TF-004 Practice Test 27 — 15 Questions

Question 1

A small startup uses Terraform to manage infrastructure on AWS. They store the state file directly in a Git repository (gitignored but accidentally committed) and have no remote backend. The team has two engineers: Alice and Bob. They both run Terraform from their local machines. Recently, they experienced state conflicts where Alice's apply would succeed but subsequently Bob's apply would fail due to state drift. They want a simple solution without adding too much complexity. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an S3 backend with DynamoDB locking and have both engineers use the remote state.. Configuring an S3 backend with DynamoDB locking provides a remote state file that both engineers can access, along with state locking to prevent concurrent modifications. This directly solves the state conflicts without adding excessive complexity. Option A (adding .gitignore) does not address the conflict issue since the state is still local and not shared. Option C (coordination via Slack) is unreliable and does not prevent race conditions. Option D (Terraform Cloud) is a valid solution but adds more complexity than the simple S3+DynamoDB setup, which is the recommended approach for small teams.

Answer

Add the state file to .gitignore and stop versioning it.

Answer

Continue with the current setup but ask Alice and Bob to coordinate via Slack before running apply.

Answer

Switch to Terraform Cloud with remote execution for automated locking.

Question 2

A developer is reviewing a terraform plan output and sees that a resource of type "aws_instance" with name "web" will be updated. The developer expected no changes because the configuration hasn't been modified. The instance was manually resized in the AWS console by another team. The developer wants to reconcile the state without destroying the instance. What should they do?

Accepted Answer

Run terraform apply -refresh-only to update the state to match reality.. `terraform apply -refresh-only` updates the Terraform state to match the actual infrastructure without making any configuration changes. This command reads the current state of the `aws_instance.web` resource from AWS and writes it to the state file, reconciling the drift caused by the manual resize. It does not destroy or recreate the instance, preserving the existing resource.

Answer

Run terraform state rm aws_instance.web and then terraform import.

Answer

Manually edit the state file to match the instance attributes.

Answer

Run terraform apply with -target=aws_instance.web to update only that resource.

Question 3

An organization uses Terraform to deploy resources on AWS. They have separate configuration files for development, staging, and production. To differentiate these environments, they plan to use the same root module with different variable values. Which Terraform feature best supports this use case?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple distinct state files within a single configuration directory, enabling you to use the same root module with different variable values for development, staging, and production environments. Each workspace maintains its own state data, so you can apply the same configuration to different environments by switching workspaces and providing environment-specific variable values.

Answer

Terraform modules

Answer

Remote state backends

Answer

Multiple provider configurations

Question 4

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Accepted Answer

Use a module registry and specify a version constraint.. Using a module registry with a version constraint is the best practice for reusing Terraform modules across multiple AWS accounts. It provides a centralized, version-controlled source that can be referenced by any root configuration via a simple source address (e.g., `registry.terraform.io/org/module/aws`), ensuring consistency and enabling safe upgrades through semantic versioning. This approach avoids duplicating code and leverages Terraform's built-in dependency resolution and caching mechanisms.

Answer

Store the module in a shared S3 bucket and reference it with the module source.

Answer

Use a data source to fetch the module's output from another state.

Answer

Copy the module code into each root configuration's directory.

Question 5

A team is writing Terraform configurations for a multi-region deployment. They want to use a module from the public Terraform Registry that provisions AWS VPCs. The module has been updated recently, but the team wants to ensure that all deployments use the same version of the module to avoid unexpected changes. Which configuration approach should they take to lock the module version?

Accepted Answer

Use the 'version' argument in the module block to specify the exact version.. The 'version' argument in a module block is the standard Terraform mechanism for pinning a module from the Terraform Registry to a specific semantic version. This ensures that all deployments use the exact same module version, preventing unexpected changes from newer releases. The version constraint is evaluated against the registry's metadata and enforces the specified version during 'terraform init'.

Answer

Run 'terraform lock' on the module to record its version in the dependency lock file.

Answer

Reference the module source with a git URL and tag, such as 'git::https://github.com/...?ref=v1.0'.

Answer

Set the 'required_version' argument in the root module to match the module's version.

Question 6

Based on the error, what is the most likely reason the 'acl' argument is not expected?

Accepted Answer

The module version currently installed does not have an 'acl' variable.. The error indicates that the 'acl' argument is not recognized by the Terraform module. This typically occurs when the installed module version does not expose an 'acl' variable in its schema. Terraform validates arguments against the module's declared variables; if 'acl' is absent from the module's variables.tf, Terraform will reject it as an unexpected argument.

Answer

The argument name is misspelled; it should be 'acl_control'.

Answer

The module requires the 'acl' to be set inside a separate block.

Answer

The 'bucket' argument is missing; 'acl' must follow it.

Question 7

You are a DevOps engineer for a company that uses Terraform to manage infrastructure across multiple AWS accounts (production, staging, development). Each account has its own Terraform configuration and remote state stored in an S3 bucket with DynamoDB locking. Recently, the production deployment pipeline failed with the error: 'Error: Error loading state: AccessDenied: Access Denied'. The pipeline runs under an IAM role that has been working for months. The S3 bucket policy and IAM role permissions have not been changed. However, the team did recently enable S3 bucket versioning and added a lifecycle policy to transition objects to Glacier after 30 days. The state file was last modified 35 days ago. What is the most likely cause of the error?

Accepted Answer

The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.. D is correct because the S3 lifecycle policy transitions objects to the Glacier storage class after 30 days. The state file was last modified 35 days ago, so it has been moved to Glacier. Terraform cannot read objects in the Glacier storage class directly; it requires a restoration (e.g., using `aws s3api restore-object`) before the state can be accessed, resulting in the 'AccessDenied' error.

