TF-004 Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. A developer runs `terraform init` and then `terraform plan`. The plan output shows that Terraform will create the AWS instance. However, the state file is expected to be stored in S3 under the key "prod/terraform.tfstate". Which statement is true?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The state will be stored in S3 in the us-east-1 region, and the EC2 instance will be created in us-west-2. The backend configuration specifies the S3 bucket and key 'prod/terraform.tfstate' for state storage, and the AWS provider region (us-west-2) is independent of the backend region. The backend block does not include a 'region' argument, so Terraform defaults to us-east-1 for state storage, while the EC2 instance is created in the provider's configured region (us-west-2).

Answer

The state will be stored locally because the S3 backend configuration is invalid

Answer

The state will be stored in S3 in the us-west-2 region because the provider overrides the backend region

Answer

The `terraform plan` will fail because the S3 bucket is not created yet

Question 2

Which TWO scenarios could cause 'terraform plan' to show 'No changes' even though the configuration file was recently modified? (Choose two.)

Accepted Answer

The user ran 'terraform plan' from a different directory that does not contain the modified configuration.. `terraform plan` operates on the configuration files in the current working directory. If the user runs the command from a different directory that does not contain the modified configuration, Terraform will compare the state against the unmodified files in that directory, resulting in 'No changes'. Option B is correct because a `lifecycle` block with `ignore_changes` tells Terraform to disregard changes to specified attributes when planning, so even if the configuration file modifies that attribute, Terraform will not detect a diff and will report 'No changes'.

Answer

The resource was manually updated in the cloud provider console.

Answer

A new resource block was added.

Answer

The provider version was changed in the required_providers block.

Question 3

Which three of the following are valid methods for reading, generating, or modifying Terraform configuration? (Choose three.)

Accepted Answer

Using `terraform console` to interactively evaluate expressions and inspect resource attributes.. The `terraform fmt` command rewrites configuration files to a canonical format and style, which is a valid method for modifying configuration. The `templatefile` function reads a template file and renders it with supplied variables, enabling dynamic configuration generation. The `terraform console` command provides an interactive shell for evaluating expressions and inspecting resource attributes, which is a valid way to read and test configuration logic.

Answer

Using the `merge` function to combine multiple map values, but only when the source maps are defined in separate Terraform modules.

Answer

Using the `terraform plan -generate-config-out` flag to automatically create configuration from existing infrastructure.

Answer

Using the `terraform state push` command to directly edit the state file and then reflect those changes back into the configuration.

Question 4

A team is using a module from the Terraform Registry and wants to ensure they always get the latest patch version of the 3.2.x series. Which version constraint should they use?

Accepted Answer

~> 3.2.0. The `~>` (pessimistic constraint) operator in Terraform allows only the rightmost version component to increment. For `~> 3.2.0`, this means any version >= 3.2.0 and < 3.3.0, which precisely matches the requirement for the latest patch within the 3.2.x series. Option C is correct because it locks the major and minor versions while permitting patch-level updates.

Answer

~> 3.2

Answer

3.2.*

Answer

>= 3.2, < 4.0

Question 5

Which TWO actions will cause Terraform to update the state file?

Accepted Answer

terraform destroy. terraform destroy (B) is correct because it removes all resources managed by the configuration and writes the resulting empty resource set back to the state file, updating it to reflect that nothing is managed. terraform apply (C) is correct because it executes the planned changes against real infrastructure and then persists the new resource attributes, IDs, and dependencies into the state file. The other commands do not modify state: terraform fmt (A) only reformats HCL files, terraform validate (D) only checks configuration syntax and internal consistency, and terraform plan (E) merely refreshes and computes a proposed diff without writing changes to the state file.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform plan

Question 6

Which TWO of the following are best practices when writing Terraform configuration for a team? (Select TWO.)

