TF-004 Practice Test 6 — 10 Questions

Question 1

After running terraform apply, you see the error: 'Error: Error loading state: state snapshot was created by Terraform v0.12.0, but this is Terraform v1.2.0'. What should you do to resolve this?

Accepted Answer

Run terraform apply with no changes to upgrade the state format. Running `terraform apply` with no changes triggers Terraform to automatically upgrade the state file format to the version compatible with the current Terraform binary (v1.2.0). Terraform state files are versioned internally, and when a newer version of Terraform reads an older state format, it performs an in-place upgrade during the next state write operation, such as an apply that results in no changes. This avoids manual intervention or data loss.

Answer

Run terraform state upgrade

Answer

Delete the state file and reimport resources

Answer

Downgrade Terraform to v0.12.0

Question 2

A team is using Terraform workspaces to manage multiple environments with a single configuration. They store state in an S3 backend. Which statement about Terraform workspaces is true?

Accepted Answer

The default workspace is named "default" and cannot be deleted. The default workspace in Terraform is always named 'default' and cannot be deleted. This workspace is created automatically when you initialize a configuration, and it serves as the baseline workspace for state management. The S3 backend fully supports workspaces, and each workspace stores its state under a separate path in the S3 bucket, enabling environment isolation without changing the configuration.

Answer

There is a limit of 10 workspaces per configuration

Answer

Workspaces can only be used with the local backend

Answer

Workspaces automatically isolate variable values and provider configurations

Question 3

A DevOps engineer is writing a Terraform configuration to provision an AWS EC2 instance. They want to ensure that the instance is replaced if the AMI ID changes, but not if the instance type changes. Which lifecycle meta-argument should be used?

Accepted Answer

Set `create_before_destroy = true` and add `instance_type` to `ignore_changes`. `create_before_destroy = true` ensures the new instance is created before the old one is destroyed, which is a best practice for zero-downtime deployments when the AMI changes. Adding `instance_type` to `ignore_changes` tells Terraform to ignore changes to the instance type attribute during plan/apply, so the instance is not replaced when only the instance type changes. This combination precisely meets the requirement: replacement on AMI change, no replacement on instance type change.

Answer

Set `prevent_destroy = true`

Answer

Set `ignore_changes = all`

Answer

Set `create_before_destroy = true` only

Question 4

An organization uses Terraform Cloud for remote state management. A user runs `terraform apply` locally but receives an error that the state is locked. What is the most likely cause?

Accepted Answer

Another user or process is currently running a Terraform operation that modifies the same state.. Terraform Cloud uses a state locking mechanism to prevent concurrent modifications that could corrupt the state file. When a user runs `terraform apply` locally, the command first attempts to acquire a lock on the remote state. If another user or process (e.g., a Terraform Cloud run, a CI/CD pipeline, or another local apply) is already holding that lock, the new operation will fail with a 'state is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The Terraform configuration has a syntax error.

Answer

The user does not have access to the remote state backend.

Answer

The remote backend is temporarily unavailable.

Question 5

Refer to the exhibit. An engineer runs 'terraform plan' and receives an error: 'Error refreshing state: state data in S3 does not have the expected content.' The state file exists and is not corrupted. What is the most likely cause?

Accepted Answer

The state file was written by a different backend configuration (e.g., different key or workspace).. The error 'state data in S3 does not have the expected content' indicates a mismatch between the state file's content and what Terraform expects based on the current backend configuration. This typically occurs when the state file was written using a different backend key, workspace, or bucket path, causing Terraform to read a state that does not match the expected serial or lineage. The state file itself is not corrupted, but the backend configuration (e.g., different `key` or `workspace_key_prefix`) points to a different state object in S3.

Answer

The state file is locked by another process.

Answer

The DynamoDB table does not exist.

Answer

The S3 bucket is in a different region.

Question 6

An operator runs terraform apply and receives the exhibit error. The instance was created but Terraform reports a failure. What is the most likely cause?

Accepted Answer

A provisioner block is configured to wait for SSH, but the instance is not reachable. The error indicates that the instance was created successfully but Terraform reports a failure during the apply phase. This typically occurs when a provisioner block (e.g., file or remote-exec) is configured to wait for SSH connectivity, but the instance is not reachable within the timeout period. Terraform marks the resource as 'tainted' and reports a failure, even though the cloud resource itself was provisioned.

Answer

The state file is locked and cannot be updated

Answer

The AMI ID is incorrect and the instance failed to boot

Answer

The AWS API returned an error during instance creation

Question 7

An organization stores their Terraform modules in a private Git repository. They need to reference a module that resides in a subdirectory called 'modules/rds' within the repository 'infra-modules' on the main branch. Which source argument should be used?

Accepted Answer

source = "git::https://github.com/org/infra-modules.git//modules/rds". Terraform's module source syntax for Git repositories uses a double slash (`//`) to specify a subdirectory within the repository. The format `git::https://github.com/org/infra-modules.git//modules/rds` tells Terraform to clone the repository at the main branch and then use the module located in the `modules/rds` subdirectory. This is the standard way to reference a module in a subdirectory of a Git repository.

Answer

source = "git::https://github.com/org/infra-modules.git"

Answer

source = "git::https://github.com/org/infra-modules.git:modules/rds"

Answer

source = "git::https://github.com/org/infra-modules.git//rds"

Question 8

Drag and drop the steps to initialize a Terraform working directory in the correct order.

Accepted Answer

Write Terraform configuration files, then run terraform init, then run terraform validate.. Initialization begins after writing configs; terraform init downloads providers/modules, creates .terraform directory, and validate checks syntax.

Answer

Run terraform init, then write Terraform configuration files, then run terraform validate.

Answer

Write Terraform configuration files, then run terraform validate, then run terraform init.

Answer

Run terraform validate, then write Terraform configuration files, then run terraform init.

Question 9

A DevOps team is using Terraform Cloud to manage infrastructure. They want to integrate Terraform into their CI/CD pipeline by triggering runs programmatically. Which approach should they use to invoke a Terraform run from an external system?

Accepted Answer

Use the Terraform Cloud API to trigger a run.. The Terraform Cloud API provides a programmatic endpoint to trigger runs, allowing external CI/CD systems to initiate Terraform operations without manual intervention. This is the correct approach because it directly invokes a run with full control over variables, configuration versions, and apply strategies, aligning with the requirement to integrate Terraform into a CI/CD pipeline programmatically.

Answer

Set up a webhook from the VCS provider to trigger runs.

Answer

Configure a remote backend to automatically run apply.

Answer

Execute 'terraform apply -auto-approve' in the CI pipeline.

Question 10

A team is using Terraform with multiple environments (dev, staging, prod) and wants to use separate state files. They are considering workspaces. A senior engineer suggests using separate directory structures instead of workspaces for prod. What is the strongest reason for this recommendation?

Accepted Answer

Workspaces share the same backend configuration, increasing the risk of accidental changes to production.. Workspaces share the same backend configuration, meaning all workspaces (including prod) use the same state storage location and access controls. This increases the risk of accidental changes to production because a single backend misconfiguration or a mistaken workspace switch can lead to unintended modifications to the production state file. Separate directory structures allow for independent backend configurations, enabling stricter access controls and isolation for production.

Answer

Workspaces cannot isolate state files.

Answer

Workspaces make it harder to refactor configurations.

Answer

Workspaces do not support state locking.