TF-003 Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. A developer runs 'terraform plan' and receives the following error: 'Error: InvalidAMIID.NotFound: The image id '[ami-0c55b159cbfafe1f0]' does not exist'. What is the most likely cause?

Accepted Answer

The AMI is not available in the region specified in the provider configuration.. Option B is correct because the error 'InvalidAMIID.NotFound' indicates that the specified AMI ID does not exist in the AWS region configured in the Terraform provider block. AMI IDs are region-specific; an AMI available in us-east-1 may not exist in eu-west-2. Terraform validates the AMI against the region's EC2 API, and if the ID is not found, it throws this exact error.

Answer

The 'tags' block is missing a required 'ami' tag.

Answer

The 'ami' argument is misspelled; it should be 'image_id'.

Answer

The AMI ID is malformed; it should start with 'ami-' but the rest is incorrect.

Question 2

A team member runs terraform apply with the configuration shown in the exhibit. The apply succeeds, but the output of the local-exec provisioner shows an empty string for the public IP address. What is the most likely cause?

Accepted Answer

The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.. Option C is correct because the `local-exec` provisioner runs on the machine executing Terraform, not on the AWS instance itself. If the instance is launched in a default VPC without `auto-assign public IP` enabled and no Elastic IP is attached, the `self.public_ip` attribute will be an empty string. The provisioner then outputs that empty string, as it simply reads the attribute value from the resource state.

Answer

There is a dependency cycle between the aws_instance and null_resource causing Terraform to skip the provisioner.

Answer

The local-exec provisioner only runs during terraform destroy, not during apply.

Answer

The provisioner cannot access the aws_instance resource's attributes because it is defined in a separate resource block.

Question 3

Which TWO of the following are valid ways to reference a value from a Terraform configuration?

Accepted Answer

var.environment. Option A is correct because `var.environment` is the standard syntax to reference an input variable defined in a Terraform configuration. Input variables are declared with a `variable` block and accessed using the `var.` prefix, making this a valid reference within any Terraform configuration file.

Answer

local.example.value

Answer

module.example.arn

Answer

provider.aws.region

Question 4

Which THREE of the following are valid Terraform providers?

Accepted Answer

hashicorp/azurerm. Option A is correct because `hashicorp/azurerm` is the official Terraform provider for Microsoft Azure, published by HashiCorp in the Terraform Registry. It allows you to manage Azure resources such as virtual machines, storage accounts, and networking components using Terraform's declarative configuration language.

Answer

kreuzwerker/docker

Answer

hashicorp/cloudwatch

Question 5

A user wants to see the current state of resources in a human-readable format without making changes. Which command should they use?

Accepted Answer

terraform show. Option D, `terraform show`, is correct because it displays the current state of managed resources in a human-readable format (defaulting to plain text) without making any changes. This command reads the state file directly and presents its contents, making it ideal for inspection and debugging. Unlike `terraform plan`, it does not generate an execution plan or propose modifications.

Answer

terraform output

Answer

terraform state list

Answer

terraform plan

Question 6

A company uses Terraform to manage infrastructure on AWS. They have a configuration that creates an S3 bucket and a DynamoDB table for state locking. The team notices that sometimes when two members run terraform apply simultaneously, they get a state locking error. However, they want to allow concurrent operations on different workspaces. What is the best approach?

Accepted Answer

Use separate state files per workspace and ensure each workspace has its own lock entry in DynamoDB; the current setup already supports this.. Option D is correct because Terraform natively supports per-workspace state files, and when using a remote backend like S3 with DynamoDB for state locking, each workspace's state file is stored at a distinct path in S3. The DynamoDB lock entry is tied to the specific state file path via the LockID, so concurrent operations on different workspaces acquire separate locks and do not conflict. This setup allows multiple team members to run terraform apply simultaneously as long as they are working in different workspaces.

Answer

Remove the DynamoDB table and use local state files to avoid locking issues.

Answer

Configure all team members to use the same workspace so that only one person can apply at a time.

Answer

Keep the current setup because the error is harmless and users can retry.

Question 7

A team wants to use Terraform to provision infrastructure across multiple cloud providers. Which configuration approach best supports this goal?

Accepted Answer

Define multiple provider blocks, one for each cloud provider.. Option A is correct because Terraform uses multiple provider blocks to manage resources from different cloud providers within a single configuration. Each provider block configures a separate provider (e.g., aws, azurerm, google) with its own authentication and region settings, allowing Terraform to provision and manage infrastructure across AWS, Azure, GCP, and others in the same state file and execution plan.

Answer

Use a single provider block that supports multiple clouds.

