TF-003 Practice Test 26 — 15 Questions

Question 1

An organization stores state files in an S3 backend with encryption. However, some resource attributes (e.g., database passwords) are stored in plaintext within the state. What is the recommended approach to avoid storing sensitive values in state?

Accepted Answer

Use a secrets backend like Vault to retrieve secrets at runtime and store only references in state. Terraform can mark outputs as sensitive to hide them from display, but they may still be stored in state. Option A is a common practice to avoid storing secrets directly.

Answer

Set the `sensitive` parameter on all resources

Answer

Enable state encryption with a stronger algorithm

Answer

Use the `terraform state rm` command after apply to remove sensitive attributes

Question 2

Refer to the exhibit. What will happen when you run terraform plan?

Accepted Answer

The plan will fail with an error about missing required argument.. Option B is correct because the configuration is missing the required 'name' argument for an IAM user, so Terraform will fail validation with an error. Option A is incorrect because Terraform does not generate a name for required arguments. Option C is incorrect because Terraform does not prompt for missing arguments interactively. Option D is incorrect because the resource cannot be created without the required name.

Answer

The plan will prompt for the name interactively.

Answer

The plan will succeed and create the IAM user with a generated name.

Answer

The plan will create the user with the path only.

Question 3

Which TWO statements correctly describe Infrastructure as Code principles?

Accepted Answer

IaC enables version control of infrastructure configurations.. B and D are correct because IaC enables version control of configurations (B) and promotes repeatable, consistent deployments (D). A is incorrect because IaC does not eliminate configuration management tools; they often complement each other. C is incorrect because IaC can automate changes without manual approval for every change. E is incorrect because IaC is applicable to on-premises, hybrid, and multi-cloud environments, not just public cloud.

Answer

IaC requires manual approval for every infrastructure change.

Answer

IaC is only applicable to public cloud environments.

Answer

IaC eliminates the need for configuration management tools.

Question 4

Which TWO statements about using Terraform with remote backends are correct?

Accepted Answer

Remote backends store state in a shared location.. Remote backends enable state locking and store state in a shared location, preventing conflicts and enabling team collaboration. The other options are incorrect: remote backends do not store state locally, can be used with Terraform Cloud, and migration can be automated.

Answer

Remote backends require manual state migration.

Answer

Remote backends store state in the local filesystem.

Answer

Remote backends cannot be used with Terraform Cloud.

Question 5

A company uses Terraform Cloud with a remote state backend and runs infrastructure as code through a CI/CD pipeline (GitHub Actions). The pipeline executes 'terraform plan' and 'terraform apply' using a service account with appropriate permissions. Recently, the team introduced a Sentinel policy to enforce that all AWS resources have mandatory tags (Environment, Owner, Project). The policy passes when runs are triggered manually from the Terraform Cloud UI, but fails consistently when the CI/CD pipeline runs the plan. The infrastructure configuration files are identical in both cases. The team verifies that the service account used by CI/CD has the same workspace permissions as the UI user. What is the most likely cause of the failure?

Accepted Answer

The CI/CD pipeline is using a different set of variables that override the tags.. The CI/CD pipeline often uses environment variables or variable files that can override Terraform variables. If the pipeline sets different values for the tag variables (e.g., missing or incorrect tags), the Sentinel policy would fail. Option C is correct because variable overrides in the pipeline are a common cause of such discrepancies.

Answer

The Sentinel policy is checking the wrong workspace.

Answer

The Sentinel policy is configured to fail on all plans regardless of compliance.

Answer

The CI/CD pipeline is using an older version of Terraform that does not support Sentinel.

Question 6

Refer to the exhibit. Which change to the configuration would prevent this error in the future?

Accepted Answer

Use a data source to fetch the AMI dynamically.. Using a data source to dynamically fetch the correct AMI avoids hardcoding invalid IDs and ensures the AMI exists in the region.

Answer

Hardcode a different AMI ID.

Answer

Set the AMI to null.

Answer

Add a lifecycle rule to ignore changes.

Question 7

Refer to the exhibit. An operator runs terraform plan and gets the following output. They have not modified the Terraform configuration since the last successful apply. What is the most likely cause of the planned changes?

Accepted Answer

The instance was modified manually via the AWS console.. The plan shows changes to the AMI and instance type, which are attributes that were not changed in the configuration. This indicates drift caused by manual modifications outside Terraform. Option A is correct because manual changes via the console cause Terraform to detect differences and propose corrections.

Answer

Terraform provider was updated to a new version.

Answer

The instance was terminated and recreated.

Answer

Terraform state was corrupted.

Question 8

Which TWO of the following statements about Terraform state are correct? (Choose two.)

Accepted Answer

Terraform state can be stored remotely using backends like S3 or Azure Storage.. Terraform state is stored locally by default in terraform.tfstate, and can be shared via remote backends like S3. State is not encrypted by default and may contain sensitive data.

Answer

Terraform state can be shared across team members using a local file.

Answer

Terraform state is always encrypted at rest by default.

Answer

Terraform state contains sensitive information such as resource passwords.

Question 9

Refer to the exhibit. The configuration fails with an error indicating that the module does not support the 'enable_vpn_gateway' argument. What is the most likely cause?

