TF-003 Practice Test 30 — 15 Questions

Question 1

What is the most likely cause of this error?

Accepted Answer

The AWS credentials used do not have permission to launch EC2 instances.. The error is most likely caused by insufficient AWS permissions because Terraform uses the configured AWS credentials to make API calls. If the IAM user or role lacks the `ec2:RunInstances` permission, the API will return an authorization error, even if the configuration is syntactically correct and the AMI/instance type are valid.

Answer

The Terraform configuration has a syntax error.

Answer

The instance type 't2.micro' is not available in the region.

Answer

The AMI ID is invalid or does not exist in the region.

Question 2

A developer runs `terraform plan` and receives the error: "Error: Unsupported argument; An argument named 'enable_vpn_gateway' is not expected here." What is the most likely cause?

Accepted Answer

The module version 5.0.0 does not support the 'enable_vpn_gateway' argument.. Option D is correct because the error 'Unsupported argument' indicates that the module version currently in use does not define an input variable named 'enable_vpn_gateway'. In Terraform, each module version has a fixed set of input variables; if you attempt to pass an argument that is not declared in the module's variables.tf, Terraform will reject it. The most common reason for this is that the module version has been updated or changed, and the argument was removed or renamed in that version.

Answer

The source address is misspelled 'vpc' instead of 'vpc/aws'.

Answer

The source module is not pinned to a specific version, so it may have changed.

Answer

The module must be sourced from a different registry or repository.

Question 3

An organization uses Terraform Cloud to manage infrastructure across multiple teams. They need to enforce that all workspaces use a specific version of Terraform and that no workspace can be deleted accidentally. Which approach meets these requirements without using Sentinel or Terraform Enterprise?

Accepted Answer

Use the Terraform Cloud API to write an OPA policy that enforces Terraform version and prevents workspace deletion.. Option C is correct because the Terraform Cloud API allows you to write OPA (Open Policy Agent) policies that can enforce Terraform version constraints and prevent workspace deletion, even without Sentinel or Terraform Enterprise. OPA policies are evaluated during runs and API calls, providing a flexible, code-based approach to governance that meets both requirements.

Answer

Include `required_version` in each workspace's root module and configure workspace locks in the UI.

Answer

Set `required_providers` with version constraints in a global Terraform file.

Answer

Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.

Question 4

What is the most likely cause of this error?

Accepted Answer

The `depends_on` meta-argument is missing from the aws_eip resource.. Option C is correct because the `aws_eip` resource depends on the `aws_instance.web` resource to ensure the instance is created before the Elastic IP is allocated. Without an explicit `depends_on` meta-argument, Terraform may attempt to create the EIP before the instance, causing an error if the instance ID is not yet available. The error message typically indicates that the `aws_eip` resource cannot resolve the `instance` argument because the instance resource has not been created yet.

Answer

The `output` block is referencing a non-existent attribute.

Answer

The `aws_eip` resource must use `self.instance` instead of `aws_instance.web.id`.

Answer

The `aws_instance.web` resource has a syntax error in the ami attribute.

Question 5

A company wants to manage its infrastructure as code using Terraform. The team has a mix of on-premises servers and cloud resources in AWS and Azure. Which of the following best describes Terraform's purpose in this scenario?

Accepted Answer

Terraform is an infrastructure-as-code tool for provisioning and managing any infrastructure across multiple providers.. Option D is correct because Terraform is explicitly designed as an infrastructure-as-code tool that uses declarative configuration files to provision and manage resources across multiple providers, including on-premises servers (via providers like vSphere or Hyper-V) and cloud platforms like AWS and Azure. Its provider model allows it to abstract away the underlying APIs, making it provider-agnostic and suitable for hybrid environments.

Answer

Terraform is a configuration management tool for installing software on existing servers.

Answer

Terraform is a cloud-specific orchestration tool that only works with AWS.

Answer

Terraform is a monitoring and logging tool for cloud resources.

Question 6

Which TWO actions are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform plan. The core Terraform workflow consists of three main steps: `terraform init` to initialize the working directory, `terraform plan` to preview changes, and `terraform apply` to execute those changes. Option B (`terraform plan`) is correct because it creates an execution plan showing what actions Terraform will take to reach the desired state defined in configuration files. Option D (`terraform apply`) is correct because it applies the changes required to reach the desired state, either by using a previously generated plan or by creating a new plan and prompting for approval.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform destroy

Question 7

A team uses Terraform Cloud with a VCS-backed workflow. They notice that a recent commit triggered a run that failed because of an invalid configuration. The team fixed the configuration and wants to re-run the plan without committing again. Which action should they take?

Accepted Answer

Use the 'Queue Plan' button in the Terraform Cloud UI. Option C is correct because the 'Queue Plan' button in Terraform Cloud allows you to trigger a new speculative plan for the same commit without modifying the VCS history or creating a new commit. This is the intended workflow for re-running a plan after fixing configuration errors in a VCS-backed workspace, as it uses the existing commit but re-evaluates the configuration.

Answer

Amend the previous commit and force push

Answer

Create a new commit with the fix

Answer

Run terraform plan locally and apply

Question 8

A developer runs `terraform plan` and it fails with a provider plugin error. Which command should they run first to resolve the issue?

