answer

State locking is not supported in Terraform Cloud.

Answer

State locking is only necessary when multiple team members are running terraform apply simultaneously.

Question 2

A CI/CD pipeline runs 'terraform plan' and needs to automatically approve only if no resources will be destroyed. Which approach should be used?

Accepted Answer

Run 'terraform plan -out=plan.tfplan', then 'terraform show -json plan.tfplan' and parse the output for destroy actions.. 'terraform plan -out=plan.tfplan' generates a plan file, and 'terraform show -json plan.tfplan' outputs it in JSON format, which can be parsed to detect destroy actions. If no destroy actions are present, the pipeline can proceed to apply. Option A is wrong because 'terraform apply -auto-approve' would apply any changes without checking for destroys. Option B is wrong because 'terraform plan -destroy' always shows a destroy plan, not a way to detect destroys in a normal plan. Option C is wrong because 'terraform fmt' only formats code, not checks for destroys. Option D is wrong because 'terraform validate' only checks syntax, not planned changes.

Answer

Run 'terraform apply -auto-approve' after a successful plan.

Answer

Run 'terraform plan -destroy' and check the exit code.

Answer

Run 'terraform fmt' to check for formatting issues.

Answer

Run 'terraform validate' to ensure no destroys are needed.

Question 3

Which four of the following statements about interacting with Terraform modules are correct? (Choose four.)

Accepted Answer

A module can reference outputs from another module using the syntax module.... This statement is correct because Terraform modules expose outputs that can be referenced by the calling configuration using the syntax `module..`. This allows values computed inside a module to be used elsewhere in the root module, enabling modular composition and data sharing between modules.

Answer

To use a module from a private registry, you must always specify a version constraint in the source attribute of the module block.

Answer

A module can be used to create resources only in the same provider configuration as the root module; it cannot define its own provider configurations.

Question 4

Which TWO of the following are best practices when using Terraform in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use version control for configurations. Remote state with locking ensures consistency and prevents corruption. Version control tracks changes. Storing state in source repo is not secure. Auto-applying after plan is risky without approval. terraform import is for importing existing resources, not a CI/CD best practice.

Answer

Run terraform apply automatically after plan

Answer

Store state in the source repository

Answer

Use terraform import to manage existing resources

Question 5

Match each Terraform feature to its description.

Accepted Answer

Terraform State: A file that tracks the current state of resources managed by Terraform.. Terraform State tracks resource states, Providers enable API interactions, Modules bundle resources for reuse, and Workspaces manage environments. Common confusions include swapping State with Provider or Provider with Module.

Answer

Terraform State: A plugin that interacts with APIs of a specific service.

Answer

Terraform Provider: A container for multiple resources that are used together.

Question 6

Match each Terraform variable type to its example value.

Accepted Answer

string: "hello". Terraform variable types: string uses quotes, number is numeric, bool is true/false, list is an array. Common mistakes include confusing numbers with strings and lists with bools.

Answer

string: 42

Answer

bool: ["a", "b"]

Question 7

Which TWO of the following are best practices when writing Terraform configuration for a team? (Select TWO.)

Accepted Answer

Pin provider versions using `required_providers`.. Options B and D are correct. Pinning provider versions using `required_providers` ensures reproducibility across team members. Using a remote backend with state locking prevents state corruption and conflicts. Option A is wrong because using `latest` versions can introduce breaking changes unexpectedly. Option C is wrong because hardcoding values (especially secrets) is insecure and inflexible. Option E is wrong because a single monolithic configuration file is harder to maintain and collaborate on.

Answer

Always use the `latest` version for providers.

Answer

Hardcode all values in the configuration for simplicity.

Answer

Store the entire infrastructure in a single configuration file.

Question 8

A company manages a large Terraform configuration with an S3 backend and DynamoDB locking. After initial setup, they modify the backend block in the main.tf to change the S3 bucket name. Running 'terraform plan' yields: 'Backend reinitialization required. Please run "terraform init".' They run 'terraform init' but it prompts to migrate state from the old bucket to the new one. The old bucket is empty (no state files) because the configuration has never been applied. The team wants to avoid unnecessary state migration. Which step should they take?

Accepted Answer

Run 'terraform init -reconfigure' to skip state migration.. The correct action is to use 'terraform init -reconfigure', which allows reinitialization without migration by ignoring the existing backend configuration and starting fresh. Option B (deleting .terraform) would also work but is less efficient and may lose cached modules. Option C is unnecessary because there is no state to manage. Option D would force migration, which the team wants to avoid.

Answer

Delete the .terraform directory and run 'terraform init' again.

Answer

Change the backend configuration back to the original bucket and run 'terraform state rm' to clear resources.

Answer

Run 'terraform init -migrate-state' and accept the migration.

Question 9

A company uses Terraform to manage infrastructure in multiple AWS accounts. An engineer runs terraform plan and sees that a security group rule will be updated, but the change is not intended. The engineer wants to understand why Terraform is proposing the change without affecting other resources. Which approach should the engineer take to troubleshoot?

