TF-003 Timed Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Accepted Answer

Automated testing and deployment pipelines can be integrated.. Option A is correct because IaC enables infrastructure to be defined in code, which can be integrated into automated CI/CD pipelines. Tools like Terraform or AWS CloudFormation allow infrastructure validation, testing, and deployment to be automated, reducing human error and speeding up delivery.

Answer

The same code can be used for any cloud provider without modification.

Answer

No learning curve is required; existing knowledge of manual processes applies directly.

Question 2

During a `terraform apply`, the operation fails mid-way due to a network outage, leaving some resources created. The operator wants to resume applying from where it left off without destroying the already-created resources. What should they do?

Accepted Answer

Run terraform apply again. Option A is correct because Terraform uses a state file to track the resources it manages. When `terraform apply` fails mid-way, the state file is updated to reflect the resources that were successfully created. Running `terraform apply` again will cause Terraform to compare the current state with the configuration, detect that the already-created resources exist, and proceed to create only the remaining resources, effectively resuming from where it left off without destroying anything.

Answer

Run terraform destroy and then apply

Answer

Run terraform refresh

Answer

Run terraform apply -auto-approve

Question 3

Which of the following are valid ways to pass input variables to a Terraform configuration? (Select all that apply.)

Accepted Answer

Use the '-var' flag on the command line to set a single variable.. Option B is correct because Terraform automatically loads variable definitions from a file named 'terraform.tfvars' (or 'terraform.tfvars.json') in the current directory when you run a plan or apply. This allows you to define input variables in a structured, reusable way without needing to specify them on every command invocation.

Question 4

A DevOps engineer is troubleshooting a failed 'terraform plan' command. The error message is: 'Error: Error acquiring the state lock' followed by a message that the lock is held by another process. The team uses Terraform Cloud with remote state. Which of the following is the most likely cause and correct resolution?

Accepted Answer

Identify the lock holder via Terraform Cloud UI and use 'terraform force-unlock' to release it.. Option D is correct because the state lock in Terraform Cloud is held by another run or process; using the 'force-unlock' command with the correct lock ID from the Terraform Cloud UI can release it. Option A is wrong because there is no such option on the apply command. Option B is wrong because waiting may be indefinite if the lock is stuck. Option C is wrong because you cannot disable locking in Terraform Cloud.

Answer

Disable state locking in the backend configuration.

Answer

Wait for the lock to be released automatically.

Answer

Add the '-lock=false' flag to the plan command.

Question 5

Which THREE practices are recommended when using Terraform modules? (Select THREE.)

Accepted Answer

Design modules to have a single clear purpose.. Option A is correct because Terraform modules should follow the single-responsibility principle: each module should encapsulate a clear, focused purpose (e.g., provisioning a VPC, an EC2 instance, or a database). This makes modules reusable, testable, and easier to compose. A module that tries to do too many things becomes brittle and hard to maintain.

Answer

Hardcode provider-specific details like region inside the module to simplify usage.

Answer

Create a new module for each individual resource type.

Question 6

A company uses Terraform Cloud and wants to enforce policies that prevent creating resources with public IP addresses unless explicitly approved. What Terraform Cloud feature should they use?

Accepted Answer

Sentinel policies. Option C is correct because Sentinel is the policy-as-code framework in Terraform Cloud. Option A is wrong because workspaces are for state isolation, not policy. Option B is wrong because VCS integration is for triggering runs. Option D is wrong because run tasks allow custom validation but Sentinel is the built-in policy engine.

Answer

VCS integration

Answer

Workspaces

Answer

Run tasks

Question 7

An organization uses Terraform workspaces to manage multiple environments (dev, staging, prod). They notice that terraform plan in the prod workspace unexpectedly shows changes to a resource that should be identical across workspaces. The resource uses a backend that stores state in an S3 bucket. What is the most likely cause?

