TF-004 Practice Test 25 — 15 Questions

Question 1

Match each Terraform cloud/enterprise feature to its purpose.

Accepted Answer

Workspaces: Manage multiple environments with separate state and variables.. Workspaces isolate state and variables per environment, Sentinel enforces policies, and Run Tasks integrate third-party tools. Common confusions include mixing the roles of Workspaces and Remote State, or Sentinel with Workspaces.

Answer

Workspaces: Store and share remote state files for collaboration.

Answer

Sentinel: Provide collaborative infrastructure management with separate environments.

Question 2

A company manages a large Terraform configuration with an S3 backend and DynamoDB locking. After initial setup, they modify the backend block in the main.tf to change the S3 bucket name. Running 'terraform plan' yields: 'Backend reinitialization required. Please run "terraform init".' They run 'terraform init' but it prompts to migrate state from the old bucket to the new one. The old bucket is empty (no state files) because the configuration has never been applied. The team wants to avoid unnecessary state migration. Which step should they take?

Accepted Answer

Run 'terraform init -reconfigure' to skip state migration.. Running `terraform init -reconfigure` tells Terraform to ignore any existing state and reconfigure the backend without attempting to migrate state from the old backend. Since the old bucket is empty and the configuration has never been applied, there is no state to migrate, so this is the correct step to avoid unnecessary migration prompts.

Answer

Delete the .terraform directory and run 'terraform init' again.

Answer

Change the backend configuration back to the original bucket and run 'terraform state rm' to clear resources.

Answer

Run 'terraform init -migrate-state' and accept the migration.

Question 3

Drag and drop the steps to handle sensitive data in Terraform outputs in the correct order.

Accepted Answer

First, define the output as sensitive. Next, run terraform apply. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.. Sensitive outputs are redacted in CLI; -json reveals raw value for secure handling.

Answer

First, run terraform apply. Next, define the output as sensitive. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, use terraform output -json to retrieve the raw value. Then, run terraform apply. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, run terraform apply. Then, securely handle the raw value. Finally, use terraform output -json to retrieve the raw value.

Question 4

Which THREE of the following are valid reasons to use 'terraform refresh'? (Choose three.)

Accepted Answer

To update the state file when resources were deleted outside of Terraform.. The `terraform refresh` command updates the state file to match real-world infrastructure. Option A is correct because if resources were deleted outside Terraform, refresh removes them from state. Option B is correct because refresh detects drift by comparing state with actual infrastructure. Option D is correct because manual changes to resources are recorded in state after refresh. Option C is incorrect because importing infrastructure requires `terraform import`, not refresh. Option E is incorrect because refresh updates the state file, not the Terraform configuration.

Answer

To import existing infrastructure into Terraform management.

Answer

To update the Terraform configuration with current resource settings.

Question 5

Which TWO statements about Infrastructure as Code (IaC) are correct?

Accepted Answer

IaC enables automated provisioning and management of infrastructure.. Infrastructure as Code (IaC) automates the provisioning and management of infrastructure through machine-readable definition files, enabling consistent and repeatable deployments without manual intervention. Tools like Terraform use a declarative approach to define resources, and the IaC engine handles creation, modification, and deletion based on the desired state. Option D is correct because IaC configurations are idempotent—applying the same configuration multiple times yields the same result. This is achieved through state management and drift detection, ensuring that infrastructure remains in the specified state regardless of how many times the configuration is applied.

Answer

IaC is only applicable to cloud-based infrastructure.

Answer

IaC eliminates configuration drift entirely.

Answer

IaC tools require manual execution of scripts.

Question 6

Refer to the exhibit. A developer creates a new Terraform configuration with this backend block and runs terraform init. What will happen?

Accepted Answer

Terraform will return an error and fail to initialize.. Terraform backend blocks require all mandatory arguments for the chosen backend type; if required fields are missing, terraform init fails with an error rather than silently falling back. Terraform does not supply defaults for backend configuration arguments and does not prompt interactively for them during init.

