TF-003 Practice Test 3 — 25 Questions

Question 1

The user runs `terraform init` successfully, but then `terraform plan` still fails with a different error: "Error: No configuration files found in this directory." The directory contains backend.tf and main.tf. What is the most likely cause?

Accepted Answer

The user is not in the same directory as the .tf files.. The error 'No configuration files found in this directory' indicates that Terraform cannot locate any .tf files in the current working directory. Even though the directory contains backend.tf and main.tf, the user must be in that directory when running `terraform plan`. This is a common path issue, not a configuration or syntax problem.

Answer

The backend block is misconfigured.

Answer

The workspace name in the backend configuration is incorrect.

Answer

The main.tf file contains invalid syntax.

Question 2

Which THREE actions should be taken when migrating Terraform state from local to a remote backend?

Accepted Answer

Run terraform init to initialize the backend and migrate state.. Option B is correct because `terraform init` is the command that initializes the backend configuration and, when a backend block is added to the configuration, automatically prompts to migrate the existing local state file to the new remote backend. This command handles the state migration seamlessly without requiring manual intervention, ensuring the state file is copied and the backend is configured correctly.

Answer

Remove the local state file before running terraform init.

Answer

Manually import all existing resources into the remote state.

Question 3

A team is using a shared backend for Terraform state. After running terraform apply, the state file is locked for an extended period, causing other team members to fail with 'Error acquiring the state lock'. What is the most likely cause?

Accepted Answer

A previous terraform apply command was interrupted or crashed, leaving a stale lock.. Option A is correct because Terraform uses a locking mechanism (typically via DynamoDB for AWS S3 backends) to prevent concurrent state modifications. If a `terraform apply` is interrupted or crashes, the lock may not be released, leaving a stale lock entry. This causes subsequent operations to fail with 'Error acquiring the state lock' until the lock is manually removed or expires (if TTL is configured).

Answer

Another team member is actively running terraform apply on the same state.

Answer

The backend configuration was changed without running terraform init.

Answer

The state file contains resources that no longer exist in the cloud provider.

Question 4

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Accepted Answer

The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. Option D is correct because even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.

Answer

The instance type chosen does not support public IP addresses.

Answer

The terraform init command failed and the apply did not actually create resources.

Answer

The subnet is configured as private and does not have a route to the internet.

Question 5

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

Accepted Answer

Configure Terraform Cloud with run triggers and policy checks. Option B is correct because Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer

Store state in a remote backend and use terraform apply in the pipeline

Answer

Use the Terraform CLI in the CI/CD pipeline with remote state

Answer

Run terraform apply locally after manual approval

Question 6

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 7

An operator runs `terraform apply` and receives an error that the state file is locked. What is the most likely cause?

Accepted Answer

Another user is running a Terraform operation. Option C is correct because Terraform uses a state locking mechanism (typically via a backend like S3 with DynamoDB, or Consul) to prevent concurrent operations from corrupting the state file. When another user or process is running a Terraform operation (e.g., `apply`, `plan`, `destroy`), the lock is held, and any subsequent `terraform apply` will fail with a 'state file is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The state file is outdated and needs refresh

Answer

The configuration has a syntax error

Answer

The user lacks write permissions to the state file

Question 8

An organization uses Terraform Cloud for remote state management. A user runs `terraform apply` locally but receives an error that the state is locked. What is the most likely cause?

Accepted Answer

Another user or process is currently running a Terraform operation that modifies the same state.. Option C is correct because Terraform Cloud uses a state locking mechanism to prevent concurrent modifications that could corrupt the state file. When a user runs `terraform apply` locally, the command first attempts to acquire a lock on the remote state. If another user or process (e.g., a Terraform Cloud run, a CI/CD pipeline, or another local apply) is already holding that lock, the new operation will fail with a 'state is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The Terraform configuration has a syntax error.

Answer

The user does not have access to the remote state backend.

Answer

The remote backend is temporarily unavailable.

Question 9

A user receives the error shown in the exhibit when running `terraform init`. The user is behind a corporate proxy. Which environment variable should be set to resolve this issue?

Accepted Answer

HTTP_PROXY=http://proxy:8080. Option C is correct because Terraform uses the standard `HTTP_PROXY` environment variable to route HTTP/HTTPS requests through a corporate proxy when downloading providers and modules. Setting `HTTP_PROXY=http://proxy:8080` instructs Terraform's underlying HTTP client to connect via the specified proxy, resolving the connectivity error during `terraform init`.

