TF-004 Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. A team deploys this configuration. They run 'terraform apply' once and the instance is created. Later, they modify the instance type and run 'terraform apply' again. They notice the provisioner does not run on the second apply. Why?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provisioners run only when the resource is created, not on subsequent updates.. Provisioners in Terraform are designed to run only during resource creation, not during subsequent updates. When the instance type is modified and 'terraform apply' is run again, Terraform updates the existing resource in place without triggering the provisioner again. This behavior is intentional because provisioners are typically used for initial setup tasks like bootstrapping, not for ongoing configuration changes.

Answer

Provisioners run only when the resource is destroyed.

Answer

The provisioner should be 'remote-exec' to run on updates.

Answer

The command syntax is incorrect.

Question 2

Which of the following is NOT a valid backend type for storing Terraform state?

Accepted Answer

kubernetes. Kubernetes is not a valid backend type for storing Terraform state. Terraform backends determine where state is stored and how operations are executed; the officially supported backends include local, remote backends like S3, HTTP, and Terraform Cloud, but Kubernetes is not among them. While Kubernetes can be used to run Terraform in a pod, it does not serve as a state storage backend.

Answer

terraform cloud

Answer

local

Answer

s3

Answer

http

Question 3

Which TWO of the following are valid ways to use Terraform outside the core workflow? (Choose two.)

Accepted Answer

Using Terraform outputs as inputs for other tools like Ansible.. Terraform outputs can be consumed by other tools like Ansible via the `terraform output` command or by referencing the state file, enabling integration in multi-tool workflows. Option E is correct because the Terraform state file (`.tfstate`) contains all resource attributes and dependencies, which can be parsed programmatically or with tools like `terraform graph` to generate infrastructure diagrams, extending Terraform's use beyond provisioning.

Answer

Using Terraform to manage application secrets lifecycle.

Answer

Using Terraform to install software on existing servers.

Answer

Using Terraform as a CI/CD pipeline tool.

Question 4

A developer creates a module in a subdirectory of their Terraform configuration and wants to reference it from the root module. The directory structure is: /terraform-project/modules/networking. Which source argument should they use in the module block?

Accepted Answer

source = "./modules/networking". Terraform resolves local module paths relative to the root module's directory. The path `./modules/networking` correctly references the `networking` subdirectory within the `modules` folder, starting from the root of the Terraform configuration. This is the standard syntax for referencing a local module in a subdirectory.

Answer

source = "file:///terraform-project/modules/networking"

Answer

source = "/terraform-project/modules/networking"

Answer

source = "hashicorp/networking/aws"

Question 5

After running `terraform plan`, the user receives an error: `Error: Missing required variable`. The variable 'vpc_cidr' is provided. What is the most likely cause?

Accepted Answer

The module requires a variable 'environment' that is not passed.. The error 'Missing required variable' indicates that a variable required by the module has not been provided. Even though 'vpc_cidr' is supplied, the module likely defines a required input variable named 'environment' without a default value, and the user did not pass it in the module block. Terraform enforces that all required variables without defaults must be explicitly set by the caller.

Answer

The module block syntax is incorrect.

Answer

The variable 'vpc_cidr' is misspelled.

Answer

The variable 'vpc_cidr' conflicts with a provider variable.

Question 6

A Terraform module defines an output 'instance_ips'. In the root module, how should this value be referenced?

Accepted Answer

module.my_module.instance_ips. Outputs from a child module are accessed in the root module using the `module..` syntax. The `module` keyword is a reserved reference that Terraform uses to expose all outputs defined within a module block, allowing the root configuration to consume values like `instance_ips` as `module.my_module.instance_ips`.

Answer

var.instance_ips

Answer

local.instance_ips

Answer

resource.my_module.instance_ips

Question 7

A developer creates a module in a subdirectory called 'networking' relative to the root module. How should the module source be specified in the root module?

Accepted Answer

./networking. When referencing a local module in a subdirectory relative to the root module, the correct path prefix is './' followed by the subdirectory name. Option A, './networking', correctly uses a relative path starting with './' to indicate the 'networking' directory is a child of the root module's directory. This is the standard Terraform convention for local module sources.

Answer

./modules/networking

Answer

../networking

Answer

networking

Question 8

Which Terraform command is used to check the syntax and internal consistency of configuration files?

Accepted Answer

terraform validate. The `terraform validate` command checks the syntax and internal consistency of Terraform configuration files, ensuring that the code is syntactically valid and that references between resources, data sources, and variables are correct. It does not access remote state or providers, making it a fast, offline validation step. This is the correct command for verifying configuration correctness before applying changes.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform graph

Question 9

A team is evaluating Terraform for managing their multi-cloud infrastructure. Which TWO statements accurately describe Terraform's purpose and capabilities? (Choose two.)