Answer

Terraform will initialize with a local backend because the remote backend configuration is incomplete.

Answer

Terraform will use default values for the missing arguments and initialize successfully.

Answer

Terraform will prompt the developer interactively for the missing arguments.

Question 7

A team has been managing their AWS infrastructure using a collection of Bash scripts that create resources in a specific order. They frequently encounter issues where resources are created out of order or not properly cleaned up. They want to adopt a more reliable approach that ensures consistent provisioning and teardown. Which action best aligns with Terraform's purpose?

Accepted Answer

Convert the scripts into Terraform configuration files and use remote state.. Terraform's core purpose is to provide declarative, idempotent infrastructure as code with a state file that tracks resource dependencies and enables consistent provisioning and teardown. Converting the Bash scripts to Terraform configuration files directly addresses the ordering and cleanup issues because Terraform builds a dependency graph and applies changes in the correct order. Using remote state (e.g., S3 backend with DynamoDB locking) ensures the state is shared, consistent, and protected from loss, which is essential for team collaboration and reliable teardown.

Answer

Continue using the Bash scripts but add more error handling.

Answer

Use Terraform but only store state locally on the lead engineer's machine.

Answer

Rewrite the scripts as Ansible playbooks for provisioning.

Question 8

Refer to the exhibit. An engineer sees this error. Which command should they run to force-unlock?

Accepted Answer

terraform force-unlock 123456. `terraform force-unlock <LOCK_ID>` is the exact command Terraform provides to manually release a state lock when the automatic unlocking mechanism fails (e.g., after a crash or network interruption). The lock ID is a unique identifier assigned by the backend (such as DynamoDB or Consul) when the lock was acquired, and this command bypasses the normal safety checks to force the unlock.

Answer

terraform force-unlock my-company-terraform-state/prod/terraform.tfstate

Answer

terraform unlock -id=123456

Answer

terraform state unlock 123456

Answer

terraform init -force-unlock=123456

Question 9

A platform team manages a large Terraform codebase with hundreds of resources across multiple environments (dev, staging, prod). They use terraform workspaces to manage environment-specific state files. Recently, an engineer made changes to the production workspace but forgot to switch from the dev workspace before applying. The apply was successful, but now the production resources are in an inconsistent state. The team wants to recover the production state to match the actual infrastructure. The previous state file for production was backed up in an S3 bucket before the accidental apply. What is the best course of action?

Accepted Answer

Use terraform state push with the backup state file to overwrite the current state. `terraform state push` directly overwrites the current state file in the workspace with a provided state file. Since the team has a backup of the production state file taken before the accidental apply, pushing that backup restores the state to exactly match the actual infrastructure, assuming no other changes occurred. This is the fastest and most reliable method to recover from an incorrect state overwrite, as it bypasses any reconciliation logic and replaces the state wholesale.

Answer

Use terraform state mv to correct the state entries by mapping resources from the backup to the current state

Answer

Use terraform import to manually import each production resource based on the backup state

Answer

Use terraform workspace select prod then terraform apply with the backup state file

Question 10

Refer to the exhibit. An engineer runs terraform state list and sees these resources. The engineer wants to remove the aws_eip.web_ip resource from state without destroying the actual resource. Which command should be used?

Accepted Answer

terraform state rm aws_eip.web_ip. The `terraform state rm` command removes a resource from the Terraform state file without destroying the actual infrastructure. This is the correct approach when you want Terraform to stop tracking a resource — for example, to hand management over to another tool or team — while leaving the real resource intact. It only modifies the state, not the cloud provider.

Answer

terraform destroy -target=aws_eip.web_ip

Answer

terraform refresh -target=aws_eip.web_ip

Answer

terraform import aws_eip.web_ip <id>

Question 11

An engineer is refactoring a monolithic Terraform configuration into reusable modules. One module outputs a list of subnet IDs. Another module needs to use these subnet IDs to create resources. What is the best way to pass this data between modules?

