TF-004 Practice Test 21 — 15 Questions

Question 1

A DevOps engineer needs to integrate Terraform with a CI/CD pipeline. What is a common practice?

Accepted Answer

Run terraform plan in a pull request. Running `terraform plan` in a pull request is a common practice because it allows the team to review the proposed infrastructure changes before they are applied. This integrates Terraform's safety mechanism into the CI/CD pipeline, ensuring that any destructive or unexpected modifications are caught during code review, not during deployment. It aligns with the principle of infrastructure as code (IaC) where changes are validated and approved through the same workflow as application code.

Answer

Avoid using variables

Answer

Use -auto-approve always

Answer

Store state in a local file

Question 2

In a CI/CD pipeline, Terraform state is stored in Terraform Cloud. A pipeline run fails with the error: 'State version conflict'. What is the most likely cause?

Accepted Answer

Two runs started at the same time. Terraform Cloud enforces state locking so that only one run can modify a given workspace's state at a time. When two runs (e.g., concurrent pipeline jobs, or a manual run overlapping a CI run) attempt to write state simultaneously, the second run fails with a 'state version conflict' because the state serial it read is no longer current. This is the classic concurrency symptom.

Answer

Authentication failure with Terraform Cloud

Answer

Missing or incorrect backend configuration

Answer

State file exceeds maximum size limit

Answer

Terraform version mismatch between local and remote

Question 3

A team wants to ensure that their infrastructure configuration repeatedly results in the same environment regardless of the initial state. Which IaC concept is most directly associated with this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the starting state. In Terraform, this is achieved by the provider's ability to detect drift and reconcile the real-world infrastructure with the declared configuration in the .tf files. Without idempotency, repeated runs could create duplicate resources or fail to correct unintended changes.

Answer

Version control

Answer

Orchestration

Answer

Provisioning

Question 4

Which TWO Terraform backends support remote state locking?

Accepted Answer

s3. The S3 backend (A) supports remote state locking by using a DynamoDB table to acquire and release a lock, which prevents concurrent Terraform runs from corrupting state; this is configured via the dynamodb_table argument. The Consul backend (C) also supports remote state locking natively, since Consul's key-value store provides a locking mechanism (sessions and acquire/release operations) that Terraform uses to lock the state path. The local backend (B) stores state on the local filesystem and does not provide remote locking, only local file-based locking. The inmem backend (D) keeps state in memory for testing purposes and offers no locking. The http backend (E) is a read-only backend for retrieving state over HTTP and does not support state locking.

Answer

local

Answer

inmem

Answer

http

Question 5

Which THREE are valid methods to create and manage Terraform workspaces?

Accepted Answer

Using 'terraform workspace' commands (new, select, delete). Option C is correct because the Terraform CLI provides the native 'terraform workspace' subcommands — 'terraform workspace new', 'terraform workspace select', and 'terraform workspace delete' — which create, switch between, and remove workspaces within a working directory, storing state per workspace. Option D is correct because Terraform Cloud exposes a REST API that lets you programmatically create, list, and delete workspaces (e.g., via the /organizations/:organization_name/workspaces endpoints), enabling automation and CI/CD integration. Option E is correct because the Terraform Cloud web UI allows users to create and manage workspaces through the graphical interface, including setting variables, VCS connections, and team access. Option A is not a valid Terraform mechanism: version control branches are a general Git practice and are not tied to Terraform workspace state management. Option B is not valid either: AWS tags are metadata applied to cloud resources and have no role in creating or managing Terraform workspaces.

Answer

Using version control branches

Answer

Using tags in AWS

Question 6

Which TWO statements about Terraform configuration files are correct? (Choose two.)

Accepted Answer

A file named terraform.tfvars is automatically processed.. Option B is correct because Terraform automatically loads a file named terraform.tfvars (as well as terraform.tfvars.json and any files matching *.auto.tfvars or *.auto.tfvars.json) from the current working directory to populate input variable values without requiring an explicit flag. Option E is correct because Terraform supports variable definitions files in JSON format, and these must use the .tfvars.json extension (e.g., terraform.tfvars.json or *.auto.tfvars.json) so Terraform parses them as JSON rather than HCL. Option A is wrong because Terraform only loads .tf and .tf.json files in the current working directory, not files in subdirectories, unless those directories are referenced as modules. Option C is wrong because backend configuration can be placed in any .tf file in the root module (commonly backend.tf) and does not need to share a file with the provider block. Option D is wrong because the -var-file flag takes a single file per occurrence and cannot accept a comma-separated list; multiple files require repeating the flag.

