TF-004 Practice Test 5 — 10 Questions

Question 1

A developer has a module that outputs a list of subnet IDs. They want to use this list to create an EC2 instance in each subnet using for_each. Which for_each expression is correct?

Accepted Answer

toset(module.my_module.ids). `for_each` in Terraform requires a map or a set of strings to iterate over, and `toset()` converts the list of subnet IDs into a set, which is a valid input for `for_each`. A plain list (as in option A) is not directly supported by `for_each`, which expects a map or set to ensure unique keys and deterministic behavior.

Answer

module.my_module.ids

Answer

{ for id in module.my_module.ids : id => id }

Answer

module.my_module.ids[*]

Question 2

A team uses the backend configuration above. What is the primary benefit of storing state remotely in S3?

Accepted Answer

Enabling state sharing and locking across the team. Storing Terraform state remotely in S3 is the standard practice for team collaboration because it allows multiple team members to access and modify the same state file, preventing conflicts. Combined with DynamoDB for state locking, it ensures that only one person runs `terraform apply` at a time, avoiding race conditions and state corruption. This is the primary benefit over local state storage, which is single-user by design.

Answer

Automatic encryption of state files

Answer

Reducing the number of API calls to AWS

Answer

Faster Terraform execution times

Question 3

A Terraform configuration uses a module from the Terraform Registry. After updating the module version in the configuration, the operator runs 'terraform plan' but does not see the changes expected from the new version. What is the most likely cause?

Accepted Answer

The operator did not run 'terraform init' after changing the version.. When you change a module version in the configuration, Terraform must re-initialize the working directory to download the new version and update the dependency lock file (.terraform.lock.hcl). Running 'terraform plan' without first running 'terraform init' will use the previously cached module version, so the expected changes from the new version will not appear. 'terraform init' is the required command to fetch and lock the updated module source.

Answer

The operator did not run 'terraform get' to update modules.

Answer

The operator did not run 'terraform refresh' to update state.

Answer

The module version constraint is stored in the state file and must be updated.

Question 4

A developer is working on a Terraform configuration that manages a single resource. They want to import an existing AWS EC2 instance into state. Which command should they use?

Accepted Answer

terraform import. `terraform import` is the dedicated command for bringing an existing infrastructure resource (like an AWS EC2 instance) under Terraform management by attaching it to a resource block in the state file. It requires the resource address and the provider-specific ID (e.g., `aws_instance.my_instance i-1234567890abcdef0`) to map the real-world resource into the Terraform state without modifying the resource itself.

Answer

terraform apply

Answer

terraform refresh

Answer

terraform state mv

Question 5

Your team uses Terraform to manage a multi-region AWS deployment consisting of over 500 resources. The state file is stored in an S3 backend with DynamoDB locking. Recently, one of your colleagues accidentally deleted the state file from S3 while trying to clean up old backups. Fortunately, you have a backup from two days ago. However, after restoring the backup, you notice that several recent changes, including two new EC2 instances and a security group, are missing from the state. The actual resources still exist in AWS. You need to bring the state back in sync with the real-world infrastructure without recreating these resources. What should you do?

Accepted Answer

Use `terraform import` for each missing resource to add them to state. `terraform import` is the intended mechanism to bring existing infrastructure under Terraform management without recreating it. Since the missing EC2 instances and security group still exist in AWS but are absent from the state file, importing each resource by its AWS ID will add the corresponding state entries, allowing Terraform to manage them going forward. This avoids the downtime and potential configuration drift that would occur with `terraform apply` or manual state editing.

Answer

Run `terraform apply` to recreate the missing resources

Answer

Manually edit the state file to add the missing resource entries

Answer

Run `terraform refresh` to update the state with the missing resources

Question 6

You are a DevOps engineer at a company that manages infrastructure for multiple environments (dev, staging, prod) using Terraform. Each environment has its own state file stored in an S3 backend with DynamoDB locking. The team recently adopted a policy of running 'terraform plan' in CI/CD pipelines to review changes before applying. However, developers have reported that sometimes the plan output shows that Terraform wants to destroy and recreate resources that were not modified in their code changes. For example, a developer added a new tag to an S3 bucket in the staging environment, but the plan also showed that an unrelated EC2 instance would be replaced. Upon investigation, you notice that the state file for staging was last modified two days ago, but the developer's branch is based on a commit from one week ago. Which action is most likely to resolve the issue and ensure that plans only reflect changes from the current configuration changes?

Accepted Answer

Run 'terraform init -reconfigure' to ensure the local state is synchronized with the remote backend before planning.. `terraform init -reconfigure` forces Terraform to reinitialize the backend and re-download the latest state file from the remote S3 backend, discarding any stale local copy. The developer's local state was based on a week-old commit, while the actual remote state had been updated two days ago, causing Terraform to detect spurious differences (e.g., an unrelated EC2 instance) due to state drift. This command ensures the local state matches the remote state before planning, so the plan only reflects changes from the current configuration.

Answer

Set the 'skip_metadata_api_check' option in the provider to avoid changes.

Answer

Use 'terraform plan -target=aws_s3_bucket.bucket' to limit the plan to only the S3 bucket.

Answer

Run 'terraform plan -refresh=true' to refresh the state before planning.

Question 7

Which Terraform command is used to bring existing infrastructure that was created outside of Terraform under Terraform management?

Accepted Answer

terraform import. `terraform import` is the dedicated command to bring existing infrastructure that was created outside of Terraform under Terraform management. It maps the real-world resource ID to a Terraform resource address in state, allowing Terraform to track and manage that resource without recreating it.

Answer

terraform state push

Answer

terraform apply

Answer

terraform refresh

Question 8

Refer to the exhibit. The configuration fails with an error indicating that the module does not support the 'enable_vpn_gateway' argument. What is the most likely cause?

Accepted Answer

The module version '3.18.0' does not include the 'enable_vpn_gateway' variable; it was added in a later version.. The error message indicates that the module does not support the 'enable_vpn_gateway' argument. In Terraform, module arguments are defined by the module's published variables. The module version '3.18.0' predates the introduction of the 'enable_vpn_gateway' variable, which was added in a later version. Upgrading the module version to one that includes this variable resolves the error.

Answer

The argument name is misspelled; it should be 'enable_vpn' instead.

Answer

The module does not support VPN gateways at all.

Answer

The module source is incorrectly specified; it should use a git URL instead of the registry path.

Question 9

A developer wants to use the output of one Terraform configuration as input to another. Which Terraform feature should they use?

Accepted Answer

remote state data source. The remote state data source (terraform_remote_state) is the correct feature because it allows one Terraform configuration to read the output values from another configuration's state file, enabling cross-configuration data sharing without manual intervention. This is the idiomatic way to consume outputs from a separate Terraform root module, such as retrieving a VPC ID from a networking configuration to use in an application configuration.

Answer

local values

Answer

data sources

Answer

variables

Question 10

A module block references a module with version constraint '>= 2.0, < 3.0'. An older version 1.5 is already cached from a previous init. The team wants to ensure they use a newer version. After running terraform init -upgrade, what happens?

Accepted Answer

Terraform upgrades to the latest version in the range 2.x that is not yet cached.. `terraform init -upgrade` instructs Terraform to ignore any cached versions and re-check the registry for the newest available version that satisfies the version constraint `>= 2.0, < 3.0`. Since the constraint excludes 3.0, the latest version in the 2.x series will be selected and downloaded, overwriting the cached 1.5 version.

Answer

Terraform upgrades to version 3.0 because it is the latest.

Answer

Terraform returns an error because version 1.5 is incompatible with the constraint.

Answer

Terraform uses the cached version 1.5 because it is already present.