TF-004 Understand IaC concepts — 10 Questions

Question 1

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Accepted Answer

Automated testing and deployment pipelines can be integrated.. IaC defines infrastructure in code, allowing it to be stored in version control systems like Git, enabling change tracking, collaboration, and rollbacks. This code can be integrated into automated CI/CD pipelines for validation, testing, and deployment, significantly reducing human error and speeding up delivery. By defining infrastructure declaratively, IaC ensures that environments can be replicated consistently and reliably across development, staging, and production, preventing configuration drift.

Answer

The same code can be used for any cloud provider without modification.

Answer

No learning curve is required; existing knowledge of manual processes applies directly.

Question 2

A developer runs terraform apply with the configuration above. The resource is created successfully, but the provisioner fails because the public_ip attribute is not yet known at plan time. What is the most likely cause?

Accepted Answer

The provisioner references a computed attribute that is not known until after resource creation.. The `public_ip` attribute of an AWS instance is a computed attribute that is not known until the resource is created and the cloud provider assigns an IP address. In Terraform, provisioners run during resource creation, but if they reference attributes that are only available after the resource is fully created (i.e., after the cloud provider has assigned the value and Terraform has processed it), the provisioner will fail with an error indicating the value is unknown. This is a fundamental behavior of Terraform's execution model: provisioners execute in the same context as the resource creation, and any attribute that is not known at plan time cannot be used in a provisioner if it's still unknown at the time the provisioner executes.

Answer

The AMI ID is incorrect.

Answer

The local-exec provisioner requires network access to the instance.

Answer

The provisioner runs before the state file is written.

Question 3

Which three statements correctly describe concepts of Infrastructure as Code (IaC) as implemented by Terraform? (Choose three.)

Accepted Answer

IaC enables consistent and repeatable provisioning of infrastructure by defining resources in declarative configuration files.. Options 2, 3, and 6 are correct because they accurately describe core IaC principles as implemented by Terraform. IaC uses declarative configuration files to define infrastructure, enabling consistent and repeatable provisioning. Version control of these files allows changes to be reviewed and rolled back like application code. Terraform's execution plan is a critical feature that previews changes before applying them, reducing risk of unintended modifications.

Answer

IaC eliminates the need for manual configuration entirely by automatically detecting and fixing all configuration drift without human intervention.

Answer

Terraform relies on a mutable infrastructure model, where changes are applied directly to existing resources without destroying and recreating them.

Answer

In Terraform, the desired state is described imperatively, meaning you specify the exact commands to create, modify, or delete resources in order.

Question 4

Which of the following are key benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management? (Choose four.)

Accepted Answer

Facilitates collaboration through code reviews and sharing of configurations. Infrastructure as Code (IaC) enables repeatable and consistent deployments by defining infrastructure in declarative or procedural configuration files, eliminating the variability of manual steps. It reduces human error by automating provisioning tasks that are prone to typos or omissions when performed manually. Version control systems like Git allow infrastructure configurations to be tracked, audited, and rolled back, while code reviews and shared modules promote team collaboration and standardization. Statements like automatically fixing all security vulnerabilities or providing self-healing infrastructure without additional tooling are not core benefits of IaC; they require extra tools and practices.

Answer

Provides self-healing infrastructure without any additional tooling

Answer

Automatically fixes all security vulnerabilities in the infrastructure

Question 5

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Accepted Answer

The workspace does not exist.. The explanation correctly identifies 'not initialized' as a cause for a missing state file, which is a common scenario for the error 'No state file was found!'. However, the option 'The workspace does not exist' is less direct. While a non-existent workspace would indeed lack a state file, Terraform typically provides a more specific error message for a non-existent workspace (e.g., 'Error: Workspace "name" does not exist.'). The error 'No state file was found!' more commonly indicates that `terraform apply` has not been run for the current workspace, or the state file has been manually deleted, which aligns better with the 'not initialized' part of the explanation than with 'workspace does not exist.' Despite this imprecision, options A, B, and C are definitively incorrect for the given error message, making D the intended, albeit imperfect, answer.

Answer

The backend configuration changed after the last apply.

Answer

The state file was manually edited in S3.

Answer

Another user ran 'terraform apply' concurrently.

Question 6

Which two are primary benefits of using Infrastructure as Code (IaC) with Terraform?

Accepted Answer

Consistent and repeatable deployments. Terraform's declarative configuration files define the desired state of infrastructure, enabling consistent and repeatable deployments across environments. These configuration files are typically stored in version control systems, allowing for tracking changes, collaboration, and rollbacks, which are core benefits of treating infrastructure as code. By applying the same version-controlled configuration, Terraform ensures that the infrastructure is provisioned identically every time, eliminating configuration drift and manual errors.

Answer

Real-time monitoring of infrastructure

Answer

Manual configuration of each resource

Answer

Automatic scaling based on CPU usage

Question 7

A company manages a microservices application across multiple AWS accounts using Terraform. They have a dedicated 'infrastructure' repository with Terraform configurations for each account. The team recently migrated their Terraform state to a centralized S3 backend with DynamoDB locking. After the migration, they notice that when two developers run `terraform apply` simultaneously in the same workspace, one of them receives a lock error, but the other proceeds normally. The team wants to ensure that only one apply runs at a time across all workspaces. However, they also need to allow concurrent operations on different workspaces. The current backend configuration uses a single DynamoDB table for all workspaces. What should the team do to achieve their goals?

Accepted Answer

Use a separate DynamoDB table for each workspace to isolate locks. The explanation correctly describes Terraform's default DynamoDB locking behavior. Terraform automatically includes the workspace name in the LockID, ensuring locks are isolated per workspace even with a single DynamoDB table. The observed lock error when two developers apply in the same workspace is the expected and correct behavior for this per-workspace isolation. Therefore, the team's current configuration already achieves the goal of allowing concurrent operations on different workspaces while preventing simultaneous operations on the same workspace. The explanation correctly concludes that no change is needed and that none of the provided options are necessary or correct, directly contradicting the marked correct answer (C).

Answer

Use a single DynamoDB table but increase the lock timeout

Answer

Remove the backend configuration and use local state with manual locking

Answer

Disable locking to allow parallel operations

Question 8

A team is adopting Terraform to manage infrastructure. One requirement is that all configuration changes must be reviewed and approved before being applied. The team wants to ensure that the Terraform state file reflects the actual deployed infrastructure at all times. Which practice should they implement to meet these requirements?

Accepted Answer

Store state remotely and use a version control system with pull requests to review changes before applying.. Storing state remotely (e.g., in S3, Azure Storage, or Terraform Cloud) enables state locking and versioning, which is essential for team collaboration. Using a version control system with pull requests ensures that all configuration changes are reviewed and approved before being applied, meeting the requirement for change control. This combination also ensures the state file accurately reflects deployed infrastructure by preventing concurrent modifications and providing an audit trail.

Answer

Store state locally and use a manual approval process outside of Terraform.

Answer

Store state locally and use a shared network drive for team access.

Answer

Have each team member run terraform apply from their local machine after informal discussion.

Question 9

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. It leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 10

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Accepted Answer

The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. Even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.

Answer

The instance type chosen does not support public IP addresses.

Answer

The terraform init command failed and the apply did not actually create resources.

Answer

The subnet is configured as private and does not have a route to the internet.