Accepted Answer

The terraform.workspace variable is used in the resource configuration.. Option D is correct because if the resource configuration references the terraform.workspace variable (e.g., for naming), the plan will differ per workspace. Option A is wrong because S3 versioning affects state file recovery, not plan differences. Option B is plausible but less likely because copying state would cause identical state initially. Option C is wrong if the provider version is consistent across workspaces.

Answer

The prod workspace was created by copying the dev workspace state.

Answer

The S3 bucket does not support versioning.

Answer

The provider version differs between workspaces.

Question 8

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Accepted Answer

The workspace does not exist.. Option C is correct because the absence of a state file indicates the workspace does not exist or is empty. Option A would cause corruption, not absence. Option B would cause a backend mismatch. Option D would cause a lock conflict.

Answer

The backend configuration changed after the last apply.

Answer

The state file was manually edited in S3.

Answer

Another user ran 'terraform apply' concurrently.

Question 9

A Terraform configuration includes a variable for a database password marked as sensitive. When a user runs 'terraform apply', the password appears as (sensitive) in the plan output. However, they want to pass this password to a provisioner as an environment variable. What should they do?

Accepted Answer

Use the nonsensitive() function around the variable when assigning.. Option A is correct because 'nonsensitive()' allows using the value while preserving the sensitive flag in state. Option B would expose the password in logs. Option C is false; sensitive affects output. Option D does not help.

Answer

Use the variable directly; sensitive only affects CLI output.

Answer

Store the password in a local value with sensitive = false.

Answer

Remove the sensitive flag from the variable.

Question 10

Refer to the exhibit. After applying this configuration, a team member manually changes the instance type to 't2.small' via the AWS console. The next `terraform plan` shows a change to revert to 't2.micro'. What does this demonstrate?

Accepted Answer

Terraform's desired state reconciliation. Terraform has detected configuration drift (the manual change) and plans to reconcile back to the desired state defined in configuration (C). A is incorrect because immutable infrastructure would replace the instance entirely. B is partially true but the key point is reconciliation, not just detection. D is false.

Answer

Terraform's drift detection only

Answer

Immutable infrastructure pattern

Answer

A misconfiguration in the Terraform code

Question 11

Refer to the exhibit. An engineer runs 'terraform plan' and receives an error: 'Error refreshing state: state data in S3 does not have the expected content.' The state file exists and is not corrupted. What is the most likely cause?

Accepted Answer

The state file was written by a different backend configuration (e.g., different key or workspace).. The error indicates that the state data read from S3 does not match what Terraform expects. This can happen if the state file was written by a different backend configuration (e.g., different key or bucket) or if the state file has a different serial. Option C is correct because if a teammate used a different backend configuration to write state (e.g., a different workspace or different key), the state file might have a different serial number causing this error.

Answer

The state file is locked by another process.

Answer

The DynamoDB table does not exist.

Answer

The S3 bucket is in a different region.

Question 12

Refer to the exhibit. A developer runs terraform plan and receives this error. What should the developer do to resolve the error?

Accepted Answer

Run terraform init -migrate-state to migrate the state to the new region.. The error indicates that the backend configuration has changed (the region changed from us-east-1 to us-west-2). Terraform requires re-initialization when backend configuration changes.

Answer

Run terraform plan again; the error will self-resolve after a few minutes.

Answer

Update the backend configuration in the Terraform code to match the previous region.

Answer

Run terraform state rm to remove the state file and start fresh.

Question 13

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

Accepted Answer

Configure Terraform Cloud with run triggers and policy checks. Option B is correct because Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer

Store state in a remote backend and use terraform apply in the pipeline

Answer

Use the Terraform CLI in the CI/CD pipeline with remote state

Answer

Run terraform apply locally after manual approval

Question 14

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 15

A user receives the error shown in the exhibit when running `terraform init`. The user is behind a corporate proxy. Which environment variable should be set to resolve this issue?

Accepted Answer

HTTP_PROXY=http://proxy:8080. Option C is correct because Terraform uses the standard `HTTP_PROXY` environment variable to route HTTP/HTTPS requests through a corporate proxy when downloading providers and modules. Setting `HTTP_PROXY=http://proxy:8080` instructs Terraform's underlying HTTP client to connect via the specified proxy, resolving the connectivity error during `terraform init`.