Answer

TF_VAR_proxy=http://proxy:8080

Answer

AWS_ACCESS_KEY_ID

Answer

TF_LOG=DEBUG

Question 10

After running 'terraform apply', the user sees that the 'aws_s3_bucket_object' is created successfully, but the bucket name is not as expected. What is the most likely reason?

Accepted Answer

The output 'bucket_name' in the module is set to 'aws_s3_bucket.this.id', which is the bucket name, so the bucket name should be as expected.. Option D is correct because the module output 'bucket_name' is defined as 'aws_s3_bucket.this.id', and in Terraform, the 'id' attribute of an 'aws_s3_bucket' resource is exactly the bucket name (not a generated ID). Since the user sees the object created successfully, the module is being called and the output is correctly referencing the bucket name, so the bucket name should be as expected. The question implies the user's expectation is wrong or the bucket name is actually correct, making D the only statement that aligns with Terraform's behavior.

Answer

The module variable 'bucket_name' is not consumed by the resource; the resource uses a hardcoded name.

Answer

The module output is incorrectly defined; it should use 'bucket' attribute instead of 'id'.

Answer

The module does not have an output for the bucket name, so the reference fails silently.

Question 11

An operator wants to pass output values from one Terraform configuration to another as input variables. Which approach is recommended?

Accepted Answer

Use a remote state data source to read the outputs from the first configuration's state.. Option C is correct because Terraform's remote state data source (e.g., `terraform_remote_state`) allows one configuration to securely read output values from another configuration's state file stored in a shared backend (like S3, Azure Storage, or Consul). This avoids duplication, manual errors, and ensures that the second configuration always uses the latest outputs from the first, without requiring direct file access or environment variables.

Answer

Hardcode the output values in a variables file for the second configuration.

Answer

Store outputs in a shared file and use 'file()' function to read them.

Answer

Use environment variables to pass the output values.

Question 12

A team uses Terraform Cloud workspaces to manage multiple environments. They notice that the state file for the production workspace is stored in a different backend than the development workspace. Which Terraform feature allows different workspaces to use different backends?

Accepted Answer

Using partial configuration with a backend block that has dynamic workspace references. Option C is correct because Terraform supports partial backend configuration, where the backend block can omit certain arguments (like the bucket or path) and those values can be supplied dynamically at initialization time. By using a backend block with dynamic workspace references (e.g., `key = "${var.env}/terraform.tfstate"`), each workspace can resolve to a different storage path or even a different backend type when combined with workspace-specific `-backend-config` files. This allows the production and development workspaces to store their state in entirely different backends without hardcoding the configuration.

Answer

Using the -backend-config flag

Answer

Using the backend block with a workspace key

Answer

Using a remote backend type

Question 13

Which of the following are core concepts or behaviors of Terraform's execution model and state management? (Choose four.)

Accepted Answer

Terraform uses a desired state model, where configuration defines the target state and Terraform determines the actions needed to reach it.. Terraform's execution model is fundamentally a desired state model: the configuration declares the target state, and Terraform computes the actions needed to reach it. The state file is the critical mapping between configuration and real-world resources, tracking metadata like dependencies and attributes. The plan phase produces a dry-run execution plan without making changes, while apply executes those changes and can be run directly without a saved plan file. These four behaviors—desired state, state file mapping, plan as dry-run, and apply as execution—are core to how Terraform operates.

Answer

Terraform refresh automatically updates the state file to match real-world infrastructure by modifying resources if differences are found.

Answer

Terraform destroy removes all resources defined in the configuration from the state file only, without affecting the actual infrastructure.

Question 14

Which three of the following are valid ways to use Terraform outside the core provisioning workflow? (Choose three.)

Accepted Answer

Using `terraform import` to bring existing infrastructure under Terraform management.. The three correct options are `terraform import`, `terraform state push`, and `terraform plan -out=tfplan`. `terraform import` is a non‑provisioning workflow that maps existing infrastructure into Terraform state without creating or destroying resources. `terraform state push` manually uploads a state file to a remote backend, bypassing the normal `apply` workflow. `terraform plan -out=tfplan` generates a plan file that can be applied later, decoupling the planning phase from the apply phase and thus operating outside the core provisioning loop.

Answer

Using `terraform console` to interactively evaluate expressions in the Terraform language.

Answer

Using `terraform validate` to check configuration syntax before any state operations.

