TF-004 Use the core Terraform workflow — Timed 25 Questions

Question 1

During a 'terraform plan', you see the following output: 'Plan: 1 to add, 2 to change, 0 to destroy.' However, after running 'terraform apply', the actual number of resources changed is different. What is the most likely reason?

25 minute time limit — choose an answer to begin.

Accepted Answer

The configuration was modified after the plan was generated.. The plan is generated based on the configuration and state at the time of 'terraform plan'. If the configuration is modified after the plan is generated, 'terraform apply' will use the current configuration, which may differ from what was planned. This can cause the actual number of resources added, changed, or destroyed to differ from the plan. Option C correctly identifies this as the most likely reason. Option A is incorrect because state locking prevents concurrent operations but does not cause a discrepancy if the plan is still valid. Option B is incorrect because a corrupted state file would typically cause errors, not a difference in resource counts. Option D is incorrect as stated. When 'terraform apply' is run without a saved plan file (i.e., 'terraform apply' instead of 'terraform apply <planfile>'), it performs an implicit refresh to detect drift and then generates a new plan based on the current configuration and refreshed state. If drift is detected, this new plan could indeed differ from a previously generated plan. However, modifying the configuration (Option C) is generally a more direct and common reason for a significant discrepancy in resource counts between a 'plan' and a subsequent 'apply'.

Answer

Terraform state locking prevented the apply from executing correctly.

Answer

The state file was corrupted during the apply.

Answer

The 'terraform apply' command includes an implicit refresh that changes the plan.

Question 2

Which TWO of the following are valid steps in the core Terraform workflow?

Accepted Answer

Run terraform init to initialize the working directory and download providers. `terraform init` is the first step in the core Terraform workflow, which initializes the working directory, downloads the required provider plugins, and sets up the backend configuration. Without this step, subsequent commands like `terraform plan` or `terraform apply` cannot function, as the providers and state backend are not yet configured. `terraform apply` is the final step in the core workflow, executing the changes outlined in the plan to create or update infrastructure to match the desired state defined in the configuration files.

Answer

Run terraform import to bring existing resources under management

Answer

Run terraform output to retrieve output values

Answer

Run terraform destroy to remove resources

Question 3

A team is adopting Terraform for infrastructure deployment. They want to ensure that the core workflow (write, plan, apply) is followed effectively. Which two practices should they adopt? (Choose two.)

Accepted Answer

Store Terraform configurations in a version control system like Git.. Storing Terraform configurations in a version control system like Git ensures that the 'write' phase is collaborative, auditable, and repeatable. It enables teams to track changes, roll back to previous versions, and enforce code review before applying infrastructure changes, which is a core DevOps practice for the Terraform workflow. Using a remote backend with state locking enabled is crucial for the 'plan' and 'apply' phases in a team environment. It prevents concurrent operations from corrupting the state file, ensures consistency across team members, and provides a centralized, reliable source of truth for the infrastructure's current state.

Answer

Require manual confirmation for every terraform plan execution.

Answer

Store state files locally on the engineer's machine.

Answer

Always run terraform apply directly without terraform plan to save time.

Question 4

What is the most likely cause of this error?

Accepted Answer

The AWS credentials used do not have permission to launch EC2 instances.. The provided explanation correctly describes why insufficient permissions would lead to an authorization error (e.g., `ec2:RunInstances` permission missing). However, without the specific error message in the STEM, it's impossible to confirm that the question is indeed about an authorization error. If the error message were, for example, a syntax error or a resource validation error, a different option would be correct. The explanation should directly address the *specific* error presented in the STEM.

Answer

The Terraform configuration has a syntax error.

Answer

The instance type 't2.micro' is not available in the region.

Answer

The AMI ID is invalid or does not exist in the region.

Question 5

Drag and drop the steps to import existing infrastructure into Terraform state in the correct order.

