TF-004 Practice Test 29 — 15 Questions

Question 1

The user runs `terraform init` successfully, but then `terraform plan` still fails with a different error: "Error: No configuration files found in this directory." The directory contains backend.tf and main.tf. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is not in the same directory as the .tf files.. The error 'No configuration files found in this directory' indicates that Terraform cannot locate any .tf files in the current working directory. Even though the directory contains backend.tf and main.tf, the user must be in that directory when running `terraform plan`. This is a common path issue, not a configuration or syntax problem.

Answer

The backend block is misconfigured.

Answer

The workspace name in the backend configuration is incorrect.

Answer

The main.tf file contains invalid syntax.

Question 2

An organization uses a shared remote backend. They want to prevent concurrent apply operations that could corrupt the state. What built-in mechanism does Terraform provide?

Accepted Answer

State locking. Terraform's state locking mechanism prevents concurrent operations that could corrupt the state file by acquiring a lock on the backend before running `plan` or `apply`. When using a shared remote backend, the lock is held for the duration of the operation and released upon completion, ensuring only one process modifies the state at a time. Option D refers to state file versioning, which provides the ability to recover previous versions but does not prevent concurrent writes.

Answer

File permissions on the remote state file

Answer

Workspace isolation

Answer

State file versioning

Answer

Backend versioning

Question 3

Which of the following are core concepts or behaviors of Terraform's execution model and state management? (Choose four.)

Accepted Answer

Terraform uses a desired state model, where configuration defines the target state and Terraform determines the actions needed to reach it.. Terraform's execution model is fundamentally a desired state model: the configuration declares the target state, and Terraform computes the actions needed to reach it. The state file is the critical mapping between configuration and real-world resources, tracking metadata like dependencies and attributes. The plan phase produces a dry-run execution plan without making changes, while apply executes those changes and can be run directly without a saved plan file. These four behaviors—desired state, state file mapping, plan as dry-run, and apply as execution—are core to how Terraform operates.

Answer

Terraform refresh automatically updates the state file to match real-world infrastructure by modifying resources if differences are found.

Answer

Terraform destroy removes all resources defined in the configuration from the state file only, without affecting the actual infrastructure.

Question 4

Which three of the following are valid methods for reading, generating, or modifying Terraform configuration? (Choose three.)

Accepted Answer

Using the `terraform fmt` command to automatically update configuration files to a canonical format and style.. The `terraform fmt` command rewrites configuration files to a canonical format and style, which is a valid method for modifying configuration. The `templatefile` function reads a template file and renders it with supplied variables, enabling dynamic configuration generation. The `terraform console` command provides an interactive shell for evaluating expressions and inspecting resource attributes, which is a valid way to read and test configuration logic.

Answer

Using the `terraform state push` command to directly edit the state file and then reflect those changes back into the configuration.

Answer

Using the `merge` function to combine multiple map values, but only when the source maps are defined in separate Terraform modules.

Answer

Using the `terraform plan -generate-config-out` flag to automatically create configuration from existing infrastructure.

Question 5

Which TWO statements about Terraform's handling of input variables are true?

Accepted Answer

The terraform.tfvars file is automatically loaded by Terraform.. Options C and E are correct. Option C is correct because Terraform automatically loads terraform.tfvars and any *.auto.tfvars files in the working directory. Option E is correct because variables are declared using the 'variable' block in .tf files. Option A is incorrect: variables can have default values and are not required to be assigned before terraform plan. Option B is incorrect: variable values can be overridden using environment variables with the TF_VAR_ prefix. Option D is incorrect: default values are set within the variable block using the default argument, not in .tfvars files.

Answer

All variables must be assigned a value before running terraform plan.

Answer

Variable values cannot be overridden using environment variables.

Answer

Default values for variables can only be set using a .tfvars file.

Question 6

A DevOps engineer wants to modify the Terraform configuration to control resource lifecycle behavior. Which TWO meta-arguments can be used to influence the order of creation and destruction?

Accepted Answer

create_before_destroy. `create_before_destroy` is a meta-argument used within a `lifecycle` block to instruct Terraform to create a replacement resource before destroying the existing one, directly influencing the order of creation and destruction during updates. Option B is correct because `depends_on` explicitly sets dependencies between resources, ensuring that Terraform creates or destroys resources in a specific order based on those declared dependencies.

Answer

for_each

Answer

prevent_destroy

Answer

count

Question 7

After running `terraform state mv` to rename a resource, the resource's state binding is lost and the resource cannot be managed. Which command should be run to restore the state binding?

Accepted Answer

terraform import. After a failed `terraform state mv`, the resource mapping in the state may become corrupted or lost. To restore the binding, use `terraform import` to re-import the existing resource into the state. Option E, `terraform import`, is correct. Option D, `terraform refresh`, updates the state to match real infrastructure but does not restore a missing resource binding.

Answer

terraform state push

Answer

terraform state show

Answer

terraform state rm

Answer

terraform refresh

Question 8

When running terraform plan, the output indicates that a resource will be replaced (destroy then create) due to a change in the 'name' attribute. However, the engineer only changed a tag. What is the most likely cause?

