TF-004 Practice Test 32 — 15 Questions

Question 1

A company uses Terraform to manage infrastructure across dev, staging, and production environments. They use Terraform workspaces to separate state files. The backend is configured with an S3 bucket for state storage and a DynamoDB table for state locking. Recently, the team has grown from 2 to 10 developers, and they frequently encounter the error: 'Error acquiring the state lock' when running terraform apply in quick succession. The error message includes: 'Lock Info: ID: ... Operation: Apply. Who: user@company.com. Version: 1.0.0. Created: ...' The error occurs intermittently, especially during peak deployment times. The DynamoDB table is configured with 5 read and 5 write capacity units. The team's current workflow involves multiple developers running apply on different workspaces simultaneously. Which course of action should the team take to minimize state locking errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the DynamoDB table's write capacity units to a higher value.. The intermittent 'Error acquiring the state lock' during peak deployment times points to DynamoDB throttling, not a fundamental locking problem. With 10 developers running applies across workspaces simultaneously, the 5 WCU provisioned on the lock table is insufficient to handle the burst of conditional writes used to acquire and release locks. Increasing the write capacity units (or switching to on-demand mode) allows DynamoDB to absorb the concurrent lock operations without throttling, which is what surfaces as a lock acquisition failure in Terraform.

Answer

Disable state locking to eliminate the error.

Answer

Use a different backend that does not support locking, such as local state.

Answer

Implement a pre-apply hook that checks if the state is already locked and waits.

Question 2

Which TWO statements about using Terraform with remote backends are correct?

Accepted Answer

Remote backends store state in a shared location.. Option B is correct because a remote backend (for example, an S3 bucket, Azure Storage Account, GCS bucket, or Terraform Cloud workspace) stores the Terraform state file in a shared, remote location rather than on the local machine, allowing teams to collaborate on the same infrastructure. Option E is correct because most remote backends support state locking — such as S3 with a DynamoDB table, Azure Blob Storage, or Consul — which prevents concurrent runs from corrupting the state file. Option A is incorrect because migrating state to a remote backend is typically handled automatically by running `terraform init` with the new backend configuration, which offers to copy existing local state; manual migration is not a requirement. Option C is incorrect because storing state in the local filesystem describes the default local backend, not a remote backend. Option D is incorrect because Terraform Cloud itself is a supported remote backend (configured via the `cloud` block or `remote` backend), so remote backends can absolutely be used with it.

Answer

Remote backends require manual state migration.

Answer

Remote backends store state in the local filesystem.

Answer

Remote backends cannot be used with Terraform Cloud.

Question 3

Which TWO statements about Terraform modules are correct?

Accepted Answer

A module can be called multiple times in the same configuration with different input variables.. Option D is correct because Terraform allows the same module to be instantiated multiple times within a configuration, and each instance can receive distinct values for its input variables, enabling reuse of the module's logic with different parameters. Option E is correct because the module source attribute supports various source types, including Git repository URLs, and you can pin a specific commit SHA (for example, using a ref query parameter or the ?ref= syntax) to ensure the exact code revision is used. Option A is incorrect because the count meta-argument is supported on module blocks, allowing multiple instances of a module to be created. Option B is incorrect because module outputs are not automatically available as inputs to other modules; they must be explicitly referenced and passed as input variables. Option C is incorrect because version constraints are only required for certain source types such as the Terraform Registry, and are not mandatory for all module sources (e.g., local paths).

Answer

The count meta-argument is not supported on module blocks.

Answer

Module outputs are automatically available as inputs to other modules in the same configuration.

Answer

Module sources must include a version constraint to ensure reproducibility.

Question 4

Which TWO statements accurately describe key purposes of Terraform?

Accepted Answer

Terraform enables declarative infrastructure provisioning.. Option A is correct because Terraform uses a declarative HashiCorp Configuration Language (HCL) model where you define the desired end state of infrastructure and Terraform computes the create/update/delete actions needed to reach it, rather than scripting imperative steps. Option D is correct because Terraform's provider plugin architecture (e.g., aws, azurerm, google, kubernetes) lets a single configuration and workflow target multiple clouds and services simultaneously, which is a core design purpose. Option B is wrong because Terraform itself has no built-in security scanning; that requires separate tools such as tfsec, Checkov, or Sentinel policies. Option C is wrong because Terraform is an infrastructure provisioning tool, not a CI/CD pipeline engine; it is typically invoked by pipelines (Jenkins, GitHub Actions, GitLab CI) rather than replacing them. Option E is wrong because Terraform's model is fundamentally immutable/declarative resource replacement, and while it can manage mutable resources via providers, 'manages both mutable and immutable infrastructure' is not a stated key purpose in the same way as A and D.

