TF-004 Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. An operator runs terraform plan and gets the following output. They have not modified the Terraform configuration since the last successful apply. What is the most likely cause of the planned changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance was modified manually via the AWS console.. When terraform plan shows changes but the configuration was not modified, the most common cause is out-of-band drift — someone changed the resource directly in the AWS console (or via CLI/another tool), so the real infrastructure no longer matches the recorded state. Terraform compares desired config to state, and state to real resources, so manual changes surface as planned updates to bring the resource back to the declared configuration.

Answer

Terraform provider was updated to a new version.

Answer

The instance was terminated and recreated.

Answer

Terraform state was corrupted.

Question 2

A DevOps team manages infrastructure for a large e-commerce platform using Terraform with a remote backend in an S3 bucket with DynamoDB state locking. Recently, a team member ran `terraform apply` from their local machine but the command failed with the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. The state file is not locked according to the DynamoDB table. After investigation, the team finds that the DynamoDB table has a TTL attribute enabled on the 'LockID' field, and old lock records are automatically deleted after a few minutes. The team suspects that another engineer's `terraform plan` process from a CI/CD pipeline might have created a lock that was subsequently deleted by TTL before it was released, causing the conflict. Which action should the team take to prevent this issue from recurring?

Accepted Answer

Disable the TTL attribute on the DynamoDB table that stores lock information.. The error occurs because the DynamoDB table has a TTL attribute that automatically deletes lock records before the lock is released. Disabling TTL on the DynamoDB table ensures lock records persist until the lock is intentionally released, preventing false lock conflicts. Option A is incorrect because local state eliminates locking and central management. Option C is incorrect because increasing TTL only delays deletion but does not guarantee the lock won't be deleted during a long-running operation. Option D is incorrect because force-unlock is a manual recovery step, not a preventive measure.

Answer

Switch to using local state files to avoid the locking issue entirely.

Answer

Increase the TTL value to 24 hours to ensure locks are not deleted during normal operations.

Answer

Use `terraform force-unlock` before each `terraform apply` to clear any stale locks.

Question 3

You are a DevOps engineer at a growing startup. The infrastructure currently consists of a single AWS EC2 instance running a web application, manually configured. The company plans to scale to multiple instances and environments (development, staging, production). They want to adopt Infrastructure as Code using Terraform. The team has limited experience with Terraform and wants to start small, then gradually adopt more advanced features. The current manual infrastructure must be imported into Terraform. The team also wants to ensure that code changes are reviewed via pull requests before being applied. Which of the following is the best course of action to meet these requirements?

Accepted Answer

Create a Git repository with a main branch. Write a minimal Terraform configuration that describes the existing EC2 instance. Use terraform import to bring the instance under Terraform management. Store the state file remotely in S3 with DynamoDB locking. Set up a CI pipeline that runs terraform plan on pull requests and requires approval before merging.. It follows the best practices for adopting Infrastructure as Code with Terraform in a team setting. It starts by writing a minimal configuration that matches the existing EC2 instance, uses `terraform import` to bring it under management without downtime, stores state remotely in S3 with DynamoDB locking for collaboration and consistency, and sets up a CI pipeline to run `terraform plan` on pull requests with approval gates, ensuring code review before changes are applied.

Answer

Install Terraform on the existing instance, run terraform init and apply directly to manage it, and store state locally. Have team members share the state file via a shared folder.

Answer

Write Terraform configuration from scratch to match the existing instance, but do not import; instead, destroy the old instance and recreate it with Terraform.

Answer

Create separate Git branches for each environment (dev, staging, prod) and have each team member work independently on their branch, merging occasionally.

Question 4

In Terraform, which command is used to format configuration files according to the HCL canonical style?

Accepted Answer

terraform fmt. `terraform fmt` is the dedicated Terraform CLI command that rewrites configuration files to adhere to the HCL canonical style, ensuring consistent formatting (e.g., indentation, alignment of equals signs). It does not modify the logic or state of the configuration, only its visual layout.