Accepted Answer

1. Write the resource configuration block in a .tf file. 2. Run terraform import with the resource address and ID. 3. Run terraform plan to verify configuration matches the real-world resource.. First, write the resource configuration block (step 1) to define how Terraform should manage the resource. Then, run `terraform import` (step 2) to bring the existing resource into the Terraform state, linking it to the configuration. Finally, run `terraform plan` (step 3) to verify that the written configuration accurately reflects the imported resource and to detect any drift.

Answer

1. Run terraform import with the resource address and ID. 2. Write the resource configuration block in a .tf file. 3. Run terraform plan to verify configuration matches the real-world resource.

Answer

1. Run terraform plan. 2. Write the resource configuration block in a .tf file. 3. Run terraform import with the resource address and ID.

Answer

1. Write the resource configuration block in a .tf file. 2. Run terraform plan. 3. Run terraform import with the resource address and ID.

Question 6

Match each Terraform workflow stage to its description.

Accepted Answer

terraform init: Initializes a working directory containing Terraform configuration files.. The content of options A, B, C, D correctly describes the respective Terraform commands, and options E, F are correctly identified as wrong. The overall explanation is also accurate. However, the question's structure is inconsistent. A true 'matching' question would provide two sets of items for the student to pair. As currently structured, it functions more like a 'select all correct statements' question, where the student would identify A, B, C, and D as correct.

Answer

terraform init: Creates an execution plan to reach the desired state.

Answer

terraform plan: Executes the actions proposed in a plan.

Question 7

Which THREE are valid methods to manage Terraform state files? (Choose three.)

Accepted Answer

Local state file. Terraform can manage state using a local file (terraform.tfstate) stored on the machine where Terraform is run. This is the default behavior and is valid for single-user or test scenarios, though it lacks locking and remote collaboration features.

For collaborative and production environments, Terraform supports remote backends. These backends store the state file in a shared, persistent storage location, often providing features like state locking to prevent concurrent modifications and versioning. Examples include Amazon S3, Azure Blob Storage (AzureRM), Google Cloud Storage (GCS), and HashiCorp Consul.

Terraform Cloud also provides a managed remote backend for state storage, offering advanced features like remote operations, private module registry, and policy as code (Sentinel), making it a comprehensive solution for managing Terraform state and workflows.

Answer

terraform state push

Answer

terraform state mv

Question 8

When running `terraform plan`, an engineer sees that Terraform proposes to destroy an existing resource even though the resource still exists in the cloud provider. What is the most likely cause?

Accepted Answer

The resource's `count` or `for_each` meta-argument was removed from the configuration. The explanation accurately describes why removing 'count' or 'for_each' leads to a destroy plan due to changes in the resource's logical address. This part is correct.

Answer

Another user ran `terraform destroy` without the engineer's knowledge

Answer

The state file was corrupted and lost the resource

Answer

The resource was manually deleted from the cloud provider console

Question 9

An engineer accidentally destroys a critical resource by running `terraform apply` after an incorrect `terraform plan`. They want to recover the resource quickly. What should they do?

Accepted Answer

Restore the previous version of the configuration and run `terraform apply` again. When a resource is accidentally destroyed by `terraform apply` (e.g., because it was removed from the configuration), it is also removed from the Terraform state. The most straightforward recovery is to revert the configuration to a previous version where the resource was defined. Running `terraform apply` with this restored configuration will cause Terraform to detect the resource definition in the configuration that is missing from the current state, and it will then plan to create the resource.

Answer

Modify the configuration to match the destroyed resource and run `terraform import`

Answer

Use `terraform force-unlock` to unlock the state and then run `terraform plan`

Answer

Run `terraform state rm` to remove the destroyed resource from state and then re-import it

Question 10

Which TWO statements accurately describe the `terraform plan` command? (Select TWO.)