Answer

Terraform provides built-in security scanning.

Answer

Terraform automates continuous delivery pipelines.

Answer

Terraform manages both mutable and immutable infrastructure.

Question 5

Based on the exhibit, what can be inferred about the Terraform state and configuration?

Accepted Answer

The aws_instance.db resource is in state but not in configuration, so it will be destroyed.. The `terraform plan` output shows that `aws_instance.db` exists in the state file but is absent from the current configuration. Terraform interprets this as a resource that should be removed to align the real-world infrastructure with the configuration, so it will be destroyed. This is a core behavior of Terraform's desired-state management: any resource in state but not in configuration is marked for deletion.

Answer

The configuration for aws_instance.db has been added back to the .tf files.

Answer

The aws_instance.db resource was manually deleted from the AWS console.

Answer

The aws_instance.web resource is being imported into Terraform management.

Question 6

A developer has a Terraform configuration that includes an output block. They run `terraform apply` and then want to quickly retrieve the output value without re-running the entire apply. Which command should they use?

Accepted Answer

terraform output. The `terraform output` command is specifically designed to retrieve the values of output variables from the state file without re-running the entire `terraform apply` operation. It reads the outputs stored in the Terraform state after a successful apply, making it the fastest and most direct way to access those values. This command supports flags like `-json` for structured output and can target a specific output by name.

Answer

terraform plan

Answer

terraform state list

Answer

terraform show

Question 7

An organization has multiple teams using Terraform to manage shared infrastructure. They want to enforce policies such as requiring specific tags on all resources and preventing the use of certain instance types. Which Terraform feature should they implement to meet these requirements?

Accepted Answer

Sentinel policy enforcement. Sentinel is HashiCorp's policy-as-code framework that integrates with Terraform Cloud and Enterprise to enforce fine-grained, logic-based policies before resources are created or modified. It can mandate that all resources carry specific tags (e.g., `required_tags`) and block prohibited instance types (e.g., `t2.micro`) by evaluating Terraform plan output against Sentinel rules, making it the correct choice for these governance requirements.

Answer

Terraform workspaces

Answer

Custom Terraform providers

Answer

Remote backends with state locking

Question 8

Which THREE of the following are capabilities of Terraform Cloud's Sentinel policy framework? (Choose three.)

Accepted Answer

Enforce that resources have mandatory tags. Sentinel is a policy-as-code framework embedded in Terraform Cloud that evaluates plan data before apply, so option B is correct because a policy can inspect planned resource attributes and fail the run when required tags (e.g., CostCenter, Environment) are missing. Option C is correct because Sentinel policies can encode organizational security rules—such as requiring encrypted S3 buckets, private subnets, or approved instance types—and reject non-compliant plans. Option D is correct because Sentinel can match on resource type (e.g., aws_instance, azurerm_virtual_machine) and forbid or conditionally allow their creation. Option A is not a Sentinel capability because policies evaluate Terraform configuration/plan data, not wall-clock scheduling; time-based run control would come from CI/CD or API triggers. Option E is not a Sentinel capability because cost estimation in Terraform Cloud is provided by the separate cost estimation feature (run tasks/infracost-style integrations), not by Sentinel policy logic.

Answer

Block Terraform runs based on the time of day

Answer

Estimate the cost of infrastructure changes

Question 9

A developer needs to inspect the current state of a specific resource managed by Terraform without modifying any infrastructure. Which command should they use?

Accepted Answer

`terraform state show aws_instance.example`. The `terraform state show` command is designed to display the attributes of a single resource in the state file. It is read-only and does not alter infrastructure or state. Other commands like `refresh` modify state, `plan` shows planned changes, and `output` displays only defined outputs. Therefore, `state show` is the correct choice for inspecting a specific resource without modifications.

Answer

`terraform refresh`

Answer

`terraform plan`

Answer

`terraform output`

Question 10

Your team stores Terraform state in an AWS S3 bucket and uses DynamoDB for state locking. A junior engineer runs `terraform apply` locally while a CI pipeline is also running `terraform apply` against the same state. The apply succeeds in both cases, but the resulting infrastructure is inconsistent and resources are missing from state. What is the most likely cause?