Answer

Using `terraform fmt` to automatically rewrite configuration files into a canonical format.

Question 15

Which three of the following are valid methods for reading, generating, or modifying Terraform configuration? (Choose three.)

Accepted Answer

Using the `terraform fmt` command to automatically update configuration files to a canonical format and style.. The `terraform fmt` command rewrites configuration files to a canonical format and style, which is a valid method for modifying configuration. The `templatefile` function reads a template file and renders it with supplied variables, enabling dynamic configuration generation. The `terraform console` command provides an interactive shell for evaluating expressions and inspecting resource attributes, which is a valid way to read and test configuration logic.

Answer

Using the `terraform state push` command to directly edit the state file and then reflect those changes back into the configuration.

Answer

Using the `merge` function to combine multiple map values, but only when the source maps are defined in separate Terraform modules.

Answer

Using the `terraform plan -generate-config-out` flag to automatically create configuration from existing infrastructure.

Question 16

A company uses Terraform to manage infrastructure in multiple AWS accounts. An engineer runs terraform plan and sees that a security group rule will be updated, but the change is not intended. The engineer wants to understand why Terraform is proposing the change without affecting other resources. Which approach should the engineer take to troubleshoot?

Accepted Answer

Run terraform plan -out=plan.tfplan and then terraform show plan.tfplan.. Option D is correct because `terraform plan -out=plan.tfplan` saves the plan to a binary file, and `terraform show plan.tfplan` then displays the full plan details, including the exact attribute-level diff and the reason for the change (e.g., a drift between the configuration and the state). This allows the engineer to inspect the proposed change without applying it, isolating the root cause without affecting other resources.

Answer

Run terraform state list to review the current state.

Answer

Run terraform show to display the current state.

Answer

Run terraform validate to check for configuration errors.

Question 17

A team wants to ensure that all Terraform runs are recorded for audit purposes. Which practice should they implement?

Accepted Answer

Configure a remote backend that supports state versioning.. Option D is correct because configuring a remote backend that supports state versioning (e.g., Terraform Cloud, S3 with versioning enabled) automatically records every state change, providing a complete audit trail of all Terraform runs. This ensures that previous state snapshots are preserved and can be reviewed or restored if needed, meeting audit requirements without manual intervention.

Answer

Run 'terraform show' after every apply to capture state.

Answer

Add the state file to version control after each run.

Answer

Enable state locking in the backend configuration.

Question 18

Which three of the following are core characteristics of Terraform's execution plan? (Choose three.)

Accepted Answer

It is generated by the `terraform plan` command.. The `terraform plan` command generates an execution plan that shows exactly what actions Terraform will take to reach the desired state defined in the configuration. This plan can be saved to a file and later applied using `terraform apply` with that file, ensuring the exact same changes are executed. These three characteristics are fundamental to Terraform's workflow, providing a safe and predictable way to manage infrastructure changes.

Answer

It automatically applies changes to infrastructure without user confirmation.

Answer

It only shows changes for resources that were manually modified outside Terraform.

Answer

It is a read-only view of the current state file with no indication of future actions.

Question 19

During a CI/CD pipeline run, terraform apply fails halfway through due to a network error. The state file is locked. The team wants to resume from the last successful apply. What should they do?

Accepted Answer

Re-run terraform apply after solving the network issue; Terraform will handle partial state.. Terraform's state file tracks all managed resources and their current status. When `terraform apply` fails mid-run, the state is locked to prevent corruption, but Terraform records any resources that were successfully created before the failure. After resolving the network issue, re-running `terraform apply` will use the existing state to detect already-created resources and continue from where it left off, creating only the remaining resources. This is the correct and intended workflow for handling partial state in Terraform.

Answer

Run terraform destroy and then reapply.

Answer

Force unlock the state and then reapply.

Answer

Manually delete the partially created resources in the cloud console and reapply.

Question 20

A user wants to remove a specific resource from Terraform state without destroying the actual infrastructure. Which command should they use?

Accepted Answer

terraform state rm resource. The `terraform state rm` command is the correct choice because it removes a specified resource from the Terraform state file without making any API calls to the actual infrastructure provider. This allows the resource to be detached from Terraform management while leaving the real-world resource running, which is exactly what the user wants.

Answer

terraform taint resource

Answer

terraform state mv resource

Answer

terraform destroy -target=resource

TF-003 Practice Test 3 — 25 Questions

Exhibit

TF-003 Practice Test 3 — 25 Questions

Exhibit