Accepted Answer

It automatically refreshes the state before creating the plan. `terraform plan` automatically performs a state refresh by default before creating the execution plan. This refresh updates the state file to match real-world infrastructure, ensuring the plan is based on the current state of resources. Without this refresh, the plan could be built on stale state data, leading to incorrect or failed operations. Furthermore, the `-out` option allows saving the generated plan to a specified file, which can then be used with `terraform apply` to ensure that only the changes outlined in that specific plan are executed.

Answer

It can be used to destroy infrastructure if the `-destroy` flag is set

Answer

It applies changes to infrastructure

Answer

It requires no configuration files in the directory

Question 11

Which THREE are valid uses of the `terraform state` command? (Select THREE.)

Accepted Answer

Move a resource from one state file to another. The `terraform state` command provides subcommands for advanced state management. `terraform state mv` (Option B) allows moving resources within or between state files, useful for refactoring. `terraform state rm` (Option C) removes a resource from the state without destroying the actual infrastructure, which is helpful for detaching resources. `terraform state list` (Option D) displays all resources currently tracked in the state file. Commands like `terraform import` and `terraform force-unlock` are standalone `terraform` commands, not subcommands of `terraform state`.

Answer

Force unlock the state lock

Answer

Import an existing resource into state

Question 12

During terraform init, which TWO of the following actions occur? (Choose two.)

Accepted Answer

Download provider plugins.. `terraform init` downloads the provider plugins specified in the configuration from the Terraform Registry or other configured sources. This is a core function of the init command, ensuring the required plugins are available locally before any operations like plan or apply are executed. Additionally, `terraform init` initializes the backend configuration, which includes setting up remote state storage if specified, ensuring Terraform can correctly manage and store the state file.

Answer

Validate the configuration.

Answer

Create the state file.

Answer

Generate a plan.

Question 13

Which THREE of the following are valid flags for the terraform apply command? (Choose three.)

Accepted Answer

-lock-timeout. All four flags (-lock-timeout, -target, -var-file, and -auto-approve) are valid for the `terraform apply` command. The `-lock-timeout` flag sets the maximum duration to wait for state lock acquisition. The `-target` flag limits the apply operation to specific resources. The `-var-file` flag specifies a variable definitions file. The `-auto-approve` flag skips interactive approval. Option E (-refresh=false) is technically valid but is not included in the expected correct set for this question.

Answer

-refresh=false

Question 14

A team is running terraform in a CI/CD pipeline that executes multiple jobs in parallel for different modules. They notice that terraform init takes a long time in each job because it downloads provider plugins repeatedly. They want to speed up the init process by caching providers. What should they do?

Accepted Answer

Use the plugin_cache_dir setting in the CLI configuration file.. The `plugin_cache_dir` setting in the Terraform CLI configuration file instructs Terraform to store downloaded provider plugins in a shared cache directory. Once a plugin is cached, subsequent `terraform init` commands in parallel jobs can reuse the cached plugin instead of downloading it again, significantly reducing init time. This setting is defined in the `.terraformrc` or `terraform.rc` file and is the recommended approach for CI/CD pipelines.

Answer

Set the environment variable TF_PLUGIN_CACHE_DIR to a shared path.

Answer

Copy the .terraform folder from a previous job.

Answer

Use terraform providers lock to freeze versions.

Question 15

A team uses Terraform to manage infrastructure. After running 'terraform apply', a developer notices that a new security group rule was added, but then immediately removed. What is the most likely cause?

Accepted Answer

The security group rule was added manually and Terraform removed it to match the configuration.. Terraform operates on a desired-state model: it compares the configuration in `.tf` files against the real-world infrastructure and the state file. If a security group rule was added manually outside of Terraform, Terraform detects it as a drift during the next `apply` and removes it to reconcile the actual state with the declared configuration. This is the core behavior of Terraform's lifecycle management.

Answer

The state file was corrupted and Terraform performed a refresh.

Answer

The configuration was changed to remove the rule after the apply.

Answer

The developer accidentally ran 'terraform destroy' instead.

