TF-004 Practice Test 24 — 15 Questions

Question 1

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a module registry and specify a version constraint.. Using a module registry with a version constraint is the best practice for reusing Terraform modules across multiple AWS accounts. It provides a centralized, version-controlled source that can be referenced by any root configuration via a simple source address (e.g., `registry.terraform.io/org/module/aws`), ensuring consistency and enabling safe upgrades through semantic versioning. This approach avoids duplicating code and leverages Terraform's built-in dependency resolution and caching mechanisms.

Answer

Store the module in a shared S3 bucket and reference it with the module source.

Answer

Use a data source to fetch the module's output from another state.

Answer

Copy the module code into each root configuration's directory.

Question 2

A team is writing Terraform configurations for a multi-region deployment. They want to use a module from the public Terraform Registry that provisions AWS VPCs. The module has been updated recently, but the team wants to ensure that all deployments use the same version of the module to avoid unexpected changes. Which configuration approach should they take to lock the module version?

Accepted Answer

Use the 'version' argument in the module block to specify the exact version.. The 'version' argument in a module block is the standard Terraform mechanism for pinning a module from the Terraform Registry to a specific semantic version. This ensures that all deployments use the exact same module version, preventing unexpected changes from newer releases. The version constraint is evaluated against the registry's metadata and enforces the specified version during 'terraform init'.

Answer

Run 'terraform lock' on the module to record its version in the dependency lock file.

Answer

Reference the module source with a git URL and tag, such as 'git::https://github.com/...?ref=v1.0'.

Answer

Set the 'required_version' argument in the root module to match the module's version.

Question 3

Based on the error, what is the most likely reason the 'acl' argument is not expected?

Accepted Answer

The module version currently installed does not have an 'acl' variable.. The error indicates that the 'acl' argument is not recognized by the Terraform module. This typically occurs when the installed module version does not expose an 'acl' variable in its schema. Terraform validates arguments against the module's declared variables; if 'acl' is absent from the module's variables.tf, Terraform will reject it as an unexpected argument.

Answer

The argument name is misspelled; it should be 'acl_control'.

Answer

The module requires the 'acl' to be set inside a separate block.

Answer

The 'bucket' argument is missing; 'acl' must follow it.

Question 4

You are a DevOps engineer for a company that uses Terraform to manage infrastructure across multiple AWS accounts (production, staging, development). Each account has its own Terraform configuration and remote state stored in an S3 bucket with DynamoDB locking. Recently, the production deployment pipeline failed with the error: 'Error: Error loading state: AccessDenied: Access Denied'. The pipeline runs under an IAM role that has been working for months. The S3 bucket policy and IAM role permissions have not been changed. However, the team did recently enable S3 bucket versioning and added a lifecycle policy to transition objects to Glacier after 30 days. The state file was last modified 35 days ago. What is the most likely cause of the error?

Accepted Answer

The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.. D is correct because the S3 lifecycle policy transitions objects to the Glacier storage class after 30 days. The state file was last modified 35 days ago, so it has been moved to Glacier. Terraform cannot read objects in the Glacier storage class directly; it requires a restoration (e.g., using `aws s3api restore-object`) before the state can be accessed, resulting in the 'AccessDenied' error.

Answer

The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.

Answer

The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.

Answer

The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.

Question 5

Refer to the exhibit. A Terraform configuration includes an `aws_instance.web` resource. The state shows the instance with a specific AMI and instance type. After running `terraform plan`, Terraform reports no changes. However, an engineer observes that the actual instance in AWS has a different AMI ID but the same instance type. What is the most likely cause?

Accepted Answer

The state file has not been refreshed since the manual AMI change; it still reflects the old AMI. The state file is stale because it has not been refreshed since the AMI was manually changed outside of Terraform. When `terraform plan` runs, by default it first refreshes the state, but if the manual change occurred before the last refresh, the plan would have detected drift. However, if no refresh has occurred after the manual change, the plan compares the configuration with the old state, showing no changes. The issue is that the state file still reflects the old AMI. Option B correctly identifies that the state has not been refreshed since the manual change.

Answer

The instance type was modified after the last apply, but AMI was not

Answer

The `terraform plan` command ignores drift by default

Answer

The AMI data source is returning a different value each time

Question 6

A company is adopting Terraform to manage its multi-cloud infrastructure on AWS and Azure. The infrastructure team has written several Terraform configurations stored in a Git repository. Each configuration is applied by different team members using their local machines. Recently, the team has been experiencing state file conflicts and inconsistencies, leading to infrastructure drift. The team currently stores the state file locally. They want to ensure that only one person can apply changes at a time and that the state file is always up-to-date. They also want to be able to collaborate effectively without overwriting each other's changes. Which approach should they implement?

Accepted Answer

Use Terraform Cloud to manage state and provide remote operations with locking.. Terraform Cloud provides a managed remote state backend with built-in state locking and remote operations. This ensures that only one person can apply changes at a time (via the locking mechanism), the state file is always up-to-date (stored centrally), and team members can collaborate without overwriting each other's changes. It directly addresses the team's need for exclusive apply access and consistent state.

Answer

Have only one team member run terraform apply from a dedicated machine.

