TF-004 Practice Questions 1 — 50 Questions

Question 1

Refer to the exhibit. What does this output indicate?

Accepted Answer

A resource will be modified. The output shows a Terraform plan with a tilde (~) prefix next to a resource attribute, which indicates an in-place update. This means Terraform will modify the existing resource without destroying and recreating it, confirming that option A is correct.

Answer

A resource will be destroyed

Answer

No changes

Answer

A resource will be created

Question 2

A team using a remote S3 backend with DynamoDB locking is experiencing frequent 'Error acquiring the state lock' messages in their CI/CD pipeline. The pipeline runs multiple concurrent jobs for different workspaces. What is the most likely cause and solution?

Accepted Answer

The same workspace is being used for concurrent runs; use separate workspaces per environment.. The error 'Error acquiring the state lock' occurs when Terraform cannot obtain a lock on the state file for a specific workspace. In this scenario, the pipeline runs multiple concurrent jobs for different workspaces, but if the same workspace is inadvertently used across concurrent runs, Terraform's DynamoDB-based locking mechanism will prevent simultaneous access to that workspace's state. The solution is to ensure each environment (e.g., dev, staging, prod) uses a separate workspace, avoiding lock contention. Option B correctly identifies this as the most likely cause and solution.

Answer

The DynamoDB table lacks sufficient read/write capacity; increase it.

Answer

The pipeline is running too many jobs; increase the lock wait time.

Answer

The S3 bucket is not versioned; enable versioning.

Question 3

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 4

A team uses an S3 backend with DynamoDB for state locking. They notice that sometimes terraform plan fails because the state is locked. What is the best practice to handle this in an automated pipeline?

Accepted Answer

Serialize pipeline runs to avoid concurrent execution. Serializing pipeline runs is the best practice to prevent concurrent Terraform operations from competing for the same state lock. When multiple pipeline jobs attempt to run `terraform plan` or `terraform apply` simultaneously, DynamoDB-based state locking ensures only one operation holds the lock at a time, causing the others to fail. By enforcing sequential execution (e.g., via CI/CD stage dependencies or a mutex), you avoid lock contention entirely without risking data corruption or bypassing safety mechanisms.

Answer

Use force-unlock before each plan

Answer

Increase the lock timeout

Answer

Use -lock=false in the pipeline

Question 5

A junior DevOps engineer is learning about Infrastructure as Code (IaC) and asks why Terraform is preferred over manual configuration in cloud consoles. Which of the following is the primary benefit of using Terraform for infrastructure management?

Accepted Answer

It enables version-controlled, repeatable, and automated infrastructure provisioning.. Terraform's core value proposition is enabling infrastructure as code (IaC), which allows teams to define infrastructure in declarative configuration files, version control them with Git, and provision consistently across environments. This repeatability and automation eliminate the drift and manual errors inherent in clicking through cloud consoles, making infrastructure management auditable, collaborative, and scalable.

Answer

It can only manage infrastructure on major cloud providers like AWS, Azure, and GCP.

Answer

It automatically rolls back any failed infrastructure changes.

Answer

It uses an imperative approach where you specify exact commands to execute.

Question 6

Refer to the exhibit. What is the purpose of this output block?

Accepted Answer

To display the public IP address of the instance after apply.. The output block shown in the exhibit is a Terraform output value, which is defined using the `output` block in a configuration file. Its purpose is to display the public IP address of the instance in the terminal after `terraform apply` completes, providing a quick reference for the user. Option D correctly identifies this behavior, as outputs are designed to surface resource attributes to the user without storing them or creating external records.

Answer

To store the public IP in a local file.

Answer

To set the public IP as a variable for use in other configurations.

Answer

To create a DNS record with the public IP.

Question 7

Refer to the exhibit. What is the purpose of the data source?

Accepted Answer

To fetch an existing AMI ID. In Terraform, a data source allows you to fetch or compute information from external sources that is not defined within the current configuration. The correct answer is B because the data source in the exhibit (e.g., `aws_ami`) is used to query and retrieve the ID of an existing AMI that matches specified filters, such as name, owner, or tag, without creating a new AMI. This enables dynamic referencing of pre-existing resources in your infrastructure.

