TF-004 Practice Test 23 — 15 Questions

Question 1

You have two modules that create resources in different providers. Module A creates a VPC in AWS, Module B creates a Kubernetes cluster that requires the VPC ID. You want to ensure Module B runs after Module A but avoid hardcoding the VPC ID. Which approach is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Output the VPC ID from Module A and pass it as input to Module B.. It establishes an explicit data dependency between modules without hardcoding values. By outputting the VPC ID from Module A and passing it as an input variable to Module B, Terraform's dependency graph automatically ensures Module A is created before Module B, and the VPC ID is dynamically available at plan time.

Answer

Use a data source in Module B to look up the VPC.

Answer

Use terraform graph to order modules.

Answer

Use module dependency via depends_on in the root module.

Question 2

Which of the following accurately describe core purposes and benefits of using Terraform in a cloud infrastructure environment? Choose all that apply. (There are four correct answers.)

Accepted Answer

Automates the provisioning and lifecycle management of infrastructure across multiple cloud providers.. Terraform's core purpose is to enable Infrastructure as Code (IaC) by allowing users to define cloud resources in declarative HCL (HashiCorp Configuration Language) files. It automates provisioning and lifecycle management across multiple providers (AWS, Azure, GCP, etc.) using a single workflow. State management is fundamental: Terraform maintains a state file to track real-world resources, enabling incremental planning and safe updates. Collaboration is facilitated by storing state remotely (e.g., in S3, Terraform Cloud) and using version control for configuration files, ensuring team consistency and auditability.

Answer

Generates real-time billing and cost optimization recommendations for deployed resources.

Answer

Provides a built-in drift detection mechanism that automatically reverts unauthorized manual changes to infrastructure.

Question 3

A team renamed a module from 'module.network' to 'module.vpc' in their configuration. They run 'terraform plan' and see that Terraform wants to destroy the old network resources and create new ones. They want to preserve the existing resources without downtime. What should they do?

Accepted Answer

Add a 'moved' block to the configuration to map the old module address to the new one.. The `moved` block in Terraform allows you to refactor module addresses without destroying and recreating resources. By adding a `moved` block that maps the old module address (`module.network`) to the new one (`module.vpc`), Terraform will automatically update the state to reflect the new address during the next plan and apply, preserving the existing infrastructure and avoiding downtime.

Answer

Use 'terraform state mv' to move the resources to the new module address.

Answer

Update the module source to a new version.

Answer

Accept the destroy and recreate since it's the only way.

Question 4

Which THREE variable declarations are valid in Terraform?

Accepted Answer

variable "enabled" { type = bool default = true }. Terraform variable declarations require a `type` argument and optionally a `default` value. Here, `type = bool` is a valid primitive type, and `default = true` provides a boolean default, which matches the type constraint. This syntax follows Terraform's variable block specification, where the default value must be compatible with the declared type.

Answer

variable "names" { type = list(string) default = "name" }

Answer

variable "count" { type = number default = "1" }

Question 5

Refer to the exhibit. Which change to the configuration would prevent this error in the future?

Accepted Answer

Use a data source to fetch the AMI dynamically.. The error occurs because the AMI ID referenced in the configuration is no longer available or has changed (e.g., after an AMI update or region change). Using a data source such as aws_ami to fetch the latest AMI dynamically ensures the configuration always references a valid, current AMI ID, preventing hardcoded stale references. This is the recommended Terraform pattern for AMI selection.

Answer

Hardcode a different AMI ID.

Answer

Set the AMI to null.

Answer

Add a lifecycle rule to ignore changes.

Question 6

A team has a monolithic Terraform configuration managing multiple AWS accounts. They want to decompose it into smaller configurations that can be managed independently. What is the recommended strategy?

Accepted Answer

Split the configuration into separate directories per account and resource type, and use remote state sharing.. Splitting a monolithic Terraform configuration into separate directories per account and resource type, combined with remote state sharing, enables independent management of each configuration while allowing them to consume outputs from one another via `terraform_remote_state` data sources. This approach aligns with the recommended practice of using separate root modules for distinct environments or accounts, avoiding tight coupling and state lock contention.

