TF-004 Practice Test 28 — 15 Questions

Question 1

A company wants to ensure that Terraform configurations are consistent across teams. What practice should they adopt?

Accepted Answer

Use modules from a registry. Using modules from a registry (Option B) is the correct practice because modules encapsulate reusable, version-controlled infrastructure configurations that enforce consistency across teams. By referencing a shared registry, teams can standardize on approved module versions, reducing drift and ensuring compliance with organizational policies. This approach aligns with Terraform's best practices for code reuse and collaboration.

Answer

Write all code in a single file

Answer

Use provisioners extensively

Answer

Avoid using variables

Question 2

Match each Terraform function to its category.

Accepted Answer

max(): numeric. Terraform functions are categorized by the type of data they operate on. The correct matches are: max() (numeric), lower() (string), and concat() (collection). Common confusions include misclassifying functions across categories.

Answer

max(): string

Answer

lower(): collection

Question 3

Match each Terraform cloud/enterprise feature to its purpose.

Accepted Answer

Workspaces: Manage multiple environments with separate state and variables.. Workspaces isolate state and variables per environment, Sentinel enforces policies, and Run Tasks integrate third-party tools. Common confusions include mixing the roles of Workspaces and Remote State, or Sentinel with Workspaces.

Answer

Workspaces: Store and share remote state files for collaboration.

Answer

Sentinel: Provide collaborative infrastructure management with separate environments.

Question 4

Which TWO statements about Terraform configuration files are correct? (Choose two.)

Accepted Answer

A file named terraform.tfvars is automatically processed.. Options B and E are correct. Terraform automatically processes a file named terraform.tfvars if it exists in the configuration directory, making option B correct. Variable definitions files can also have a .tfvars.json extension, as stated in option E. Option A is incorrect because Terraform does not load .tf files from subdirectories by default; only the root directory is scanned. Option C is incorrect because the backend configuration does not have to be defined in the same file as the provider configuration; they can be in separate files. Option D is incorrect because the -var-file flag does not accept a comma-separated list; you must use multiple -var-file flags to specify multiple variable files.

Answer

All .tf files in subdirectories are automatically loaded.

Answer

The backend configuration must be defined in the same file as the provider configuration.

Answer

The -var-file flag accepts a comma-separated list of variable files.

Question 5

Drag and drop the steps to handle sensitive data in Terraform outputs in the correct order.

Accepted Answer

First, define the output as sensitive. Next, run terraform apply. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.. Sensitive outputs are redacted in CLI; -json reveals raw value for secure handling.

Answer

First, run terraform apply. Next, define the output as sensitive. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, use terraform output -json to retrieve the raw value. Then, run terraform apply. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, run terraform apply. Then, securely handle the raw value. Finally, use terraform output -json to retrieve the raw value.

Question 6

Which THREE of the following are valid Terraform providers?

Accepted Answer

hashicorp/azurerm. All four options A, B, C, D are valid Terraform providers. Options A (hashicorp/azurerm), C (hashicorp/kubernetes), and D (hashicorp/aws) are official HashiCorp providers. Option B (kreuzwerker/docker) is a well-known community provider for Docker. The question asks for 'valid' providers, which includes both official and community providers. Option E (hashicorp/cloudwatch) is not a valid standalone provider because CloudWatch is a service within AWS and is managed by the hashicorp/aws provider.

Answer

hashicorp/cloudwatch

Question 7

Which THREE of the following are valid reasons to use 'terraform refresh'? (Choose three.)

Accepted Answer

To update the state file when resources were deleted outside of Terraform.. The `terraform refresh` command updates the state file to match real-world infrastructure. Option A is correct because if resources were deleted outside Terraform, refresh removes them from state. Option B is correct because refresh detects drift by comparing state with actual infrastructure. Option D is correct because manual changes to resources are recorded in state after refresh. Option C is incorrect because importing infrastructure requires `terraform import`, not refresh. Option E is incorrect because refresh updates the state file, not the Terraform configuration.

Answer

To import existing infrastructure into Terraform management.

Answer

To update the Terraform configuration with current resource settings.

Question 8

Which TWO statements about Infrastructure as Code (IaC) are correct?

Accepted Answer

IaC enables automated provisioning and management of infrastructure.. Infrastructure as Code (IaC) automates the provisioning and management of infrastructure through machine-readable definition files, enabling consistent and repeatable deployments without manual intervention. Tools like Terraform use a declarative approach to define resources, and the IaC engine handles creation, modification, and deletion based on the desired state. Option D is correct because IaC configurations are idempotent—applying the same configuration multiple times yields the same result. This is achieved through state management and drift detection, ensuring that infrastructure remains in the specified state regardless of how many times the configuration is applied.

Answer

IaC is only applicable to cloud-based infrastructure.