Accepted Answer

Pin provider versions using `required_providers`.. Option B is correct because pinning provider versions in the `required_providers` block (e.g., `version = "~> 5.0"`) ensures every team member and CI pipeline resolves the same provider release, preventing unexpected breaking changes from newer versions. Option D is correct because a remote backend (such as S3 with DynamoDB, or Terraform Cloud) centralizes state storage and enables state locking, which prevents concurrent `terraform apply` runs from corrupting the shared state file. Option A is wrong because using `latest` makes builds non-deterministic and can silently introduce breaking provider changes. Option C is wrong because hardcoding values harms reusability and prevents parameterization via variables, workspaces, or environments. Option E is wrong because splitting infrastructure into multiple files/modules improves readability, ownership, and blast-radius control for a team.

Answer

Always use the `latest` version for providers.

Answer

Hardcode all values in the configuration for simplicity.

Answer

Store the entire infrastructure in a single configuration file.

Question 7

Which three of the following are valid command-line operations that modify the Terraform state? (Choose three.)

Accepted Answer

`terraform apply -auto-approve`. `terraform apply -auto-approve` modifies the Terraform state by creating, updating, or destroying resources as defined in the configuration, and then writing the resulting state to the state file. The `-auto-approve` flag skips the interactive approval prompt but does not change the fundamental behavior of applying changes and updating state.

Answer

`terraform plan`

Answer

`terraform state list`

Question 8

A user accidentally ran `terraform state rm` on a critical resource, removing it from state but not destroying the actual infrastructure. Later, they need to re-import the resource. Which sequence of commands correctly accomplishes this?

Accepted Answer

`terraform import` using the resource address and ID of the resource. `terraform import` is the correct mechanism to bring an existing resource back under Terraform management by associating it with a resource address in state using its real-world ID. After `terraform state rm`, the resource still exists in the cloud but is no longer tracked, so import is the only command that re-establishes that mapping. The syntax is `terraform import `.

Answer

`terraform state push` with the original state file

Answer

`terraform plan` and then `terraform apply`

Answer

`terraform refresh` and then `terraform plan`

Question 9

Refer to the exhibit. What will happen when you run terraform plan?

Accepted Answer

The plan will fail with an error about missing required argument.. In Terraform, the `aws_iam_user` resource requires the `name` argument, which is mandatory. If the exhibit shows a resource block without a `name` value (or with an empty/omitted name), `terraform plan` will fail during validation with an error stating that the required argument 'name' is missing. Terraform does not auto-generate names for IAM users, so the plan cannot succeed.

Answer

The plan will prompt for the name interactively.

Answer

The plan will succeed and create the IAM user with a generated name.

Answer

The plan will create the user with the path only.

Question 10

A team of five engineers manages infrastructure using Terraform with remote state stored in an S3 bucket and state locking via a DynamoDB table. After a power outage, an engineer notices that a terraform apply command fails with the message: 'Error: Error acquiring the state lock'. The engineer suspects that a lock from a previous run has not been released. The team needs to proceed with applying changes. Which action should the engineer take to resolve the issue safely?

Accepted Answer

Run terraform force-unlock with the lock ID obtained from the error message.. The correct action is to run terraform force-unlock with the lock ID from the error message. This command safely removes the stale lock from the DynamoDB table after verifying that no other process is running, allowing the apply to proceed. It is the intended mechanism for resolving stuck locks without risking state corruption.

Answer

Wait for the lock to expire automatically (locks have a 5-minute TTL).

Answer

Delete the lock record from the DynamoDB table using the AWS CLI.

Answer

Run terraform apply with the -lock=false flag to bypass locking.

Question 11

During a `terraform apply`, the operation fails mid-way due to a network outage, leaving some resources created. The operator wants to resume applying from where it left off without destroying the already-created resources. What should they do?

Accepted Answer

Run terraform apply again. Terraform uses a state file to track the resources it manages. When `terraform apply` fails mid-way, the state file is updated to reflect the resources that were successfully created. Running `terraform apply` again will cause Terraform to compare the current state with the configuration, detect that the already-created resources exist, and proceed to create only the remaining resources, effectively resuming from where it left off without destroying anything.