Answer

TF_VAR_proxy=http://proxy:8080

Answer

AWS_ACCESS_KEY_ID

Answer

TF_LOG=DEBUG

Question 16

After running 'terraform apply', the user sees that the 'aws_s3_bucket_object' is created successfully, but the bucket name is not as expected. What is the most likely reason?

Accepted Answer

The output 'bucket_name' in the module is set to 'aws_s3_bucket.this.id', which is the bucket name, so the bucket name should be as expected.. Option D is correct because the module output 'bucket_name' is defined as 'aws_s3_bucket.this.id', and in Terraform, the 'id' attribute of an 'aws_s3_bucket' resource is exactly the bucket name (not a generated ID). Since the user sees the object created successfully, the module is being called and the output is correctly referencing the bucket name, so the bucket name should be as expected. The question implies the user's expectation is wrong or the bucket name is actually correct, making D the only statement that aligns with Terraform's behavior.

Answer

The module variable 'bucket_name' is not consumed by the resource; the resource uses a hardcoded name.

Answer

The module output is incorrectly defined; it should use 'bucket' attribute instead of 'id'.

Answer

The module does not have an output for the bucket name, so the reference fails silently.

Question 17

Refer to the exhibit. A developer runs terraform plan and sees "No changes". However, the developer knows that manual changes were made to the infrastructure outside Terraform. What is the most likely reason terraform plan does not detect the drift?

Accepted Answer

Terraform plan does not refresh state by default; it uses the existing state file.. Terraform plan compares the state file to the configuration. If the state file does not reflect manual changes (because it was not refreshed), terraform plan may not detect drift unless -refresh-only or a refresh is performed.

Answer

The manual changes were made to resources not managed by Terraform.

Answer

Terraform only detects drift when running terraform apply.

Answer

The manual changes were reverted before the plan was run.

Question 18

A developer creates a module that provisions an AWS EC2 instance and an S3 bucket. The module outputs the instance ID and bucket ARN. When using this module, the root configuration references module.my_module.instance_id and module.my_module.bucket_arn. After running terraform apply, they notice that the bucket ARN is empty. What is the most likely cause?

Accepted Answer

The output value in the module is defined incorrectly, e.g., referencing a non-existent attribute.. Option C is correct because the most likely cause of an empty output value is that the output block in the module references an attribute that does not exist on the resource. For example, if the output is defined as `output "bucket_arn" { value = aws_s3_bucket.my_bucket.arn }` but the resource is actually `aws_s3_bucket.my_bucket` and the correct attribute is `arn`, a typo like `arnn` or `id` would cause Terraform to return an empty string (or an error during plan). Terraform validates attribute references at plan time, but if the attribute is missing or misspelled, the output value will be empty or cause a failure.

Answer

The output is defined in the module but not in the root configuration.

Answer

The S3 bucket creation depends on another resource that hasn't been created yet.

Answer

The IAM role used by Terraform does not have permission to read the bucket ARN.

Question 19

A Terraform configuration uses a module from the Terraform Registry. After updating the module version in the configuration, the operator runs 'terraform plan' but does not see the changes expected from the new version. What is the most likely cause?

Accepted Answer

The operator did not run 'terraform init' after changing the version.. When you change a module version in the configuration, Terraform must re-initialize the working directory to download the new version and update the dependency lock file (.terraform.lock.hcl). Running 'terraform plan' without first running 'terraform init' will use the previously cached module version, so the expected changes from the new version will not appear. 'terraform init' is the required command to fetch and lock the updated module source.

Answer

The operator did not run 'terraform get' to update modules.

Answer

The operator did not run 'terraform refresh' to update state.

Answer

The module version constraint is stored in the state file and must be updated.

Question 20

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. Option C is correct because the error indicates the state lock cannot be acquired because another process holds the lock. Options A and B are configuration issues that would cause different errors. Option D is unlikely; a corrupted state file would cause other errors.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.