Answer

IaC eliminates configuration drift entirely.

Answer

IaC tools require manual execution of scripts.

Question 9

You are managing a multi-environment Terraform configuration using separate workspaces for 'dev', 'staging', and 'prod'. Each workspace uses the same root module but different variable values stored in terraform.tfvars files per workspace. Your team reports that after a recent change to the root module, running `terraform plan` in the 'dev' workspace shows that it will destroy and recreate a critical RDS database instance, even though no changes were made to the database configuration. The state file for 'dev' is stored in a remote S3 backend with DynamoDB locking. You suspect the issue is related to how Terraform generates and reads configuration. What is the most likely cause?

Accepted Answer

A new variable with a default value that forces recreation of the database was added to the root module, but the 'dev' workspace's tfvars file does not override it, so Terraform uses the default which differs from the current state.. When a new variable with a default value is added to the root module, and the 'dev' workspace's terraform.tfvars does not override it, Terraform uses the default value. If that default differs from the value currently tracked in the state (e.g., a database engine version or instance class), Terraform interprets this as a configuration change and plans to destroy and recreate the resource to match the new default. This is a common pitfall when variables are introduced without updating all workspace-specific variable files.

Answer

The S3 backend is misconfigured, causing the 'dev' workspace to use the 'prod' state file.

Answer

The root module was changed to use a different Terraform provider version that is incompatible with the existing state.

Answer

The DynamoDB lock is not being released after previous operations, causing state corruption.

Question 10

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 11

Refer to the exhibit. An engineer sees this error. Which command should they run to force-unlock?

Accepted Answer

terraform force-unlock 123456. `terraform force-unlock <LOCK_ID>` is the exact command Terraform provides to manually release a state lock when the automatic unlocking mechanism fails (e.g., after a crash or network interruption). The lock ID is a unique identifier assigned by the backend (such as DynamoDB or Consul) when the lock was acquired, and this command bypasses the normal safety checks to force the unlock.

Answer

terraform force-unlock my-company-terraform-state/prod/terraform.tfstate

Answer

terraform unlock -id=123456

Answer

terraform state unlock 123456

Answer

terraform init -force-unlock=123456

Question 12

During a `terraform apply`, the operation fails mid-way due to a network outage, leaving some resources created. The operator wants to resume applying from where it left off without destroying the already-created resources. What should they do?

Accepted Answer

Run terraform apply again. Terraform uses a state file to track the resources it manages. When `terraform apply` fails mid-way, the state file is updated to reflect the resources that were successfully created. Running `terraform apply` again will cause Terraform to compare the current state with the configuration, detect that the already-created resources exist, and proceed to create only the remaining resources, effectively resuming from where it left off without destroying anything.

Answer

Run terraform destroy and then apply

Answer

Run terraform refresh

Answer

Run terraform apply -auto-approve

Question 13

A user wants to use a remote state backend for the first time. After adding the backend configuration, which command must they run to migrate the state from local to remote?

Accepted Answer

`terraform init`. When you add a remote backend configuration to your Terraform code, `terraform init` is the required command to initialize the backend and migrate the existing local state file to the remote backend. During initialization, Terraform detects the backend change, prompts for confirmation, and automatically copies the state from the local `terraform.tfstate` to the configured remote store (e.g., S3, Azure Storage, or Terraform Cloud). Without running `init`, the remote backend is not configured and local state remains unchanged.

Answer

`terraform plan`

Answer

`terraform apply`

Answer

`terraform state push`

Question 14

Which TWO are valid methods to import existing infrastructure into Terraform?

Accepted Answer

Run 'terraform import' with the resource address and ID.. `terraform import` is the primary command for bringing existing infrastructure under Terraform management. It requires both the resource address (as defined in your configuration) and the provider-specific ID of the real-world object. This command maps the existing resource into the Terraform state, enabling subsequent `apply` operations to manage it.

Answer

Use 'terraform state rm' to remove existing state before running apply.

Answer

Use 'terraform console' to inspect and import.

Answer

Use 'terraform init -migrate-state' to import from another backend.

Question 15

A team is using a module from the Terraform Registry. When they run 'terraform init', they receive an error stating that the module source cannot be downloaded. The module source is correct. What is the most likely cause?

Accepted Answer

The internet connection is down.. The error 'module source cannot be downloaded' occurs during terraform init when Terraform tries to fetch the module from the registry but cannot reach it. Since the module source is correct, the most likely cause is a network connectivity issue, such as the internet being down. The other options are less likely: A (output variable misspellings) would not prevent downloading; B (provider version conflict) would cause a different error later; D (forgotten init) is illogical because the error occurs while running init.

Answer

The module output variable names are misspelled.

Answer

The provider version in the module conflicts with the root provider version.

Answer

The user forgot to run 'terraform init' before 'terraform plan' or 'apply'.