Answer

Run terraform destroy and then apply

Answer

Run terraform refresh

Answer

Run terraform apply -auto-approve

Question 12

A company uses Terraform with an S3 backend. A user accidentally deletes the state file. What is the best practice to recover the state?

Accepted Answer

Restore the state file from S3 bucket versioning. When using Terraform with an S3 backend, the state file is stored in S3. If it is accidentally deleted, the best recovery method is to restore it from an S3 bucket versioning-enabled bucket, which retains previous versions of objects. This restores the exact state file, preserving resource mappings and metadata, and avoids the need to re-import or recreate resources.

Answer

Use terraform state pull from the local cache

Answer

Use terraform import on all resources

Answer

Recreate the state from a terraform plan

Answer

Restore from the local terraform.tfstate.backup

Question 13

Which TWO of the following are valid ways to pass variables to Terraform in an automated pipeline?

Accepted Answer

Creating a .tfvars file and referencing it with -var-file.. Option A is correct because Terraform supports variable definition files (commonly with a .tfvars or .tfvars.json extension), and you can explicitly load one with the -var-file flag, e.g. terraform apply -var-file="prod.tfvars", which is ideal for automated pipelines where the file is committed or generated by the CI/CD system. Option C is correct because the -var flag lets you pass individual input variables directly on the command line, e.g. terraform apply -var="instance_type=t3.micro", which works non-interactively and is therefore suitable for pipeline execution. Option B is not valid for automation because interactive prompts require a human to type values at the terminal, which defeats unattended pipeline runs. Option D is incorrect because Terraform reads input variables from environment variables prefixed with TF_VAR_, not TERRAFORM_. Option E is incorrect because there is no -vars flag in Terraform; the correct flags are -var and -var-file.

Answer

Using interactive prompts during terraform apply.

Answer

Setting environment variables with prefix TERRAFORM_.

Answer

Using the -vars flag to pass JSON string.

Question 14

Which TWO are benefits of using Terraform Cloud's remote operations with a CLI-driven run workflow?

Accepted Answer

Centralized state management with automatic locking. Option B is correct because Terraform Cloud remote operations store the workspace state centrally on Terraform Cloud's servers rather than on the local machine, and the platform automatically locks state during runs to prevent concurrent modifications and state corruption. Option D is correct because with remote operations the run executes inside Terraform Cloud's disposable environment, where provider credentials and secrets are supplied via workspace variables (environment variables, Terraform variables, or dynamic provider credentials) rather than relying on the practitioner's local shell environment. The unmarked options do not belong: A describes VCS-driven workflows, not the CLI-driven run workflow, which triggers runs from the local CLI via `terraform plan`/`terraform apply`; C is not a benefit specific to remote operations, since a single workspace still maps to one provider configuration and multi-provider support exists regardless of execution mode; and E is false because `terraform plan -refresh-only` is a Terraform CLI command that still requires a run to be initiated and executed, whether locally or remotely.

Answer

Integration with version control systems for automatic plan and apply

Answer

Support for multiple cloud providers in a single workspace

Answer

Ability to execute `terraform plan -refresh-only` without a run

Question 15

During terraform init, which TWO of the following actions occur? (Choose two.)

Accepted Answer

Download provider plugins.. Option C is correct because terraform init downloads and installs the provider plugins declared in the configuration into the .terraform directory (or the plugin cache), resolving version constraints from the required_providers block. Option E is correct because terraform init initializes the backend, configuring where state is stored (e.g., local, S3, or Terraform Cloud) and, for remote backends, performing the backend setup such as creating or verifying the state storage. Option A is not part of init; configuration validation is performed by terraform validate. Option B is not performed by init; the state file is created or written when Terraform applies changes (or via terraform state operations), not during initialization. Option D is not performed by init; a plan is generated by terraform plan.

Answer

Validate the configuration.

Answer

Create the state file.

Answer

Generate a plan.