Answer

Store the state file in a shared Git repository and use git pull/push to sync changes.

Answer

Use a remote backend such as Amazon S3 with DynamoDB for state locking.

Question 7

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

Accepted Answer

Use a JSON validator tool to check the policy string in the configuration.. The error 'The policy failed validation' indicates that the JSON-encoded IAM policy string in the Terraform configuration is malformed or violates AWS IAM policy syntax. Using a JSON validator tool (e.g., `jq`, online validator, or `aws iam simulate-custom-policy`) directly checks the string's structure and compliance with AWS IAM policy schema, which is the most efficient first step before re-running Terraform. This isolates the issue from Terraform's execution logic and avoids unnecessary plan/apply cycles.

Answer

Run 'terraform plan' to see the detailed error.

Answer

Use 'terraform console' to test the policy string.

Answer

Upgrade to the latest Terraform version.

Question 8

Which statement best describes 'immutable infrastructure' in the context of IaC?

Accepted Answer

Servers are never modified after deployment; new ones are created for updates. Immutable infrastructure means servers, once deployed, are never modified in place; any change (patch, config update, new version) results in building a new image and replacing the old instance. This eliminates configuration drift and makes deployments reproducible and rollback-friendly. It is a core IaC pattern where infrastructure is treated like disposable, versioned artifacts.

Answer

Configuration is changed via patches and updates

Answer

Resources are shared across environments

Answer

Infrastructure is version-controlled

Question 9

Refer to the exhibit. A developer runs `terraform apply` but receives an error that the state file is locked. Which of the following is a likely cause?

Accepted Answer

Another user has an active plan or apply running. Terraform uses a state locking mechanism to prevent concurrent operations that could corrupt the state file. When another user (or CI/CD pipeline) is running terraform plan or terraform apply against the same backend, the lock is held and any subsequent apply fails with a 'state file is locked' error. The correct resolution is to wait for the other operation to finish or, if it is stale, force-unlock it.

Answer

The DynamoDB table for locking is not configured

Answer

The S3 bucket does not exist

Answer

The IAM user lacks s3:ListBucket permission

Answer

The encryption key is incorrect

Question 10

Which TWO statements best describe Terraform's purpose? (Choose two.)

Accepted Answer

It uses a declarative language.. Terraform uses a declarative language (HCL) where you define the desired end state of your infrastructure, and Terraform determines the necessary steps to achieve that state. This is a core differentiator from imperative tools, as it focuses on 'what' rather than 'how'.

Answer

It is a configuration management tool.

Answer

It is designed for single-cloud environments.

Answer

It requires a master node to manage agents.

Question 11

A team is using a private module registry from a third-party vendor. When running terraform init, they receive an error: 'Error downloading module: could not download module... server responded with 401 Unauthorized'. What is the most likely cause?

Accepted Answer

The registry credentials are missing or invalid.. The 401 Unauthorized error indicates that the request to the private module registry was received but authentication failed. Private registries require valid credentials (such as an API token or username/password) to be configured, typically via a `.terraformrc` or `credentials` block in the CLI configuration. Without these, Terraform cannot authenticate and the download is rejected.

Answer

The module source URL is incorrect.

Answer

The Terraform version is too old for the module.

Answer

The network firewall is blocking outbound connections.

Question 12

Drag and drop the steps to destroy infrastructure managed by Terraform in the correct order.

Accepted Answer

Run terraform plan -destroy, then run terraform destroy with confirmation.. Destroy plan previews removal; destroy command with confirmation tears down infrastructure.

Answer

Run terraform destroy, then run terraform plan -destroy.

Answer

Run terraform apply, then run terraform destroy.

Answer

Run terraform plan, then run terraform destroy.

Question 13

A developer wants to create multiple instances of a module that provisions a single EC2 instance. They want to create 3 EC2 instances. Which approach is most efficient and concise?

Accepted Answer

Use the 'count' meta-argument in the module block.. The `count` meta-argument in a module block allows you to create multiple instances of the entire module (including its EC2 instance) by specifying a number. This is the most efficient and concise approach when you need a fixed number of identical module instances, as it avoids code duplication and leverages Terraform's built-in iteration.

Answer

Set the source argument to a list of three URLs.

Answer

Use the 'for_each' meta-argument with a list of numbers.

Answer

Copy the module block three times with different names.

Question 14

A company wants to ensure that Terraform configurations are consistent across teams. What practice should they adopt?

Accepted Answer

Use modules from a registry. Using modules from a registry (Option B) is the correct practice because modules encapsulate reusable, version-controlled infrastructure configurations that enforce consistency across teams. By referencing a shared registry, teams can standardize on approved module versions, reducing drift and ensuring compliance with organizational policies. This approach aligns with Terraform's best practices for code reuse and collaboration.

Answer

Write all code in a single file

Answer

Use provisioners extensively

Answer

Avoid using variables

Question 15

Match each Terraform function to its category.

Accepted Answer

max(): numeric. Terraform functions are categorized by the type of data they operate on. The correct matches are: max() (numeric), lower() (string), and concat() (collection). Common confusions include misclassifying functions across categories.

Answer

max(): string

Answer

lower(): collection