TF-004 Practice Test 27 — 15 Questions

Question 1

A developer creates a module in a subdirectory called 'networking' relative to the root module. How should the module source be specified in the root module?

Accepted Answer

./networking. When referencing a local module in a subdirectory relative to the root module, the correct path prefix is './' followed by the subdirectory name. Option A, './networking', correctly uses a relative path starting with './' to indicate the 'networking' directory is a child of the root module's directory. This is the standard Terraform convention for local module sources.

Answer

./modules/networking

Answer

../networking

Answer

networking

Question 2

Which Terraform command is used to check the syntax and internal consistency of configuration files?

Accepted Answer

terraform validate. The `terraform validate` command checks the syntax and internal consistency of Terraform configuration files, ensuring that the code is syntactically valid and that references between resources, data sources, and variables are correct. It does not access remote state or providers, making it a fast, offline validation step. This is the correct command for verifying configuration correctness before applying changes.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform graph

Question 3

Which four of the following are valid techniques for reading, generating, or modifying Terraform configuration? (Choose all that apply. There are four correct answers.)

Accepted Answer

Using `terraform validate` to check configuration syntax and internal consistency before applying changes.. The `templatefile` function is a valid technique for reading and generating configuration because it reads an external template file and renders it with variables from the current Terraform configuration, producing a string that can be used in resource arguments or other expressions. This is a core feature for dynamic configuration generation, such as injecting user data into cloud-init scripts or generating complex configuration files for provisioned resources.

Answer

Using `terraform console` to evaluate expressions and generate valid HCL configuration output.

Answer

Using `terraform state pull` to retrieve remote state and then using `terraform state mv` to rename a resource address in the local state file before pushing it back.

Question 4

A user runs `terraform apply` and receives an error: 'Error acquiring the state lock'. What is the most likely cause?

Accepted Answer

Another user is running a Terraform command that modifies state.. The 'Error acquiring the state lock' occurs when Terraform cannot obtain the lock on the remote state backend because another process already holds it. This is most commonly caused by another user or CI job running a Terraform command that modifies state (apply, destroy, import, etc.) at the same time.

Answer

The state file is missing.

Answer

The backend configuration is invalid.

Answer

The Terraform provider is incompatible.

Question 5

A company uses AWS CloudFormation for AWS resources and Azure Resource Manager for Azure resources. They want to standardize on a single tool that can manage resources across both clouds with a consistent workflow and support for infrastructure as code. They also want to ensure that their infrastructure can be version-controlled and reviewed. Which approach best fulfills Terraform's purpose?

Accepted Answer

Use Terraform with the AWS and Azure providers to manage all resources.. Terraform is a cloud-agnostic infrastructure as code tool that uses providers to interact with multiple cloud APIs. By configuring both the AWS and Azure providers, Terraform can manage resources across both clouds using a single, consistent workflow and HCL configuration. This enables version control and code review of the infrastructure definitions, fulfilling the company's requirements.

Answer

Use a custom Python script that calls both cloud APIs.

Answer

Continue using CloudFormation for AWS and Resource Manager for Azure.

Answer

Migrate all resources to a single cloud provider to simplify management.

Question 6

A developer is new to infrastructure as code and wants to deploy a simple web server on AWS using a tool that allows them to define the infrastructure in a reusable and version-controlled manner. They are considering using the AWS Management Console, AWS CLI, or Terraform. Which course of action aligns best with Terraform's purpose?

Accepted Answer

Use Terraform to define the web server in a .tf file and run terraform apply.. Terraform's core purpose is to allow infrastructure to be defined declaratively in configuration files (typically .tf files) that can be version-controlled, shared, and reused. Writing the web server definition in a .tf file and running `terraform apply` follows this declarative, code-based workflow, enabling repeatable and auditable deployments. This aligns with infrastructure as code (IaC) principles, unlike manual or imperative approaches.

Answer

Use the AWS Management Console to manually create the web server.

Answer

Write a shell script using the AWS CLI to provision resources.

Answer

Use Terraform but only with local state and no version control.

Question 7

Refer to the exhibit. An engineer runs the commands shown in sequence. After executing 'terraform state rm', the next 'terraform plan' shows that the resource will be created. What is the most likely reason?

Accepted Answer

The 'terraform state rm' command only removes the resource from the state file, not the actual infrastructure. The next plan sees the configuration and attempts to create a new resource.. 'terraform state rm' removes the resource from the Terraform state file but does not destroy or modify the actual infrastructure. On the next 'terraform plan', Terraform sees the resource in the configuration but not in state, so it plans to create a new resource — even though the original still exists in the cloud.

Answer

The 'terraform state rm' command triggers an automatic recreation of the resource.

Answer

The resource was destroyed by a separate process.

Answer

The state file was corrupted after removal.