Accepted Answer

Run terraform plan -out=plan.tfplan and then terraform show plan.tfplan.. `terraform plan -out=plan.tfplan` saves the plan to a binary file, and `terraform show plan.tfplan` then displays the full plan details, including the exact attribute-level diff and the reason for the change (e.g., a drift between the configuration and the state). This allows the engineer to inspect the proposed change without applying it, isolating the root cause without affecting other resources.

Answer

Run terraform state list to review the current state.

Answer

Run terraform show to display the current state.

Answer

Run terraform validate to check for configuration errors.

Question 10

A team uses Terraform to manage infrastructure. They have multiple configuration directories for different environments (dev, staging, prod). They want to reuse common modules across environments. Which approach aligns with the core Terraform workflow best practices?

Accepted Answer

Use a single configuration with separate state files and variable files for each environment. It follows the core Terraform workflow of separating configuration from state and using variable files to manage environment-specific differences. By maintaining a single configuration directory with separate state files (e.g., via different backends or state file paths) and variable files (e.g., `dev.tfvars`, `prod.tfvars`), the team avoids duplication and ensures that all environments use the same module versions and resource definitions, which is a best practice for consistency and maintainability.

Answer

Use workspaces with state stored in a local backend

Answer

Copy the configuration into each environment directory and modify as needed

Answer

Create separate Terraform configurations for each environment with hardcoded values

Question 11

Which three of the following best describe the core purpose and capabilities of Terraform? (Choose three.)

Accepted Answer

It maintains a state file to map real-world resources to your configuration and to track metadata such as resource dependencies.. Terraform is an infrastructure as code (IaC) tool that uses a declarative configuration language (HCL) to define and provision data center infrastructure. It manages both low-level components (e.g., compute instances, storage) and high-level components (e.g., DNS records, SaaS resources) across multiple cloud providers and on-premises systems via providers. Terraform maintains a state file to map real-world resources to your configuration, track metadata like dependencies, and enable incremental updates.

Answer

It requires a running daemon or agent on each target machine to execute resource changes.

Answer

It is primarily a configuration management tool for installing and configuring software on existing servers.

Answer

It only supports public cloud providers (AWS, Azure, GCP) and cannot manage on-premises infrastructure.

Question 12

You are a platform engineer at a large enterprise that uses Terraform Cloud with a VCS-backed workflow for all infrastructure. Your team manages a configuration that provisions AWS EC2 instances for a critical application. Recently, a junior team member accidentally committed a change that removed a required tag from the EC2 instance resource. The change passed the plan stage but was blocked by a Sentinel policy during the apply, preventing the infrastructure from being updated. The team needs to fix the configuration and apply the change. However, the repository is configured to automatically trigger runs on every push to the main branch. The team wants to avoid triggering an unwanted run while they work on the fix. What should the team do?

Accepted Answer

Create a feature branch, fix the configuration, and merge via pull request. Using a feature branch and pull request allows the team to fix the configuration without triggering a run on the main branch, since Terraform Cloud’s VCS integration only auto-triggers runs on pushes to the configured branch (typically main). Once the fix is merged via pull request, the change will be applied through the normal VCS-backed workflow, maintaining audit trails and policy enforcement. This approach avoids disrupting the VCS connection or bypassing Terraform Cloud’s governance.

Answer

Temporarily disable the VCS connection in Terraform Cloud to prevent runs

Answer

Run terraform apply locally with the fixed configuration to bypass Terraform Cloud

Answer

Amend the commit on main and force push to overwrite history

Question 13

A developer runs `terraform init` in a directory containing Terraform configuration files. After initialization, they notice that a provider plugin was installed. Where are provider plugins stored locally by default?

Accepted Answer

In a `.terraform` subdirectory of the current working directory. By default, `terraform init` downloads and installs provider plugins into a `.terraform` subdirectory within the current working directory. This local directory acts as the plugin cache for the specific configuration, ensuring that each Terraform project has its own isolated set of provider binaries. The `.terraform` directory is created automatically during initialization and is managed by Terraform to store plugins, modules, and state data.

Answer

In the system-wide plugin directory `/usr/share/terraform/plugins`

Answer

In the user's home directory under `~/.terraform.d/plugins`

Answer

In a temporary directory that is deleted after `terraform init` completes

Question 14

A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies are Terraform Cloud's policy-as-code framework that allows teams to enforce mandatory rules on infrastructure configurations before they are applied. By writing a Sentinel policy that checks for the presence and value of a specific tag on all AWS resources, the team can reject any run that does not comply, ensuring consistent tagging across all resources created by Terraform.

Answer

Cost estimation

Answer

Workspace variables

Answer

Run tasks

Question 15

Refer to the exhibit. A Terraform Cloud plan includes an EC2 instance of type 't2.medium'. The team uses Sentinel policies. Which action should they take to proceed?

Accepted Answer

Change the instance type in the configuration to t2.micro or t2.small.. Sentinel policies enforce compliance rules, and if the policy explicitly denies 't2.medium', the team must modify their configuration to use an allowed instance type (e.g., t2.micro or t2.small) to pass the policy check. This aligns with the principle of infrastructure-as-code where policies are immutable guardrails, and the configuration must be adapted to meet them rather than bypassing the policy.

Answer

Modify the Sentinel policy to allow t2.medium.

Answer

Disable the policy check for this run.

Answer

Override the policy in the run using Terraform Cloud UI.