Answer

The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.

Answer

The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.

Answer

The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.

Question 8

Refer to the exhibit. A Terraform configuration includes an `aws_instance.web` resource. The state shows the instance with a specific AMI and instance type. After running `terraform plan`, Terraform reports no changes. However, an engineer observes that the actual instance in AWS has a different AMI ID but the same instance type. What is the most likely cause?

Accepted Answer

The state file has not been refreshed since the manual AMI change; it still reflects the old AMI. The state file is stale because it has not been refreshed since the AMI was manually changed outside of Terraform. When `terraform plan` runs, by default it first refreshes the state, but if the manual change occurred before the last refresh, the plan would have detected drift. However, if no refresh has occurred after the manual change, the plan compares the configuration with the old state, showing no changes. The issue is that the state file still reflects the old AMI. Option B correctly identifies that the state has not been refreshed since the manual change.

Answer

The instance type was modified after the last apply, but AMI was not

Answer

The `terraform plan` command ignores drift by default

Answer

The AMI data source is returning a different value each time

Question 9

A company is adopting Terraform to manage its multi-cloud infrastructure on AWS and Azure. The infrastructure team has written several Terraform configurations stored in a Git repository. Each configuration is applied by different team members using their local machines. Recently, the team has been experiencing state file conflicts and inconsistencies, leading to infrastructure drift. The team currently stores the state file locally. They want to ensure that only one person can apply changes at a time and that the state file is always up-to-date. They also want to be able to collaborate effectively without overwriting each other's changes. Which approach should they implement?

Accepted Answer

Use Terraform Cloud to manage state and provide remote operations with locking.. Terraform Cloud provides a managed remote state backend with built-in state locking and remote operations. This ensures that only one person can apply changes at a time (via the locking mechanism), the state file is always up-to-date (stored centrally), and team members can collaborate without overwriting each other's changes. It directly addresses the team's need for exclusive apply access and consistent state.

Answer

Have only one team member run terraform apply from a dedicated machine.

Answer

Store the state file in a shared Git repository and use git pull/push to sync changes.

Answer

Use a remote backend such as Amazon S3 with DynamoDB for state locking.

Question 10

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

Accepted Answer

Use a JSON validator tool to check the policy string in the configuration.. The error 'The policy failed validation' indicates that the JSON-encoded IAM policy string in the Terraform configuration is malformed or violates AWS IAM policy syntax. Using a JSON validator tool (e.g., `jq`, online validator, or `aws iam simulate-custom-policy`) directly checks the string's structure and compliance with AWS IAM policy schema, which is the most efficient first step before re-running Terraform. This isolates the issue from Terraform's execution logic and avoids unnecessary plan/apply cycles.

Answer

Run 'terraform plan' to see the detailed error.

Answer

Use 'terraform console' to test the policy string.

Answer

Upgrade to the latest Terraform version.

Question 11

Which TWO statements best describe Terraform's purpose? (Choose two.)

Accepted Answer

It uses a declarative language.. Terraform uses a declarative language (HCL) where you define the desired end state of your infrastructure, and Terraform determines the necessary steps to achieve that state. This is a core differentiator from imperative tools, as it focuses on 'what' rather than 'how'.

Answer

It is a configuration management tool.

Answer

It is designed for single-cloud environments.

Answer

It requires a master node to manage agents.

Question 12

Which TWO actions are part of the core Terraform workflow? (Select TWO.)

Accepted Answer

Write Terraform configuration files. The core workflow consists of: Write (author config), Plan (review changes), Apply (execute). Options that match are 'Write configuration' and 'Review execution plan'.

Answer

Create infrastructure manually via cloud console

Answer

Commit changes to version control

Answer

Run unit tests on the configuration

Question 13

A team is using a private module registry from a third-party vendor. When running terraform init, they receive an error: 'Error downloading module: could not download module... server responded with 401 Unauthorized'. What is the most likely cause?

Accepted Answer

The registry credentials are missing or invalid.. The 401 Unauthorized error indicates that the request to the private module registry was received but authentication failed. Private registries require valid credentials (such as an API token or username/password) to be configured, typically via a `.terraformrc` or `credentials` block in the CLI configuration. Without these, Terraform cannot authenticate and the download is rejected.

Answer

The module source URL is incorrect.

Answer

The Terraform version is too old for the module.

Answer

The network firewall is blocking outbound connections.

Question 14

Drag and drop the steps to destroy infrastructure managed by Terraform in the correct order.

Accepted Answer

Run terraform plan -destroy, then run terraform destroy with confirmation.. Destroy plan previews removal; destroy command with confirmation tears down infrastructure.

Answer

Run terraform destroy, then run terraform plan -destroy.

Answer

Run terraform apply, then run terraform destroy.

Answer

Run terraform plan, then run terraform destroy.

Question 15

A developer wants to create multiple instances of a module that provisions a single EC2 instance. They want to create 3 EC2 instances. Which approach is most efficient and concise?

Accepted Answer

Use the 'count' meta-argument in the module block.. The `count` meta-argument in a module block allows you to create multiple instances of the entire module (including its EC2 instance) by specifying a number. This is the most efficient and concise approach when you need a fixed number of identical module instances, as it avoids code duplication and leverages Terraform's built-in iteration.

Answer

Set the source argument to a list of three URLs.

Answer

Use the 'for_each' meta-argument with a list of numbers.

Answer

Copy the module block three times with different names.