Accepted Answer

Terraform can provision, update, and destroy infrastructure resources across multiple providers.. Terraform is designed as an infrastructure-as-code tool that can provision, update, and destroy resources across multiple cloud providers (e.g., AWS, Azure, GCP) and other services using a declarative configuration. This multi-provider capability is a core differentiator from single-cloud tools, enabling consistent workflows for hybrid and multi-cloud environments.

Answer

Terraform requires all configuration files to be placed in a single directory named 'terraform'.

Answer

Terraform uses an imperative language to specify the exact steps to create resources.

Answer

Terraform is primarily a configuration management tool for installing software on servers.

Question 10

Which four of the following are valid techniques for reading, generating, or modifying Terraform configuration? (Choose all that apply. There are four correct answers.)

Accepted Answer

Using the `jsonencode` function within a `local` value to programmatically construct a JSON string that is then used as part of a resource argument.. The `templatefile` function is a valid technique for reading and generating configuration because it reads an external template file and renders it with variables from the current Terraform configuration, producing a string that can be used in resource arguments or other expressions. This is a core feature for dynamic configuration generation, such as injecting user data into cloud-init scripts or generating complex configuration files for provisioned resources.

Answer

Using `terraform state pull` to retrieve remote state and then using `terraform state mv` to rename a resource address in the local state file before pushing it back.

Answer

Using `terraform console` to evaluate expressions and generate valid HCL configuration output.

Question 11

A team is using a remote backend in Terraform Cloud. After a failed apply, the state file is locked. The team lead wants to unlock the state immediately. What should be done?

Accepted Answer

Run terraform force-unlock with the lock ID. The `terraform force-unlock` command with the lock ID is the correct way to manually unlock a state file in Terraform Cloud after a failed apply. This command overrides the backend's lock mechanism, which is designed to prevent concurrent modifications and state corruption. Deleting or editing the state file would bypass Terraform's safety guarantees and risk data loss or inconsistency.

Answer

Delete the state file from the backend and reinitialize

Answer

Manually edit the state file to remove the lock

Answer

Run terraform unlock

Question 12

A developer runs terraform plan and sees that a resource will be destroyed. They want to confirm the exact cause of the destruction before applying. What should they do?

Accepted Answer

Run terraform show after plan.. Running `terraform show` after `terraform plan` displays the plan output in a human-readable format, including the full set of changes (create, update, destroy) and the attributes that triggered them. This allows the developer to inspect the exact reason a resource is marked for destruction, such as a changed required argument or a removed configuration block. It is the standard way to review plan details without applying.

Answer

Review the state file directly.

Answer

Run terraform validate.

Answer

Run terraform graph.

Question 13

A team member runs terraform apply with the configuration shown in the exhibit. The apply succeeds, but the output of the local-exec provisioner shows an empty string for the public IP address. What is the most likely cause?

Accepted Answer

The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.. The `local-exec` provisioner runs on the machine executing Terraform, not on the AWS instance itself. If the instance is launched in a default VPC without `auto-assign public IP` enabled and no Elastic IP is attached, the `self.public_ip` attribute will be an empty string. The provisioner then outputs that empty string, as it simply reads the attribute value from the resource state.

Answer

There is a dependency cycle between the aws_instance and null_resource causing Terraform to skip the provisioner.

Answer

The local-exec provisioner only runs during terraform destroy, not during apply.

Answer

The provisioner cannot access the aws_instance resource's attributes because it is defined in a separate resource block.

Question 14

An organization uses Terraform to provision infrastructure and then Ansible to configure it. They want to pass dynamic IP addresses from Terraform to Ansible. What is a recommended approach?

Accepted Answer

Use terraform output -json and parse it in Ansible as an inventory.. `terraform output -json` produces JSON output that can be parsed by Ansible to dynamically build an inventory. This approach is simple, directly uses Terraform's built-in output, and avoids additional infrastructure. Option A is incorrect: while environment variables can pass simple strings, they are less suitable for structured data like multiple IP addresses and are not the recommended pattern. Option B is incorrect: `terraform_remote_state` is designed for fetching outputs from other Terraform configurations, not for exposing data to external tools like Ansible. Option C is incorrect: using Consul KV store introduces unnecessary complexity and external dependencies; the direct `terraform output` approach is simpler and more maintainable.

Answer

Use environment variables in the pipeline to pass IP addresses.

Answer

Use the terraform_remote_state data source in a dummy Terraform configuration.

Answer

Store outputs in Consul KV store and have Ansible read from there.

Question 15

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

Accepted Answer

Configure Terraform Cloud with run triggers and policy checks. Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer

Store state in a remote backend and use terraform apply in the pipeline

Answer

Use the Terraform CLI in the CI/CD pipeline with remote state

Answer

Run terraform apply locally after manual approval