Answer

To create a new AMI

Answer

To define a variable

Answer

To output the AMI name

Question 8

A team uses Terraform with remote state in Azure Storage. They have a CI/CD pipeline that runs terraform plan and apply. Recently, a team member ran terraform apply manually from their local machine and the process crashed due to a network interruption. Now, the pipeline's next run fails with an error: "Error: Error acquiring the state lock". The team is unsure who holds the lock. They need to proceed with the pipeline as soon as possible. What should they do?

Accepted Answer

Use terraform force-unlock with the lock ID to break the lock.. The correct action is to use `terraform force-unlock` with the lock ID to break the stale lock. When a Terraform process crashes while holding a state lock (stored in Azure Blob Storage via the `azurerm` backend), the lock remains in place, blocking all subsequent operations. The `force-unlock` command is the designed mechanism to manually release such locks, and the lock ID can be obtained from the error message or by querying the Azure Storage blob's lease state.

Answer

Wait for the lock to expire automatically.

Answer

Re-run terraform apply with -lock=false to skip locking.

Answer

Delete the .terraform folder and reinitialize.

Question 9

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. It leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 10

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. The error 'ConditionalCheckFailedException' occurs when DynamoDB's conditional put operation fails, which happens when a lock item already exists in the DynamoDB table. This indicates another Terraform process currently holds the state lock, preventing concurrent operations. Terraform uses DynamoDB's conditional writes to ensure only one process can acquire the lock at a time.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.

Question 11

In Terraform, the `terraform plan` command compares the current state with the configuration. This is an example of which IaC principle?

Accepted Answer

Desired state enforcement. The `terraform plan` command compares the current state (what is deployed) with the configuration (what is declared) and computes the changes needed to align the real-world infrastructure with the declared configuration. This is the essence of desired state enforcement: the tool continuously reconciles the actual state toward the user-defined desired state, rather than executing imperative steps. Option D is correct because Terraform's core loop—plan, apply, refresh—is built around this declarative, state-driven model.

Answer

Version control integration

Answer

Continuous delivery

Answer

Modular architecture

Question 12

A junior engineer is asked to review a Terraform configuration that defines a module from the Terraform Registry. In which files are the descriptions of the module’s inputs and outputs typically found?

Accepted Answer

variables.tf. In Terraform modules, input variables are declared in `variables.tf` with `description` arguments to document their purpose, and output values are declared in `outputs.tf` with `description` arguments. Therefore, descriptions of both inputs and outputs are found in these two files. Neither file alone describes both; the question's phrasing implies consideration of both files, making both B and C correct.

Answer

versions.tf

Answer

main.tf

Question 13

Refer to the exhibit. A team is troubleshooting a Terraform deployment. What information can be inferred from this state file?

Accepted Answer

There is one EC2 instance of type t2.micro with a dependency on a security group.. The state file explicitly shows a resource of type `aws_instance` with `instance_type = "t2.micro"` and a `depends_on` meta-argument referencing `aws_security_group.example`. This indicates that Terraform recorded the EC2 instance as created with a t2.micro type and that it has a formal dependency on a security group resource, ensuring the security group is created before the instance during apply.

Answer

The Terraform version is outdated and must be upgraded.

Answer

The instance ID is invalid and needs to be recreated.

Answer

The security group dependency was not applied.

Question 14

A team uses Terraform with remote state in an S3 backend and DynamoDB for state locking. A user runs 'terraform apply' and receives the error: 'Error acquiring the state lock'. The lock info shows a lock ID and caller. What is the best immediate course of action?

Accepted Answer

Check if another Terraform process is running; if not, use 'terraform force-unlock' with the lock ID.. The error indicates a state lock is held, typically by another Terraform process or a stale lock. The best immediate course is to verify no other process is running (e.g., via 'ps' or task manager), then use 'terraform force-unlock -lock-id=<LOCK_ID>' to release the lock. This is the safe, documented procedure that preserves the state file and DynamoDB lock table integrity.

Answer

Delete the state file from S3 and re-run apply.

Answer

Manually delete the DynamoDB lock table item.

Answer

Wait for 15 minutes and re-run apply.

Question 15

An engineer modifies a Terraform configuration by increasing the instance_count for an AWS EC2 resource from 2 to 5. After running terraform plan, which change will be displayed?

Accepted Answer

Three new resources will be created, two unchanged.. Terraform's `instance_count` meta-argument uses a count-based resource management strategy. When the count increases from 2 to 5, Terraform treats the existing resources (index 0 and 1) as unchanged and plans to create three new resources (indices 2, 3, and 4). No in-place updates or destructions occur because the existing resources' configurations remain identical.