Answer

All .tf files in subdirectories are automatically loaded.

Answer

The backend configuration must be defined in the same file as the provider configuration.

Answer

The -var-file flag accepts a comma-separated list of variable files.

Question 7

Which TWO of the following are key advantages of using Terraform over manual infrastructure management? (Select TWO.)

Accepted Answer

Consistent and repeatable deployments. Option B is correct because Terraform's declarative configuration and state file let you apply the same plan repeatedly, producing consistent and repeatable deployments across environments instead of relying on error-prone manual steps. Option C is correct because Terraform configurations are plain code (HCL) that can be stored in Git and versioned, enabling peer review, change history, and rollback of infrastructure definitions. Options A, D, and E are not inherent Terraform advantages: zero downtime depends on the resource/provider and update strategy, Terraform does not automatically discover and import existing resources without explicit import commands, and self-healing is typically provided by orchestrators or auto-scaling services rather than by Terraform itself.

Answer

Guaranteed zero downtime during updates

Answer

Automatic discovery of existing resources

Answer

Self-healing infrastructure

Question 8

A company wants to use Terraform to create Azure resources. They have written a configuration file but when they run `terraform init`, they get a warning about an 'incomplete lock file'. What should they do first?

Accepted Answer

Delete the `.terraform.lock.hcl` and re-run `terraform init`. The warning about an 'incomplete lock file' indicates that the `.terraform.lock.hcl` file is corrupted, incomplete, or from an incompatible provider version. The correct first step is to delete the existing lock file and re-run `terraform init`, which will regenerate a fresh lock file based on the current configuration and provider requirements. This ensures dependency integrity before any planning or applying.

Answer

Change the provider version in the configuration

Answer

Run `terraform apply` immediately

Answer

Run `terraform plan` to update the lock file

Answer

Run `terraform validate` to fix the warning

Question 9

A DevOps team accidentally deleted their Terraform state file. The actual infrastructure (EC2 instances, security groups, etc.) is still running and unchanged. They have the Terraform configuration files that were used to create the infrastructure. They want to re-establish management of the existing infrastructure without recreating it. Which course of action aligns with Terraform's purpose?

Accepted Answer

Use terraform import for each resource to bring them into the state file.. terraform import is the supported mechanism to bring existing resources under Terraform management by writing their real-world attributes into the state file, without destroying or recreating them. Since the configuration files already exist and match the infrastructure, importing each resource re-establishes the mapping between config and state. After import, terraform plan should show no changes if the config matches reality.

Answer

Delete all existing infrastructure and run terraform apply to recreate it.

Answer

Manually edit the configuration to match the existing resources exactly, then run terraform apply.

Answer

Run terraform plan to generate a new state file automatically.

Question 10

A team uses Terraform to manage multiple environments (dev, staging, prod) with a shared networking module. The module defines a variable 'cidr_block' with no default. In the root module, they have a file dev.tfvars containing 'cidr_block = "10.0.0.0/16"'. When running 'terraform plan' while in the dev workspace, they receive: 'Error: No value for required variable cidr_block'. They have already run 'terraform init' and confirmed the workspace is 'dev'. What is the most likely cause and correct action?

Accepted Answer

They forgot to include the -var-file flag; add -var-file='dev.tfvars' to the plan command.. Terraform does not automatically load *.tfvars files unless they are named terraform.tfvars or *.auto.tfvars, or explicitly passed with -var-file. Since dev.tfvars is a custom-named file, the plan command must include -var-file='dev.tfvars' to supply the required variable. Workspace selection alone does not bind a variable file to a workspace.

Answer

The variable is defined in the child module; they need to reference it with module.cidr_block in the root module.

Answer

The workspace is not selected; run 'terraform workspace select dev' again.

Answer

The variable must be passed through the module block; they should add a module input assignment.

Question 11

A team has an existing S3 bucket created outside Terraform. They want to manage it with Terraform by importing its state. Which of the following is the correct sequence of commands to read the bucket's configuration and avoid drift?