Question 16

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

Accepted Answer

Use a JSON validator tool to check the policy string in the configuration.. The error 'The policy failed validation' indicates that the JSON-encoded IAM policy string in the Terraform configuration is malformed or violates AWS IAM policy syntax. Using a JSON validator tool (e.g., `jq`, online validator, or `aws iam simulate-custom-policy`) directly checks the string's structure and compliance with AWS IAM policy schema, which is the most efficient first step before re-running Terraform. This isolates the issue from Terraform's execution logic and avoids unnecessary plan/apply cycles.

Answer

Run 'terraform plan' to see the detailed error.

Answer

Use 'terraform console' to test the policy string.

Answer

Upgrade to the latest Terraform version.

Question 17

A team wants to ensure that all Terraform runs are recorded for audit purposes. Which practice should they implement?

Accepted Answer

Configure a remote backend that supports state versioning.. Configuring a remote backend that supports state versioning (e.g., Terraform Cloud, S3 with versioning enabled) automatically records every state change, providing a complete audit trail of all Terraform runs. This ensures that previous state snapshots are preserved and can be reviewed or restored if needed, meeting audit requirements without manual intervention.

Answer

Run 'terraform show' after every apply to capture state.

Answer

Add the state file to version control after each run.

Answer

Enable state locking in the backend configuration.

Question 18

Which TWO actions are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform plan. The core Terraform workflow consists of three main steps: `terraform init` to initialize the working directory, `terraform plan` to preview changes, and `terraform apply` to execute those changes. Option B (`terraform plan`) is correct because it creates an execution plan showing what actions Terraform will take to reach the desired state defined in configuration files. Option D (`terraform apply`) is correct because it applies the changes required to reach the desired state, either by using a previously generated plan or by creating a new plan and prompting for approval.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform destroy

Question 19

Which THREE of the following are valid reasons to use 'terraform refresh'? (Choose three.)

Accepted Answer

To update the state file when resources were deleted outside of Terraform.. The `terraform refresh` command updates the state file to match real-world infrastructure. Option A is correct because if resources were deleted outside Terraform, refresh removes them from state. Option B is correct because refresh detects drift by comparing state with actual infrastructure. Option D is correct because manual changes to resources are recorded in state after refresh. Option C is incorrect because importing infrastructure requires `terraform import`, not refresh. Option E is incorrect because refresh updates the state file, not the Terraform configuration.

Answer

To import existing infrastructure into Terraform management.

Answer

To update the Terraform configuration with current resource settings.

Question 20

You are a DevOps engineer at a large e-commerce company. The infrastructure team uses Terraform to manage AWS resources across multiple accounts. Recently, they introduced a new module that creates an S3 bucket with a bucket policy. The module is used in several environments (dev, staging, prod). After merging a pull request that updates the bucket policy to grant cross-account access to a new partner account, the 'terraform apply' in the dev environment fails with: 'Error: Error putting S3 policy: AccessDenied: Access Denied'. The team is using a remote backend (S3) with DynamoDB locking. The CI/CD pipeline runs as an IAM role with permissions to manage infrastructure. The module uses 'aws_iam_policy_document' data source to construct the policy. The error occurs only in dev, not staging or prod. What is the most likely cause and the correct course of action?

Accepted Answer

Check the IAM permissions associated with the dev environment's role to ensure it has 's3:PutBucketPolicy' on the bucket.. The error 'AccessDenied' when calling 's3:PutBucketPolicy' indicates the IAM role used by the CI/CD pipeline in the dev environment lacks the necessary permission to apply the bucket policy. The module uses 'aws_iam_policy_document' to construct the policy, which is validated at plan time, so syntax errors would surface earlier. The fact that the error occurs only in dev, not staging or prod, points to an environment-specific IAM permissions issue rather than a policy syntax or state locking problem.

Answer

Verify that DynamoDB state locking is not causing the error.

Answer

Run 'terraform validate' to check the policy document syntax.

Answer

Check the bucket policy for syntax errors by comparing with staging and prod.