Answer

terraform plan

Answer

terraform init

Answer

terraform validate

Answer

terraform apply

Question 5

A Terraform plan shows that an AWS EC2 instance will be destroyed and recreated. The team wants to ensure zero downtime during the update. Which lifecycle attribute should be added?

Accepted Answer

create_before_destroy. `create_before_destroy` is a lifecycle attribute that instructs Terraform to create the replacement resource first, then destroy the old one. This ensures that the new EC2 instance is fully operational before the original is terminated, achieving zero downtime during the update.

Answer

depends_on

Answer

ignore_changes

Answer

prevent_destroy

Question 6

A company uses Terraform to deploy virtual machines. They want to ensure that the same exact operating system and software versions are used every time. Which practice supports this?

Accepted Answer

Using a golden image and referencing it in the configuration. Using a golden image—a pre-configured virtual machine template containing the exact operating system and software versions—ensures consistency across deployments. Terraform can reference this image via the `source_image` or `image_id` argument in a resource like `azurerm_virtual_machine` or `aws_instance`, guaranteeing that every provisioned VM starts from the same immutable baseline.

Answer

Manually installing software

Answer

Using inline userdata scripts

Answer

Running configuration management after provisioning

Question 7

Which Terraform command is used to validate the syntax of configuration files without accessing any cloud provider?

Accepted Answer

terraform validate. `terraform validate` checks syntax and internal consistency of configuration files. `init` initializes backends and providers, `plan` accesses remote state, `fmt` formats code.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform init

Question 8

Which TWO of the following are core components of Terraform's workflow? (Select TWO.)

Accepted Answer

terraform init. Terraform's core workflow consists of three main steps: init, plan, and apply. `terraform init` initializes the working directory by downloading the required providers and modules, setting up the backend, and preparing the environment for configuration. `terraform plan` creates an execution plan showing what actions Terraform will take to reach the desired state, allowing you to preview changes before applying them.

Answer

terraform validate

Answer

terraform install

Answer

terraform destroy

Question 9

Which THREE of the following are best practices for managing Terraform state?

Accepted Answer

Use remote backends to store state files. Option B is correct because remote backends (e.g., S3, GCS, Azure Blob, or Terraform Cloud) store state centrally so teams share a single source of truth, keep sensitive state off local disks, and enable collaboration and locking. Option C is correct because enabling versioning on the state storage backend (such as S3 bucket versioning) preserves prior state revisions, allowing recovery from corruption or accidental deletion and providing an audit trail. Option E is correct because state locking (e.g., DynamoDB for S3 backends or native locking in Terraform Cloud) prevents concurrent runs from simultaneously writing state, which would otherwise corrupt it or cause lost updates. Option A is not a best practice: directly editing state files bypasses Terraform's integrity checks and can corrupt the state; drift should be reconciled with 'terraform plan/apply' or 'terraform import'/'state rm' commands. Option D is not a best practice: local state storage risks loss, blocks team collaboration, and prevents locking, so network latency is an acceptable trade-off for a remote backend.

Answer

Edit state files directly to fix drift

Answer

Store state files locally to avoid network latency

Question 10

A company has a Terraform configuration that creates many AWS resources. They want to check the estimated cost of the plan before applying. Which approach should they use?

Accepted Answer

Enable cost estimation in Terraform Cloud.. Terraform Cloud provides a built-in cost estimation feature that analyzes the resources in a plan against current cloud provider pricing APIs to estimate monthly costs. This is the recommended approach because it is integrated directly into the Terraform workflow and does not require manual parsing or external scripts. Option C is correct because it leverages Terraform Cloud's native capability to estimate costs before applying.

Answer

Use 'terraform plan -cost' command.

Answer

Manually use 'terraform show -json' and parse pricing.

Answer

Use 'terraform validate' with a custom script.

Question 11

A team wants to import an existing AWS S3 bucket named 'my-bucket' into Terraform state. The resource block is defined as 'aws_s3_bucket.my_bucket'. Which command should be used?