Answer

One new resource will be created and two modified.

Answer

Two existing resources will be destroyed and five new created.

Answer

All five resources will be updated in-place.

Question 16

Refer to the exhibit. A developer runs `terraform plan -out=tfplan` and then `terraform apply "tfplan"`. During apply, network fails and apply is interrupted. The developer then runs `terraform apply` again (without a plan file). What will happen?

Accepted Answer

It will create a new plan and apply only the changes that are still needed. When `terraform apply` is run without a plan file, Terraform automatically creates a new plan based on the current state and configuration, then applies only the changes that are still needed. Since the previous apply was interrupted, the state file reflects the partial progress, and the new plan will detect any remaining resources that still need to be created, updated, or destroyed, ensuring idempotent behavior.

Answer

It will automatically use the previously saved plan file `tfplan`

Answer

It will fail because the state is locked from the previous apply

Answer

It will resume the previous apply from where it left off

Question 17

A module 'web_app' defines an input variable 'instance_count' with type = number and a validation block ensuring it is between 1 and 10. What happens if a user sets instance_count = 0?

Accepted Answer

Terraform returns an error during validation and stops execution.. HashiCorp Terraform validates input variables against their declared type and any validation blocks before applying configuration. When `instance_count = 0` is set, the validation block's condition `var.instance_count >= 1 && var.instance_count <= 10` evaluates to `false`, causing HashiCorp Terraform to halt with an error during the `terraform plan` or `terraform validate` phase, preventing any further execution.

Answer

Terraform applies the module with zero instances, as a value of 0 is allowed.

Answer

Terraform ignores the validation if the variable is explicitly set.

Answer

Terraform uses the default value for instance_count from the module.

Question 18

You are a platform engineer at a growing startup. The company currently manages infrastructure manually by SSH-ing into servers to install packages and update configurations. As the team grows, this approach has led to frequent configuration drift, inconsistent environments, and manual errors. Deploying a new environment takes several days and requires detailed runbooks. The CTO has asked you to propose a solution that improves consistency, reduces deployment time, and enables version control of infrastructure. You are evaluating Infrastructure as Code (IaC) tools like Terraform. Which course of action best addresses the CTO's requirements?

Accepted Answer

Adopt Terraform to define all infrastructure as code, store configurations in a Git repository, and use a CI/CD pipeline to apply changes automatically.. Terraform directly addresses the CTO's requirements by enabling infrastructure as code (IaC), which ensures consistent, repeatable deployments through declarative configuration files stored in Git for version control. Using a CI/CD pipeline to automatically apply changes eliminates manual SSH errors, reduces deployment time from days to minutes, and prevents configuration drift by enforcing a single source of truth for infrastructure state.

Answer

Improve SSH key management and use configuration management tools like Ansible to apply changes.

Answer

Migrate all applications to containers and use Kubernetes for orchestration.

Answer

Create more detailed runbooks and require peer review for all manual changes.

Question 19

A team uses a remote state backend with partial configuration. They have a `backend` block with only the `bucket` attribute, and the rest of the backend configuration is provided via CLI during `terraform init`. Which of the following best describes the purpose of partial configuration?

Accepted Answer

It allows sensitive backend configuration to be provided dynamically, avoiding hardcoding.. Partial configuration in Terraform remote state backends allows you to split backend settings between the `backend` block in your configuration and dynamic inputs provided at `terraform init` time. This is especially useful for sensitive values like access keys or secret tokens, which can be supplied via CLI flags, environment variables, or interactive prompts, thereby avoiding hardcoding them in version-controlled files. Option D correctly identifies this primary purpose of enhancing security and flexibility.

Answer

It reduces the number of files needed for configuration.

Answer

It is required when using Terraform Cloud.

Answer

It enables state locking.

Question 20

What is the purpose of the `terraform state list` command?

Accepted Answer

List all resources in the current state file. `terraform state list` lists all resources currently tracked in the Terraform state file, providing their resource addresses. Option B correctly describes this. Option A is incorrect because `terraform state list` does not show planned resources; that is the role of `terraform plan`. Option C lists resources from configuration (not from state), D lists workspaces, and E lists providers.

Answer

List all resources that would be created by the current plan

Answer

List all resources defined in the Terraform configuration

Answer

List all available workspaces

Answer

List all providers used in the configuration