Accepted Answer

terraform init. The `terraform init` command is the correct first step because it initializes the working directory, downloads the required provider plugins, and sets up the backend configuration. A provider plugin error typically indicates that the provider plugins are missing, outdated, or not properly installed, and `terraform init` resolves this by fetching the correct versions from the Terraform registry.

Answer

terraform validate

Answer

terraform apply

Answer

terraform fmt

Question 9

An organization wants to use Terraform to manage infrastructure in multiple environments (dev, staging, prod) with the same configuration but different variable values. Which approach should they use?

Accepted Answer

Use Terraform workspaces and separate variable files. Terraform workspaces allow you to manage multiple distinct sets of infrastructure resources within the same configuration by maintaining separate state files. By combining workspaces with separate variable definition files (e.g., `dev.tfvars`, `prod.tfvars`), you can reuse the same configuration code while applying environment-specific variable values, avoiding duplication and ensuring consistency across environments.

Answer

Create separate directories with duplicated configurations

Answer

Use a single state file with environment variables

Answer

Use different versions of Terraform for each environment

Question 10

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

Accepted Answer

Use a JSON validator tool to check the policy string in the configuration.. Option C is correct because the error 'The policy failed validation' indicates that the JSON-encoded IAM policy string in the Terraform configuration is malformed or violates AWS IAM policy syntax. Using a JSON validator tool (e.g., `jq`, online validator, or `aws iam simulate-custom-policy`) directly checks the string's structure and compliance with AWS IAM policy schema, which is the most efficient first step before re-running Terraform. This isolates the issue from Terraform's execution logic and avoids unnecessary plan/apply cycles.

Answer

Run 'terraform plan' to see the detailed error.

Answer

Use 'terraform console' to test the policy string.

Answer

Upgrade to the latest Terraform version.

Question 11

Which TWO statements about Terraform module sources are correct? (Select TWO.)

Accepted Answer

A module source can be a local file system path.. Option A is correct because Terraform allows module sources to be local file system paths, enabling you to reference modules stored on your local machine. This is useful for developing and testing modules before publishing them, and the path can be relative or absolute, such as `./modules/my-module` or `/home/user/modules/my-module`.

Answer

Modules can only be sourced from the public Terraform Registry.

Answer

Running 'terraform plan' automatically downloads any missing modules.

Answer

The module source is defined in a separate 'source' block within the module.

Question 12

After running terraform apply, you see the error: 'Error: Error loading state: state snapshot was created by Terraform v0.12.0, but this is Terraform v1.2.0'. What should you do to resolve this?

Accepted Answer

Run terraform apply with no changes to upgrade the state format. Option B is correct because running `terraform apply` with no changes triggers Terraform to automatically upgrade the state file format to the version compatible with the current Terraform binary (v1.2.0). Terraform state files are versioned internally, and when a newer version of Terraform reads an older state format, it performs an in-place upgrade during the next state write operation, such as an apply that results in no changes. This avoids manual intervention or data loss.

Answer

Run terraform state upgrade

Answer

Delete the state file and reimport resources

Answer

Downgrade Terraform to v0.12.0

Question 13

A team uses Terraform to manage infrastructure. After running 'terraform apply', a developer notices that a new security group rule was added, but then immediately removed. What is the most likely cause?

Accepted Answer

The security group rule was added manually and Terraform removed it to match the configuration.. Option A is correct because Terraform operates on a desired-state model: it compares the configuration in `.tf` files against the real-world infrastructure and the state file. If a security group rule was added manually outside of Terraform, Terraform detects it as a drift during the next `apply` and removes it to reconcile the actual state with the declared configuration. This is the core behavior of Terraform's lifecycle management.

Answer

The state file was corrupted and Terraform performed a refresh.

Answer

The configuration was changed to remove the rule after the apply.

Answer

The developer accidentally ran 'terraform destroy' instead.

Question 14

Which THREE of the following are best practices for managing Terraform state?

Accepted Answer

Use remote backends to store state files. Remote backends (e.g., S3, Azure Storage, Terraform Cloud) store state outside the local filesystem, enabling team collaboration, durability, and integration with state locking and encryption. This prevents loss of state due to local machine failure and ensures all team members work from the same state file, which is critical for consistent infrastructure management.

Answer

Edit state files directly to fix drift

Answer

Store state files locally to avoid network latency

Question 15

Which TWO statements about Terraform provisioners are correct?

Accepted Answer

Provisioners should be used as a last resort when no other Terraform resource or data source fits.. Option B is correct because Terraform provisioners are considered a last resort for tasks that cannot be accomplished with Terraform's declarative resource model. The official Terraform documentation explicitly states that provisioners should be used sparingly, as they introduce procedural logic and can cause state drift or failures that are hard to debug. This aligns with the principle of keeping configurations idempotent and relying on native resource attributes or data sources first.

Answer

Provisioners can only be used with the 'local-exec' and 'remote-exec' provisioners.

Answer

Provisioners are the primary way to configure resources after creation.

Answer

Provisioners run only once during initial creation by default.

TF-003 Practice Test 30 — 15 Questions

Exhibit

TF-003 Practice Test 30 — 15 Questions

Exhibit