Accepted Answer

The module version '3.18.0' does not include the 'enable_vpn_gateway' variable; it was added in a later version.. Option B is correct because the error message indicates that the module does not support the 'enable_vpn_gateway' argument. In Terraform, module arguments are defined by the module's published variables. The module version '3.18.0' predates the introduction of the 'enable_vpn_gateway' variable, which was added in a later version. Upgrading the module version to one that includes this variable resolves the error.

Answer

The argument name is misspelled; it should be 'enable_vpn' instead.

Answer

The module does not support VPN gateways at all.

Answer

The module source is incorrectly specified; it should use a git URL instead of the registry path.

Question 10

Which TWO of the following are benefits of using Terraform's infrastructure as code approach?

Accepted Answer

Provisioning can be automated and repeated consistently across environments.. Option A is correct because Terraform's infrastructure as code approach allows you to define your entire infrastructure in declarative configuration files (HCL). These configurations can be executed repeatedly using `terraform apply`, ensuring that the same provisioning steps are performed consistently across development, staging, and production environments without manual intervention or drift.

Answer

Terraform automatically scales resources based on load.

Answer

Manual configuration of servers is eliminated entirely.

Answer

Terraform provides real-time monitoring of infrastructure health.

Question 11

A Terraform configuration includes a module from the Terraform Registry. After running `terraform init`, the module is downloaded. However, a subsequent `terraform plan` fails with an error that a required provider is not installed, even though it is declared in the module. What is the most likely cause?

Accepted Answer

The `required_providers` block is not declared in the root module. Option C is correct because in Terraform, the `required_providers` block must be declared in the root module to ensure all providers are installed during `terraform init`. When a module from the Registry declares a provider but the root module does not, `terraform init` may not automatically install that provider, leading to a 'required provider not installed' error during `terraform plan`. The root module acts as the top-level configuration that aggregates all provider requirements.

Answer

The module uses a different Terraform version

Answer

The provider version constraint is incompatible

Answer

The module source URL is incorrect

Question 12

An operator runs terraform apply and receives the exhibit error. The instance was created but Terraform reports a failure. What is the most likely cause?

Accepted Answer

A provisioner block is configured to wait for SSH, but the instance is not reachable. The error indicates that the instance was created successfully but Terraform reports a failure during the apply phase. This typically occurs when a provisioner block (e.g., file or remote-exec) is configured to wait for SSH connectivity, but the instance is not reachable within the timeout period. Terraform marks the resource as 'tainted' and reports a failure, even though the cloud resource itself was provisioned.

Answer

The state file is locked and cannot be updated

Answer

The AMI ID is incorrect and the instance failed to boot

Answer

The AWS API returned an error during instance creation

Question 13

Which TWO of the following are valid reasons to use Terraform state?

Accepted Answer

Improving performance for large infrastructures by caching resource attributes.. Option D is correct because Terraform state acts as a cache for resource attributes, which significantly improves performance for large infrastructures. By storing the current state of resources locally or remotely, Terraform avoids making repeated API calls to the cloud provider for every `plan` or `apply` operation, reducing latency and API rate limits. This caching mechanism is essential for efficiently managing complex deployments with hundreds or thousands of resources.

Answer

Automatically applying changes when configuration files are saved.

Answer

Storing sensitive data like passwords and API keys.

Answer

Providing a backup of the infrastructure to restore in case of disaster.

Question 14

A team manages infrastructure with Terraform and uses a remote backend in an S3 bucket. After a recent state migration, a developer runs 'terraform plan' and gets an error: 'Error: Error loading state: NoSuchKey: The specified key does not exist.' The developer confirms that the state file exists in the bucket. What is the most likely cause?

Accepted Answer

The backend configuration in the Terraform code does not match the actual state file path.. The error 'NoSuchKey: The specified key does not exist' indicates that Terraform is looking for the state file at a specific key (path) in the S3 bucket, but that key does not exist. Since the developer confirms the state file exists in the bucket, the most likely cause is a mismatch between the backend configuration in the Terraform code (e.g., the `key` argument) and the actual path where the state file is stored. This often happens after a state migration if the backend configuration was not updated to reflect the new location.

Answer

Terraform state locking is enabled but the lock was not released.

Answer

The S3 bucket policy does not allow reading the state file.

Answer

S3 bucket versioning is enabled, and the state file is a non-current version.

Question 15

An organization uses Terraform with the AzureRM backend. The team recently split a large configuration into multiple smaller configurations, each with its own state file. They want to share outputs from one configuration (networking) as inputs to another (compute). Which approach should they use to reference the networking state from the compute configuration without duplicating data?

Accepted Answer

Use a 'data' 'terraform_remote_state' block in the compute configuration to read the networking state.. Option C is correct because the `terraform_remote_state` data source allows one Terraform configuration to read the root-level output values from another configuration's state file stored in the AzureRM backend. This enables sharing of networking outputs (e.g., subnet IDs) into the compute configuration without duplicating data or manually exporting values. The data source retrieves the state directly from the configured backend, ensuring the compute configuration always uses the latest networking outputs.

Answer

Define output values in the networking configuration and they will be automatically available in the compute configuration.

Answer

Run 'terraform output' on the networking state and save the values to a JSON file, then use 'terraform_remote_state' to read them.

Answer

Hardcode the subnet IDs from the networking configuration into the compute configuration.