Answer

Use Terraform workspaces to separate environments within the same configuration.

Answer

Create a single super-module that contains all resources.

Answer

Move everything to Terraform Cloud and use different workspaces.

Question 7

Refer to the exhibit. A developer runs 'terraform plan' and receives the following error: 'Error: InvalidAMIID.NotFound: The image id '[ami-0c55b159cbfafe1f0]' does not exist'. What is the most likely cause?

Accepted Answer

The AMI is not available in the region specified in the provider configuration.. The error 'InvalidAMIID.NotFound' indicates that the specified AMI ID does not exist in the AWS region configured in the Terraform provider block. AMI IDs are region-specific; an AMI available in us-east-1 may not exist in eu-west-2. Terraform validates the AMI against the region's EC2 API, and if the ID is not found, it throws this exact error.

Answer

The 'tags' block is missing a required 'ami' tag.

Answer

The 'ami' argument is misspelled; it should be 'image_id'.

Answer

The AMI ID is malformed; it should start with 'ami-' but the rest is incorrect.

Question 8

A small startup is using Terraform to deploy AWS resources. They have two separate environments: development and production. Currently, they manage two sets of Terraform configuration files in different directories, each with its own state file stored locally. The CEO wants to reduce duplication and simplify management. The team decides to restructure into a single configuration with workspaces. After implementing workspaces, they run `terraform workspace new dev` and `terraform workspace new prod`, then `terraform apply` in the dev workspace. However, when they switch to prod and run `terraform apply`, the plan shows that Terraform wants to recreate all resources instead of managing the existing production resources. What is the most likely reason for this behavior?

Accepted Answer

The team did not migrate the existing production state into the 'prod' workspace.. When the team restructured into a single configuration with workspaces, they created new empty workspaces (`dev` and `prod`) but did not migrate the existing production state file into the `prod` workspace. Terraform workspaces maintain separate state files, so without importing the existing production state into the `prod` workspace, Terraform has no record of the existing production resources and plans to create them from scratch. The `terraform workspace new` command creates a fresh, empty state for that workspace.

Answer

Workspaces cannot be used for different environments; only for temporary feature branches.

Answer

The Terraform configuration uses the same resource names in both workspaces, causing conflicts.

Answer

The team must configure a remote backend for workspaces to function correctly.

Question 9

Refer to the exhibit. An engineer runs 'terraform apply' and receives the lock error. After forcing an unlock, what is the most important next step?

Accepted Answer

Check if the previous apply process is still running, and if not, proceed with the new apply.. After forcing an unlock, the most important next step is to verify whether the previous apply process is still running (A). If the prior apply is still active, forcing an unlock and proceeding could cause two concurrent applies to corrupt the state file or create duplicate resources. If the prior process is confirmed dead, it is safe to proceed with the new apply. This verification step prevents state corruption.

Answer

Delete the state file and re-import resources.

Answer

Run 'terraform apply' again immediately.

Answer

Modify the backend configuration to disable locking.

Question 10

During 'terraform apply', a user receives an error: 'Error: Error creating resource: Resource already exists'. The resource does not appear in the Terraform state. What is the most likely cause?

Accepted Answer

The resource was manually created outside of Terraform before the apply.. The error 'Resource already exists' indicates that the resource was created outside of Terraform's management (e.g., manually via the cloud console or CLI). Since the resource does not appear in the Terraform state, Terraform attempts to create it during 'terraform apply', but the underlying API rejects the request because the resource already exists in the cloud provider. This is a common state drift scenario where the real-world infrastructure is out of sync with the Terraform state.

Answer

The state file was migrated from a different backend and the resource is duplicated.

Answer

The resource was removed from the configuration but not from state.

Answer

The user forgot to run terraform refresh before apply.

Question 11

A team is evaluating Terraform for managing their multi-cloud infrastructure. Which TWO statements accurately describe Terraform's purpose and capabilities? (Choose two.)

