TF-004 Practice Test 8 — 10 Questions

Question 1

An organization uses a remote backend (S3) with DynamoDB for state locking. A developer runs `terraform plan` and gets the error: "Error acquiring the state lock: ConditionalCheckFailedException". What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Another Terraform process is currently holding the state lock. The error 'ConditionalCheckFailedException' occurs when Terraform attempts to acquire a lock in DynamoDB but the conditional write fails because the lock item already exists with a different lock ID. This indicates another Terraform process (or a stale lock) is currently holding the state lock, preventing concurrent operations to protect state integrity.

Answer

The S3 bucket does not exist

Answer

The DynamoDB table is not yet created

Answer

The Terraform version is incompatible with the backend

Question 2

A company has a Terraform configuration that works correctly in us-east-1 but fails in us-west-2 due to resource availability. What is the best way to handle this?

Accepted Answer

Use data sources. Data sources allow Terraform to query the target region for available resources at plan time, enabling dynamic configuration that adapts to regional differences. By using a data source to filter or validate resource availability, the configuration can fail gracefully or select an alternative resource without hardcoding region-specific values.

Answer

Hardcode region in resources

Answer

Use count

Answer

Use provisioners

Question 3

Refer to the exhibit. A user runs `terraform plan` and receives this error. The user is using a local backend. Which of the following is the most likely cause?

Accepted Answer

The configured state file path's directory does not exist.. With a local backend, Terraform stores state in a local file, typically `terraform.tfstate`. The error indicates that the directory specified for the state file path does not exist. Terraform requires the parent directory to exist before it can write the state file; if it is missing, the plan fails with this error.

Answer

The workspace is not selected correctly.

Answer

The state file is corrupted.

Answer

The backend is misconfigured for remote state.

Question 4

A developer is new to Terraform and wants to understand the core workflow. Which sequence of commands correctly represents the basic Terraform workflow?

Accepted Answer

terraform init, terraform plan, terraform apply. The basic Terraform workflow follows a strict three-step sequence: `terraform init` to initialize the working directory and download required providers/modules, `terraform plan` to preview the changes Terraform will make against the current state, and `terraform apply` to execute the planned changes. Skipping `init` or `plan` would either fail due to missing providers or apply changes without a reviewable execution plan, violating the standard workflow.

Answer

terraform init, terraform apply

Answer

terraform plan, terraform init, terraform apply

Answer

terraform validate, terraform plan, terraform destroy

Question 5

An organization has a policy that all AWS S3 buckets must have versioning enabled. They want to ensure that even if someone removes the `versioning` block from the configuration, the bucket still has versioning enabled after `terraform apply`. Which lifecycle configuration should they add to the `aws_s3_bucket` resource?

Accepted Answer

`ignore_changes = [versioning]`. `ignore_changes = [versioning]` tells Terraform to disregard any changes to the `versioning` block in the configuration during `terraform apply`. This ensures that even if someone removes the `versioning` block from the HCL, the existing versioning state on the S3 bucket (enabled) remains unchanged, enforcing the organization's policy.

Answer

`replace_triggered_by = [aws_s3_bucket_versioning.this]`

Answer

`prevent_destroy`

Answer

`create_before_destroy`

Question 6

A user runs 'terraform plan' and the output includes a change that adds a new resource. However, the user expected the change to modify an existing resource. What is the most likely cause?

Accepted Answer

The resource name or type was changed in the configuration.. When a resource's name or type is changed in the configuration, Terraform interprets it as a request to destroy the old resource and create a new one, because Terraform maps each resource block to a state entry using its resource type and name (e.g., `aws_instance.web`). The plan output will show a `+` (create) for the new resource and a `-` (destroy) for the old one, rather than a `~` (update in-place). This matches the user's observation of a new resource being added instead of the expected modification.

Answer

The provider version was updated.

Answer

A required attribute was added to the resource block.

Answer

The state file was manually deleted.

Question 7

A developer runs `terraform plan` and it fails with a provider plugin error. Which command should they run first to resolve the issue?

Accepted Answer

terraform init. The `terraform init` command is the correct first step because it initializes the working directory, downloads the required provider plugins, and sets up the backend configuration. A provider plugin error typically indicates that the provider plugins are missing, outdated, or not properly installed, and `terraform init` resolves this by fetching the correct versions from the Terraform registry.

Answer

terraform validate

Answer

terraform apply

Answer

terraform fmt

Question 8

An organization uses Terraform Cloud and wants to automate run triggers when a new version of a module is published in a private module registry. What is the recommended method?

Accepted Answer

Configure a webhook in the private module registry to notify Terraform Cloud.. Terraform Cloud supports webhook notifications from private module registries. When a new module version is published, the registry can send an HTTP POST payload to a configured webhook URL in Terraform Cloud, which triggers a run in the associated workspace. This eliminates the need for polling or manual intervention, aligning with Terraform Cloud's event-driven automation model.

Answer

Create a Git repository with versioned modules and use GitOps.

Answer

Schedule terraform plan to run periodically via cron.

Answer

Use the Terraform Cloud API to poll the registry for new versions.

Question 9

A developer runs `terraform plan` and sees that Terraform will create a new S3 bucket and modify a security group. Which Terraform feature allows the developer to review these changes before applying them?

Accepted Answer

The `terraform plan` command. The `terraform plan` command creates an execution plan that shows what actions Terraform will take to achieve the desired state defined in the configuration. It compares the current state with the configuration and outputs a diff-like summary of resources to be created, modified, or destroyed, allowing the developer to review changes before applying them with `terraform apply`.

Answer

The `terraform apply` command

Answer

The `terraform validate` command

Answer

The `terraform state` command

Question 10

Your organization manages a multi-cloud infrastructure using Terraform. The infrastructure includes an AWS VPC with subnets and EC2 instances, and an Azure resource group with virtual networks and VMs. The Terraform configuration is stored in a Git repository, and state is stored in an S3 bucket with DynamoDB locking. Recently, a developer updated the configuration to add a new security group rule in AWS, but after running `terraform apply`, the rule was not created. The developer verified that the configuration file contains the rule. Additionally, the developer noticed that the state file shows the security group exists but without the new rule. The developer ran `terraform plan` again, and it shows that the rule will be created. However, when applying, it fails with a 'timeout' error. The operations team suspects network connectivity issues to the S3 backend. What is the best course of action to resolve this issue?

Accepted Answer

Migrate the state backend to Terraform Cloud, and use remote operations for applies.. The timeout error when applying, despite a successful plan, indicates that the issue is not with the configuration or state locking but with the network connectivity to the S3 backend during the apply operation. Migrating to Terraform Cloud with remote operations moves the execution environment to Terraform Cloud's infrastructure, which has reliable connectivity to the S3 backend, bypassing the local network issues. This resolves the timeout without altering the configuration or compromising state integrity.

Answer

Run `terraform init` again to reinitialize the backend.

Answer

Increase the timeout value in the Terraform provider configuration.

Answer

Disable state locking by removing the DynamoDB table reference.