Accepted Answer

The S3 backend was configured without `dynamodb_table`, so state locking was not enabled.. State locking prevents concurrent operations from modifying the same state file simultaneously. When the S3 backend is configured without a `dynamodb_table`, Terraform cannot acquire a lock, so two applies can run at once. Each apply reads the state, plans changes, and writes back, overwriting the other's updates. This leads to a state file that does not reflect all created resources, causing drift and inconsistencies.

Answer

The `terraform apply` command was run with the `-parallelism=1` flag, which disabled locking.

Answer

The DynamoDB table was created in a different region than the S3 bucket, so locking was not enforced.

Answer

The S3 bucket versioning was disabled, so Terraform could not read the latest state file.

Question 11

A developer is writing a Terraform configuration that uses a `variable` block to define an input variable `region` with a default value of `us-west-2`. The developer wants to ensure that the variable can only be set to one of three approved regions: `us-west-2`, `us-east-1`, or `eu-west-1`. Which approach should the developer use?

Accepted Answer

Add a `validation` block with a `condition` that checks if `var.region` is in the list of approved regions.. Terraform's `variable` block supports `validation` blocks that define a `condition` and an `error_message`. The condition can use functions like `contains` to check if the provided value is within a list of approved options. This validation occurs during plan and apply, preventing invalid values from being used. It is the standard way to enforce custom constraints on input variables.

Answer

Set the variable type to `string` and use a `default` value that is a list of the approved regions.

Answer

Define the variable with type `list(string)` and set the default to the approved regions, then use `contains` in the resource.

Answer

Use the `allowed_values` argument in the `variable` block to specify the permitted regions.

Question 12

A platform team is standardizing how infrastructure is provisioned across three cloud providers using Terraform. Leadership wants to reduce the risk of undocumented manual changes and ensure that every environment can be recreated identically on demand. Which two characteristics of infrastructure as code directly support these goals? (Choose two.)

Accepted Answer

A single Terraform configuration can describe resources across multiple providers without maintaining separate tooling for each cloud.. Version-controlled declarative configuration provides auditable, repeatable provisioning, and Terraform's multi-provider capability lets one workflow span AWS, Azure, and Google Cloud. Together these reduce undocumented manual changes and allow identical environment recreation. The remaining choices describe either manual console workflows, continuous auto-remediation that Terraform does not perform, or an incorrect claim about state persistence.

Answer

Infrastructure can be provisioned through the cloud provider's web console using the same templates that Terraform applies.

Answer

Terraform automatically detects and reverts any manual change made outside of Terraform within seconds of it occurring.

Answer

Infrastructure state is stored only in memory during an apply, so no persistent artifacts remain after provisioning completes.

Question 13

An operator runs `terraform apply` and the command blocks waiting for interactive approval. They need to run the same apply in an unattended CI pipeline without any prompt. Which command should they use?

Accepted Answer

terraform apply -auto-approve. To run terraform apply without an interactive prompt, the -auto-approve flag must be used. It tells Terraform to skip the confirmation step and immediately apply the planned changes. Other flags like -input=false or -refresh=false do not remove the approval prompt and therefore do not satisfy the scenario.

Answer

terraform apply -refresh=false

Answer

terraform apply -input=false

Answer

terraform plan -auto-approve

Question 14

A developer new to Terraform writes a configuration with a provider block, a resource block, and an output block. They run a single command that initializes the working directory, downloads the provider plugin, and prepares the backend. Which command did they run?

Accepted Answer

terraform init. terraform init is the initialization command that downloads provider plugins, sets up the backend, and installs modules. It must be run before plan, apply, or validate in a new working directory. The other commands operate on an already initialized directory and will fail if initialization has not occurred.

Answer

terraform plan

Answer

terraform validate

Answer

terraform apply

Question 15

You are maintaining a Terraform configuration for a team that uses the local backend. A junior engineer accidentally deletes the terraform.tfstate file from the working directory before running terraform destroy. You need to recover from this situation without disrupting the existing infrastructure. Which two statements about Terraform state are true? (Choose two.)

Accepted Answer

Terraform state maps real-world resources to your configuration and tracks metadata such as resource dependencies.. Terraform state is the mapping between configuration and real infrastructure, and terraform import is the supported way to reattach existing resources to configuration when state is lost. State also tracks dependencies and metadata, enabling correct planning and destruction order. Automatic discovery is not a feature, and local state is not encrypted by default.

Answer

State files are encrypted by default when using the local backend, so deletion is the only risk.

Answer

The state file is optional; Terraform can operate correctly using only the configuration files and provider APIs.

Answer

Terraform can automatically reconstruct the state file by scanning the cloud provider for resources that match the configuration.