Accepted Answer

Output the subnet IDs from the first module and reference that output as an input variable in the second module's block.. Terraform modules communicate through explicit input and output variables. By outputting the subnet IDs from the first module and then referencing that output as an input variable in the second module's block, you create a clear, versionable, and dependency-aware data flow. This approach avoids hidden dependencies and ensures Terraform can properly graph the resource dependencies for parallel execution.

Answer

Use a Terraform data source in the second module to query the subnets directly.

Answer

Define the subnet IDs as a variable in the first module and pass them to the second module via a remote state data source.

Answer

Store the subnet IDs in a local file and use the 'file' function to read them in the second module.

Question 12

Which two statements about Terraform state files are true? (Choose two.)

Accepted Answer

State files are used to map configuration to real-world resources.. Option C is correct because the Terraform state file is the authoritative record that maps each resource declared in the configuration to its corresponding real-world object (for example, an AWS instance ID), enabling Terraform to plan accurate create, update, and destroy operations. Option E is correct because state stores resource attributes in plain text, including values such as database passwords, connection strings, and private keys, which is why state must be protected with encryption and restricted access. Option A is wrong because encryption at rest is not automatic for all backends; local state is unencrypted by default, and remote backends like S3 require explicit SSE configuration or KMS. Option B is wrong because committing state to version control exposes secrets and causes conflicts; remote backends with locking are the recommended approach. Option D is wrong because concurrent operations on the same state can corrupt it, which is why backends such as S3 with DynamoDB or Terraform Cloud provide state locking.

Answer

State files are automatically encrypted at rest by all backends.

Answer

State files should be stored in version control.

Answer

State files can be shared across multiple users simultaneously without issues.

Question 13

Which TWO of the following are valid methods for importing existing infrastructure into Terraform management? (Choose two.)

Accepted Answer

Use a third-party tool like Terraformer to generate configuration. Option B is correct because Terraformer is a real third-party tool that reads existing cloud infrastructure via provider APIs and generates both Terraform configuration files and matching state, letting you bring resources under management without hand-writing everything. Option D is correct because the canonical native workflow is to write the resource block in your configuration first, then run terraform import

so Terraform maps the existing object into state and subsequent plans reconcile it. Option A is wrong because terraform apply only creates or updates resources described in configuration and state; it cannot discover or adopt pre-existing infrastructure. Option C is wrong because terraform state push writes a state file you supply, which is a state-manipulation operation, not a supported import mechanism, and it does not generate configuration. Option E is wrong because terraform import requires the target resource address to already exist in configuration (in modern Terraform), so importing without prior configuration fails or leaves the resource unmanaged in config.

Answer

Use terraform apply directly on existing resources

Answer

Use terraform state push to manually add state entries

Answer

Use terraform import without any prior configuration

Question 14

A user wants to use a remote state backend for the first time. After adding the backend configuration, which command must they run to migrate the state from local to remote?

Accepted Answer

`terraform init`. When you add a remote backend configuration to your Terraform code, `terraform init` is the required command to initialize the backend and migrate the existing local state file to the remote backend. During initialization, Terraform detects the backend change, prompts for confirmation, and automatically copies the state from the local `terraform.tfstate` to the configured remote store (e.g., S3, Azure Storage, or Terraform Cloud). Without running `init`, the remote backend is not configured and local state remains unchanged.

Answer

`terraform plan`

Answer

`terraform apply`

Answer

`terraform state push`

Question 15

Which TWO are valid methods to import existing infrastructure into Terraform?

Accepted Answer

Run 'terraform import' with the resource address and ID.. `terraform import` is the primary command for bringing existing infrastructure under Terraform management. It requires both the resource address (as defined in your configuration) and the provider-specific ID of the real-world object. This command maps the existing resource into the Terraform state, enabling subsequent `apply` operations to manage it.

Answer

Use 'terraform state rm' to remove existing state before running apply.

Answer

Use 'terraform console' to inspect and import.

Answer

Use 'terraform init -migrate-state' to import from another backend.