Accepted Answer

Terraform can provision, update, and destroy infrastructure resources across multiple providers.. Option B is correct because Terraform's core purpose is infrastructure as code: the terraform plan/apply/destroy workflow lets it provision, modify, and tear down resources through provider plugins for many clouds (AWS, Azure, GCP, etc.) from one configuration. Option C is correct because Terraform's HashiCorp Configuration Language (HCL) is a declarative, human-readable syntax that is also structured enough for machines to parse and process. Option A is wrong because Terraform does not mandate a directory named 'terraform'; configuration files can live in any working directory and are conventionally named with a .tf extension. Option D is wrong because Terraform is declarative, not imperative: you describe the desired end state and Terraform computes the steps, rather than specifying exact procedural steps. Option E is wrong because Terraform is a provisioning/IaC tool, not a configuration management tool like Ansible, Chef, or Puppet that installs and configures software on servers.

Answer

Terraform requires all configuration files to be placed in a single directory named 'terraform'.

Answer

Terraform uses an imperative language to specify the exact steps to create resources.

Answer

Terraform is primarily a configuration management tool for installing software on servers.

Question 12

A developer runs `terraform plan` and receives the error: "Error: Unsupported argument; An argument named 'enable_vpn_gateway' is not expected here." What is the most likely cause?

Accepted Answer

The module version 5.0.0 does not support the 'enable_vpn_gateway' argument.. The error 'Unsupported argument' indicates that the module version currently in use does not define an input variable named 'enable_vpn_gateway'. In Terraform, each module version has a fixed set of input variables; if you attempt to pass an argument that is not declared in the module's variables.tf, Terraform will reject it. The most common reason for this is that the module version has been updated or changed, and the argument was removed or renamed in that version.

Answer

The source address is misspelled 'vpc' instead of 'vpc/aws'.

Answer

The source module is not pinned to a specific version, so it may have changed.

Answer

The module must be sourced from a different registry or repository.

Question 13

Which of the following commands creates an execution plan that shows what resources will be created, updated, or destroyed?

Accepted Answer

terraform plan. The `terraform plan` command creates an execution plan by comparing the current state against the configuration, showing what resources will be created, updated, or destroyed without making any changes. This is the correct command for previewing infrastructure changes before applying them.

Answer

terraform apply

Answer

terraform output

Answer

terraform destroy

Answer

terraform validate

Question 14

A small startup uses Terraform to manage infrastructure on AWS. They store the state file directly in a Git repository (gitignored but accidentally committed) and have no remote backend. The team has two engineers: Alice and Bob. They both run Terraform from their local machines. Recently, they experienced state conflicts where Alice's apply would succeed but subsequently Bob's apply would fail due to state drift. They want a simple solution without adding too much complexity. What should they do?

Accepted Answer

Configure an S3 backend with DynamoDB locking and have both engineers use the remote state.. Configuring an S3 backend with DynamoDB locking provides a remote state file that both engineers can access, along with state locking to prevent concurrent modifications. This directly solves the state conflicts without adding excessive complexity. Option A (adding .gitignore) does not address the conflict issue since the state is still local and not shared. Option C (coordination via Slack) is unreliable and does not prevent race conditions. Option D (Terraform Cloud) is a valid solution but adds more complexity than the simple S3+DynamoDB setup, which is the recommended approach for small teams.

Answer

Add the state file to .gitignore and stop versioning it.

Answer

Continue with the current setup but ask Alice and Bob to coordinate via Slack before running apply.

Answer

Switch to Terraform Cloud with remote execution for automated locking.

Question 15

A developer is reviewing a terraform plan output and sees that a resource of type "aws_instance" with name "web" will be updated. The developer expected no changes because the configuration hasn't been modified. The instance was manually resized in the AWS console by another team. The developer wants to reconcile the state without destroying the instance. What should they do?

Accepted Answer

Run terraform apply -refresh-only to update the state to match reality.. `terraform apply -refresh-only` updates the Terraform state to match the actual infrastructure without making any configuration changes. This command reads the current state of the `aws_instance.web` resource from AWS and writes it to the state file, reconciling the drift caused by the manual resize. It does not destroy or recreate the instance, preserving the existing resource.

Answer

Run terraform state rm aws_instance.web and then terraform import.

Answer

Manually edit the state file to match the instance attributes.

Answer

Run terraform apply with -target=aws_instance.web to update only that resource.