Accepted Answer

terraform import aws_s3_bucket.my_bucket my-bucket. The correct syntax for `terraform import` is `terraform import `, where the resource address is the Terraform resource block identifier (e.g., `aws_s3_bucket.my_bucket`) and the ID is the actual AWS resource identifier (e.g., the bucket name `my-bucket`). Option C follows this exact order: `terraform import aws_s3_bucket.my_bucket my-bucket`, making it the correct command to import the existing S3 bucket into Terraform state.

Answer

terraform import my-bucket aws_s3_bucket.my_bucket

Answer

terraform import 'aws_s3_bucket.my_bucket' 'my-bucket'

Answer

terraform import aws_s3_bucket.my-bucket my-bucket

Question 12

A team uses a remote backend (S3) with state locking via DynamoDB. One team member runs terraform apply and it fails mid-way. Another team member immediately tries to run terraform plan. What is likely to happen?

Accepted Answer

The plan will fail with an error indicating the state is locked.. Terraform's remote backend with DynamoDB state locking acquires a lock at the start of `terraform apply` and does not release it until the operation completes or is explicitly unlocked. If the apply fails mid-way, the lock remains held (it is not automatically released on failure). Therefore, when another team member immediately runs `terraform plan`, the plan command will attempt to acquire the lock, fail, and return an error indicating the state is locked.

Answer

The plan will run successfully because the lock is automatically released after failure.

Answer

The plan will run but the state file will be corrupted.

Answer

The plan will run successfully and show any partial changes.

Question 13

An organization uses Terraform Cloud for team collaboration. They have a workspace that manages production infrastructure. Due to a security policy, they must ensure that all changes go through a peer review process before they are applied. How can they enforce this requirement?

Accepted Answer

Enable 'apply on merge' and set the workspace to require approval before applying.. Enabling 'apply on merge' combined with requiring approval before applying enforces a peer review process: changes must be merged via a VCS pull request (triggering the plan), and then a separate approval step is needed before Terraform Cloud applies the changes. This ensures that no change is applied without explicit human approval after the plan is reviewed.

Answer

Require all changes to be submitted via a VCS pull request.

Answer

Use run triggers to automatically apply after a successful plan in another workspace.

Answer

Lock the workspace and only unlock it for approved changes.

Question 14

A junior DevOps engineer is asked to explain the primary purpose of Terraform. Which statement best describes Terraform's purpose?

Accepted Answer

Terraform is an infrastructure provisioning tool that manages cloud and on-premises resources using declarative configuration.. Terraform is an infrastructure provisioning tool that uses declarative configuration (HashiCorp Configuration Language, HCL) to define and manage both cloud and on-premises resources. Its primary purpose is to provision infrastructure—such as virtual machines, networks, and storage—across multiple providers (e.g., AWS, Azure, GCP) by maintaining a desired state and applying changes via execution plans. Unlike configuration management or scripting tools, Terraform focuses on the lifecycle of infrastructure resources, not on configuring software within those resources.

Answer

Terraform is a monitoring tool that tracks infrastructure changes.

Answer

Terraform is a scripting tool for automating manual tasks in cloud environments.

Answer

Terraform is a configuration management tool that installs and configures software on servers.

Question 15

A team is using a remote backend in Terraform Cloud. After a failed apply, the state file is locked. The team lead wants to unlock the state immediately. What should be done?

Accepted Answer

Run terraform force-unlock with the lock ID. The `terraform force-unlock` command with the lock ID is the correct way to manually unlock a state file in Terraform Cloud after a failed apply. This command overrides the backend's lock mechanism, which is designed to prevent concurrent modifications and state corruption. Deleting or editing the state file would bypass Terraform's safety guarantees and risk data loss or inconsistency.

Answer

Delete the state file from the backend and reinitialize

Answer

Manually edit the state file to remove the lock

Answer

Run terraform unlock