Accepted Answer

Write a minimal resource configuration, run terraform import, then terraform plan, then adjust configuration to match state.. Importing an existing S3 bucket into Terraform requires first writing a minimal resource configuration (e.g., `resource "aws_s3_bucket" "example" { bucket = "existing-bucket-name" }`), then running `terraform import` to link the real-world bucket to the state file. After import, running `terraform plan` reveals any configuration-to-state mismatches, allowing you to adjust the resource block (e.g., adding `acl`, `versioning`, or `tags`) to match the actual bucket configuration, thereby avoiding drift. This workflow ensures the Terraform configuration accurately reflects the existing infrastructure before making changes.

Answer

Run terraform refresh, then terraform state pull to generate configuration.

Answer

Run terraform plan, note the resource address, then run terraform import.

Answer

Run terraform import, then terraform state show to generate configuration.

Question 12

A team uses an S3 backend for state storage with DynamoDB locking. They want to migrate to a new S3 bucket. Which two steps are necessary to perform a successful state migration? (Choose two.)

Accepted Answer

Run `terraform init -reconfigure` to update the backend configuration.. `terraform init -reconfigure` forces Terraform to reinitialize the backend and apply the new backend configuration from the `backend` block without prompting for confirmation. Option E is correct because the `backend` block in the Terraform configuration must be updated to reference the new S3 bucket name; Terraform reads this block during initialization to determine where to store and retrieve state. Together, these steps ensure Terraform knows the new backend location and can properly manage state going forward.

Answer

Run `terraform plan` to verify no resource changes before migration.

Answer

Delete the old state file after migration.

Answer

Manually copy the state file from the old bucket to the new bucket.

Question 13

Which two are benefits of using Infrastructure as Code? (Choose two.)

Accepted Answer

Reproducible environments. Option C (Reproducible environments) is correct because IaC defines infrastructure in versioned template/code files (e.g., Terraform HCL, CloudFormation YAML), so the same configuration can be applied repeatedly to produce identical, consistent environments across dev, test, and prod. Option D (Automated documentation) is correct because the declarative code itself serves as living documentation of the infrastructure's desired state, and tools can generate diagrams or docs directly from those definitions, keeping documentation in sync with reality. Option A is wrong because IaC does not guarantee cost optimization—it enables consistent, auditable provisioning, but cost savings depend on design choices and rightsizing. Option B is wrong because IaC still relies on cloud providers (or other target platforms) to actually host the resources; it automates how they are provisioned, not whether a provider is needed. Option E is wrong because IaC reduces configuration drift and many manual errors, but it cannot eliminate all errors—mistakes in the code, parameters, or logic can still be deployed.

Answer

Guaranteed cost optimization

Answer

Removes need for cloud providers

Answer

Elimination of all manual errors

Question 14

Which TWO statements are correct about Terraform state when using the S3 backend with DynamoDB for state locking?

Accepted Answer

The DynamoDB table must exist before running terraform init. Option A is correct because Terraform's S3 backend with DynamoDB locking requires the DynamoDB table (with a partition key of LockID) to already exist before terraform init, since init validates and configures the backend and will fail if the table is missing. Option B is correct because enabling versioning on the S3 bucket is a recommended practice that supports state recovery and consistency, allowing you to roll back to a previous state version if corruption or accidental deletion occurs. Option C is incorrect because the S3 backend configuration requires a key parameter specifying the path to the state file within the bucket. Option D is incorrect because S3 server-side encryption is not enabled by default for Terraform state; you must explicitly configure encrypt = true or apply bucket-level encryption. Option E is incorrect because DynamoDB state locking prevents concurrent write operations that could corrupt state, not read operations.

Answer

State can be stored without specifying a key in the backend configuration

Answer

State is encrypted at rest by default using SSE

Answer

State locking prevents any read operations on the state file

Question 15

A user wants to import an existing AWS EC2 instance into Terraform state so it can be managed. After writing the resource block matching the instance, what is the correct next step?

Accepted Answer

Run 'terraform import' with the resource address and ID of the instance.. After writing the resource block that matches the existing EC2 instance, the correct next step is to run 'terraform import' with the resource address and the instance ID. This command maps the real-world infrastructure to the Terraform state, allowing Terraform to manage the resource without destroying or recreating it. Without this explicit import, Terraform has no knowledge of the existing instance in its state file.

Answer

Run 'terraform plan' to see if the import is necessary.

Answer

Run 'terraform refresh' to sync state with the existing resource.

Answer

Run 'terraform apply' directly; Terraform will detect the existing resource and import it.