Question 8

A team uses an S3 backend for Terraform state. During a `terraform apply`, another team member accidentally runs a plan that also modifies the same state. Which feature prevents state corruption in this scenario?

Accepted Answer

State locking via DynamoDB. When using an S3 backend, Terraform state locking is implemented via a DynamoDB table. If two users run apply/plan concurrently, the second operation is blocked because it cannot acquire the lock, preventing state corruption. This is the standard AWS-recommended configuration for S3 backends.

Answer

The `-lock=false` flag

Answer

Terraform Cloud remote operations

Answer

State versioning in S3

Question 9

Refer to the exhibit. After applying the plan, the state serial number is 2. What was the serial number before the apply?

Accepted Answer

1. Terraform increments the state serial number by 1 each time the state is written (e.g., after apply, refresh, or import). If the serial is 2 after applying the plan, the serial before the apply was 1. The serial is a monotonically increasing integer used to detect stale state and prevent concurrent modifications.

Answer

0

Answer

3

Answer

2

Question 10

A large organization uses Terraform to manage infrastructure across multiple AWS accounts. They have a shared module for VPC stored in a private Git repository (git::https://github.com/org/terraform-aws-vpc.git?ref=v1.0.0). After updating the module source to ref=v1.2.0, they run terraform init and then terraform plan. The plan still shows the old module's resources and behavior. They confirm the new tag exists and the module code has changed. The root module source line is correct. What is the most likely cause?

Accepted Answer

Terraform cached the previous module version and did not download the new one.. Terraform caches modules in the `.terraform/modules` directory after `terraform init`. When the module source version is updated (e.g., from `ref=v1.0.0` to `ref=v1.2.0`), Terraform does not automatically re-download the module unless the lock file changes or `terraform init -upgrade` is used. Running `terraform init` without the `-upgrade` flag will not overwrite the cached module, so the plan still reflects the old version's resources and behavior.

Answer

They forgot to run terraform get.

Answer

The module source URL is incorrect.

Answer

The module's outputs changed and they need to update the root module.

Question 11

Refer to the exhibit. A team member receives this error when running terraform apply. What is the most likely cause?

Accepted Answer

A previous Terraform process was terminated abruptly, leaving a stale lock.. The error shown is Terraform's state-lock error, which occurs when a lock entry exists in the backend (e.g., DynamoDB for S3) but no active process holds it. This typically happens when a previous terraform apply was killed (Ctrl+C, CI runner timeout, network drop) before Terraform could release the lock, leaving a stale lock that blocks new operations.

Answer

The state file is corrupted and needs to be restored from backup.

Answer

Another user is currently running terraform apply on the same state.

Answer

The S3 bucket containing the state has been deleted.

Question 12

Which TWO of the following are valid ways to reference a module from the Terraform Registry?

Accepted Answer

source = "hashicorp/consul/aws". The Terraform Registry uses a three-part namespace format: `//`, where `hashicorp/consul/aws` specifies the `consul` module from the `hashicorp` namespace for the `aws` provider. This format is the standard way to reference a module hosted in the public Terraform Registry, and Terraform automatically resolves it to the registry's HTTPS URL.

Answer

source = "hashicorp/consul"

Answer

source = "github.com/hashicorp/terraform-aws-consul"

Answer

source = "./modules/consul"

Question 13

A developer runs terraform plan and sees that a resource will be destroyed. They want to confirm the exact cause of the destruction before applying. What should they do?

Accepted Answer

Run terraform show after plan.. Running `terraform show` after `terraform plan` displays the plan output in a human-readable format, including the full set of changes (create, update, destroy) and the attributes that triggered them. This allows the developer to inspect the exact reason a resource is marked for destruction, such as a changed required argument or a removed configuration block. It is the standard way to review plan details without applying.

Answer

Review the state file directly.

Answer

Run terraform validate.

Answer

Run terraform graph.

Question 14

A team member runs terraform apply with the configuration shown in the exhibit. The apply succeeds, but the output of the local-exec provisioner shows an empty string for the public IP address. What is the most likely cause?

Accepted Answer

The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.. The `local-exec` provisioner runs on the machine executing Terraform, not on the AWS instance itself. If the instance is launched in a default VPC without `auto-assign public IP` enabled and no Elastic IP is attached, the `self.public_ip` attribute will be an empty string. The provisioner then outputs that empty string, as it simply reads the attribute value from the resource state.

Answer

There is a dependency cycle between the aws_instance and null_resource causing Terraform to skip the provisioner.

Answer

The local-exec provisioner only runs during terraform destroy, not during apply.

Answer

The provisioner cannot access the aws_instance resource's attributes because it is defined in a separate resource block.

Question 15

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

Accepted Answer

Configure Terraform Cloud with run triggers and policy checks. Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer

Store state in a remote backend and use terraform apply in the pipeline

Answer

Use the Terraform CLI in the CI/CD pipeline with remote state

Answer

Run terraform apply locally after manual approval