Answer

Terraform cannot manage multiple clouds in one configuration.

Answer

Create separate workspaces for each cloud provider.

Question 8

A Terraform configuration includes a resource block with a 'lifecycle' block that has 'create_before_destroy = true'. During an apply, the create step succeeds but the destroy step fails. What is the resulting state?

Accepted Answer

Both the old and new resources are in state.. When `create_before_destroy = true` is set, Terraform creates the new resource first, then destroys the old one. If the destroy step fails after the new resource is created, both resources exist in the state file because Terraform does not remove the old resource from state until the destroy operation completes successfully. The state retains both resource instances at the same address, which is why option D is correct.

Answer

Only the new resource remains in state, old resource is destroyed.

Answer

The state is empty for that resource address.

Answer

Only the old resource remains in state.

Question 9

Which three of the following describe correct practices or behaviors when interacting with Terraform modules? (Choose three.)

Accepted Answer

A module source can be a local file path, such as './modules/networking'.. Option null is correct because Terraform modules can be sourced from a local file path using the `source` argument, such as `'./modules/networking'`, which allows referencing modules stored within the same repository or filesystem. This is a fundamental feature for organizing infrastructure code without relying on remote registries.

Answer

Module input variables are automatically populated from environment variables without explicit variable declarations.

Answer

When using a module from a Git repository, Terraform automatically applies any local changes made inside the `.terraform/modules` directory.

Answer

Terraform modules can only be sourced from the public Terraform Registry.

Question 10

A developer runs `terraform plan` and sees that Terraform will create a new S3 bucket and modify a security group. Which Terraform feature allows the developer to review these changes before applying them?

Accepted Answer

The `terraform plan` command. The `terraform plan` command creates an execution plan that shows what actions Terraform will take to achieve the desired state defined in the configuration. It compares the current state with the configuration and outputs a diff-like summary of resources to be created, modified, or destroyed, allowing the developer to review changes before applying them with `terraform apply`.

Answer

The `terraform apply` command

Answer

The `terraform validate` command

Answer

The `terraform state` command

Question 11

Which TWO statements about Terraform's handling of input variables are true?

Accepted Answer

The terraform.tfvars file is automatically loaded by Terraform.. Option A is correct because variables are declared using the 'variable' block in .tf files. Option C is correct because Terraform automatically loads terraform.tfvars. Option B is incorrect because variables can have defaults and are not required to be assigned before plan. Option D is incorrect because environment variables with TF_VAR_ prefix can override variable values. Option E is incorrect because default values are set in the variable block, not in .tfvars files.

Answer

All variables must be assigned a value before running terraform plan.

Answer

Variable values cannot be overridden using environment variables.

Answer

Default values for variables can only be set using a .tfvars file.

Question 12

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. Option D is correct because it leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 13

What will happen when this configuration is applied?

Accepted Answer

The instance will be modified in-place, potentially causing a reboot.. Option C is correct because the tilde (~) indicates an in-place update. Changing the instance type on AWS requires a stop/start, which results in a reboot but not a full destroy and recreate. Option A is incorrect because the plan shows an update, not a destroy/recreate (which would show -/+). Option B is incorrect because changing instance type typically requires a reboot, causing downtime. Option D is incorrect because the plan does not indicate any missing variables.

Answer

The plan will fail due to missing variables.

Answer

The instance will be destroyed and recreated.

Answer

The instance type will be changed without downtime.

Question 14

Which THREE of the following are valid methods to manage Terraform state in a team environment? (Choose three.)

Accepted Answer

Using a remote backend like S3 with DynamoDB locking. Option B is correct because using a remote backend like Amazon S3 with DynamoDB locking provides a centralized, durable, and consistent state storage solution. DynamoDB implements a distributed lock mechanism using conditional writes to prevent concurrent state modifications, ensuring state integrity in team environments.

Answer

Storing state in a version control system

Answer

Storing state locally and sharing via network drive

Question 15

A team uses Terraform Cloud for remote state management. They want to ensure that state file changes are only made through the Terraform Cloud API and not through direct access to the storage backend. Which feature should they enable?

Accepted Answer

Sentinel policy enforcement. Option A is correct because Sentinel policy enforcement allows the team to define rules that restrict direct modifications to the state file in the storage backend, ensuring that all state changes must go through the Terraform Cloud API. This prevents bypassing Terraform Cloud's access controls and audit logging, which is essential for maintaining integrity and compliance in remote state management.

Answer

Remote state locking

Answer

VCS integration

Answer

Team tokens

TF-003 Practice Test 27 — 15 Questions

Exhibit

TF-003 Practice Test 27 — 15 Questions

Exhibit