Accepted Answer

The 'name' attribute is computed and any change to the resource forces replacement.. When a resource attribute is marked as 'computed' and 'ForceNew' in the Terraform provider schema, any change to that attribute—or, in some provider implementations, any change to the resource at all—triggers a destroy-and-create cycle. In this scenario, the engineer changed only a tag, but the provider has been configured to treat the entire resource as requiring replacement if any attribute changes, often because the 'name' attribute is computed from other inputs or because the provider's internal logic forces replacement on any update. This is a known behavior in certain Terraform providers where the 'name' attribute is set to 'Computed' and 'ForceNew' in the schema, causing any modification to the resource to result in a plan that shows replacement.

Answer

The tag change triggered a ForceNew attribute.

Answer

The resource has create_before_destroy enabled.

Answer

The underlying API does not support in-place updates.

Question 9

Refer to the exhibit. You need to add a security group to each instance. You have a local value defined as 'security_group_map = { "subnet-1" = "sg-1", "subnet-2" = "sg-2" }'. Which expression should be used to reference the security group ID in the resource block?

Accepted Answer

vpc_security_group_ids = [local.security_group_map[var.subnet_ids[count.index]]]. It properly references the local value `security_group_map` using the `local.` prefix, which is required in Terraform to access local values. It then uses the subnet ID from `var.subnet_ids[count.index]` as the key to look up the corresponding security group ID. This ensures each instance gets the correct security group based on its subnet index.

Answer

vpc_security_group_ids = [lookup(security_group_map, var.subnet_ids[count.index])]

Answer

vpc_security_group_ids = [security_group_map[var.subnet_ids[count.index]]]

Answer

vpc_security_group_ids = [lookup(local.security_group_map, var.subnet_ids[count.index])]

Question 10

Which THREE files are considered part of the standard module structure?

Accepted Answer

main.tf. `main.tf` is the primary entry point for defining the core resources and data sources in a Terraform module. It is one of the three mandatory files (along with `variables.tf` and `outputs.tf`) that constitute the standard module structure, as specified by HashiCorp's module best practices.

Answer

backend.tf

Answer

terraform.tfvars

Question 11

A developer accidentally deletes the local terraform.tfstate file. The backend is configured to store state remotely in an S3 bucket. What is the effect on Terraform operations?

Accepted Answer

Terraform will automatically recover the state from the remote backend on the next plan or apply.. When a remote backend (e.g., S3) is configured, Terraform stores the state file in the remote location and maintains a local copy as a cache. Deleting the local terraform.tfstate file does not affect the remote state. On the next plan or apply, Terraform automatically pulls the latest state from the remote backend, effectively recovering it without data loss or manual intervention.

Answer

Terraform will create a new empty state file, losing all existing managed resources.

Answer

Terraform will fail with an error because the local state is missing.

Answer

Terraform will prompt the user to confirm whether to use the remote state.

Question 12

A team uses Terraform with a remote backend that stores state in Azure Storage. A developer runs terraform apply and receives an error: 'Error refreshing state: state data in Azure Blob does not have expected content.' What is the most likely cause?

Accepted Answer

The state file was manually edited.. The error 'state data in Azure Blob does not have expected content' indicates that Terraform's internal consistency check failed when reading the state file. This typically occurs when the state file has been manually edited outside of Terraform, corrupting its JSON structure or checksum. Terraform expects the state to be in a specific format and will reject any blob content that does not match its expected schema or hash.

Answer

The Azure Storage account access key has expired.

Answer

The blob name contains uppercase letters.

Answer

The Terraform version is incompatible with the backend.

Question 13

A company uses Terraform Cloud and wants to enforce policies that prevent creating resources with public IP addresses unless explicitly approved. What Terraform Cloud feature should they use?

Accepted Answer

Sentinel policies. Sentinel is HashiCorp's policy-as-code framework that integrates directly with Terraform Cloud. It allows you to define fine-grained, logic-based policies (e.g., 'deny resources with public IPs unless a specific approval tag is present') that are enforced during the plan phase before any resources are created. This is the correct feature for enforcing custom governance rules on infrastructure provisioning.

Answer

VCS integration

Answer

Workspaces

Answer

Run tasks

Question 14

A company uses Terraform Cloud and wants to enforce policies that all EC2 instances must be of type t2.micro or t2.small. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies are HashiCorp's policy-as-code framework integrated with Terraform Cloud. They allow organizations to define fine-grained, logic-based rules that are enforced during the plan phase, such as restricting EC2 instance types to t2.micro or t2.small. This is the correct feature because it provides mandatory, automated policy enforcement across all workspaces, ensuring compliance before any infrastructure is provisioned.

Answer

Run tasks

Answer

Cost estimation

Answer

Terraform validate

Question 15

Which THREE of the following are capabilities of Terraform Cloud's Sentinel policy framework? (Choose three.)

Accepted Answer

Enforce that resources have mandatory tags. Terraform Cloud's Sentinel policy framework allows you to define policy-as-code rules that can enforce mandatory tags on resources. By writing a Sentinel policy that checks for the presence of specific tags (e.g., 'Environment', 'Owner') during the plan phase, you can block or warn on any resource creation that lacks those tags, ensuring compliance with organizational tagging standards.

Answer

Block Terraform runs based on the time of day

Answer

Estimate the cost of infrastructure changes