TF-003 Understand IaC concepts — 20 Questions

Question 1

A team is adopting Terraform to manage infrastructure. One requirement is that all configuration changes must be reviewed and approved before being applied. The team wants to ensure that the Terraform state file reflects the actual deployed infrastructure at all times. Which practice should they implement to meet these requirements?

Accepted Answer

Store state remotely and use a version control system with pull requests to review changes before applying.. Storing state remotely (e.g., in S3, Azure Storage, or Terraform Cloud) enables state locking and versioning, which is essential for team collaboration. Using a version control system with pull requests ensures that all configuration changes are reviewed and approved before being applied, meeting the requirement for change control. This combination also ensures the state file accurately reflects deployed infrastructure by preventing concurrent modifications and providing an audit trail.

Answer

Store state locally and use a manual approval process outside of Terraform.

Answer

Store state locally and use a shared network drive for team access.

Answer

Have each team member run terraform apply from their local machine after informal discussion.

Question 2

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. Option D is correct because it leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 3

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Accepted Answer

The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. Option D is correct because even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.

Answer

The instance type chosen does not support public IP addresses.

Answer

The terraform init command failed and the apply did not actually create resources.

Answer

The subnet is configured as private and does not have a route to the internet.

Question 4

A company uses Terraform to manage infrastructure on AWS. They have a configuration that creates an S3 bucket and a DynamoDB table for state locking. The team notices that sometimes when two members run terraform apply simultaneously, they get a state locking error. However, they want to allow concurrent operations on different workspaces. What is the best approach?

Accepted Answer

Use separate state files per workspace and ensure each workspace has its own lock entry in DynamoDB; the current setup already supports this.. Option D is correct because Terraform natively supports per-workspace state files, and when using a remote backend like S3 with DynamoDB for state locking, each workspace's state file is stored at a distinct path in S3. The DynamoDB lock entry is tied to the specific state file path via the LockID, so concurrent operations on different workspaces acquire separate locks and do not conflict. This setup allows multiple team members to run terraform apply simultaneously as long as they are working in different workspaces.

Answer

Remove the DynamoDB table and use local state files to avoid locking issues.

Answer

Configure all team members to use the same workspace so that only one person can apply at a time.

Answer

Keep the current setup because the error is harmless and users can retry.

Question 5

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Accepted Answer

Automated testing and deployment pipelines can be integrated.. Option A is correct because IaC enables infrastructure to be defined in code, which can be integrated into automated CI/CD pipelines. Tools like Terraform or AWS CloudFormation allow infrastructure validation, testing, and deployment to be automated, reducing human error and speeding up delivery.

Answer

The same code can be used for any cloud provider without modification.

Answer

No learning curve is required; existing knowledge of manual processes applies directly.

Question 6

You are a DevOps engineer at a growing startup. The infrastructure currently consists of a single AWS EC2 instance running a web application, manually configured. The company plans to scale to multiple instances and environments (development, staging, production). They want to adopt Infrastructure as Code using Terraform. The team has limited experience with Terraform and wants to start small, then gradually adopt more advanced features. The current manual infrastructure must be imported into Terraform. The team also wants to ensure that code changes are reviewed via pull requests before being applied. Which of the following is the best course of action to meet these requirements?

Accepted Answer

Create a Git repository with a main branch. Write a minimal Terraform configuration that describes the existing EC2 instance. Use terraform import to bring the instance under Terraform management. Store the state file remotely in S3 with DynamoDB locking. Set up a CI pipeline that runs terraform plan on pull requests and requires approval before merging.. Option D is correct because it follows the best practices for adopting Infrastructure as Code with Terraform in a team setting. It starts by writing a minimal configuration that matches the existing EC2 instance, uses `terraform import` to bring it under management without downtime, stores state remotely in S3 with DynamoDB locking for collaboration and consistency, and sets up a CI pipeline to run `terraform plan` on pull requests with approval gates, ensuring code review before changes are applied.

Answer

Install Terraform on the existing instance, run terraform init and apply directly to manage it, and store state locally. Have team members share the state file via a shared folder.

Answer

Write Terraform configuration from scratch to match the existing instance, but do not import; instead, destroy the old instance and recreate it with Terraform.

Answer

Create separate Git branches for each environment (dev, staging, prod) and have each team member work independently on their branch, merging occasionally.

Question 7

Which TWO statements about Infrastructure as Code (IaC) are correct?

Accepted Answer

IaC enables automated provisioning and management of infrastructure.. Option C is correct because IaC is fundamentally about automating the provisioning and management of infrastructure through machine-readable definition files, enabling consistent, repeatable deployments without manual intervention. Tools like Terraform use a declarative language (HCL) to define resources, and the IaC engine handles the creation, modification, and deletion of those resources based on the desired state defined in the configuration.

Answer

IaC is only applicable to cloud-based infrastructure.

Answer

IaC eliminates configuration drift entirely.

Answer

IaC tools require manual execution of scripts.

Question 8

A developer runs terraform apply with the configuration above. The resource is created successfully, but the provisioner fails because the public_ip attribute is not yet known at plan time. What is the most likely cause?

Accepted Answer

The provisioner references a computed attribute that is not known until after resource creation.. Option C is correct because the `public_ip` attribute of an AWS instance is a computed attribute that is not known until the resource is created and the cloud provider assigns an IP address. In Terraform, provisioners run during resource creation, but if they reference attributes that are only available after the resource is fully created (i.e., after the apply completes), the plan will fail with an error indicating the value is unknown. This is a fundamental behavior of Terraform's execution model: provisioners execute in the same context as the resource creation, and any attribute that is not known at plan time cannot be used in a provisioner unless it is explicitly deferred using `on_failure = continue` or similar workarounds.

Answer

The AMI ID is incorrect.

Answer

The local-exec provisioner requires network access to the instance.

Answer

The provisioner runs before the state file is written.

Question 9

You are a platform engineer at a growing startup. The company currently manages infrastructure manually by SSH-ing into servers to install packages and update configurations. As the team grows, this approach has led to frequent configuration drift, inconsistent environments, and manual errors. Deploying a new environment takes several days and requires detailed runbooks. The CTO has asked you to propose a solution that improves consistency, reduces deployment time, and enables version control of infrastructure. You are evaluating Infrastructure as Code (IaC) tools like Terraform. Which course of action best addresses the CTO's requirements?

Accepted Answer

Adopt Terraform to define all infrastructure as code, store configurations in a Git repository, and use a CI/CD pipeline to apply changes automatically.. Option C is correct because Terraform directly addresses the CTO's requirements by enabling infrastructure as code (IaC), which ensures consistent, repeatable deployments through declarative configuration files stored in Git for version control. Using a CI/CD pipeline to automatically apply changes eliminates manual SSH errors, reduces deployment time from days to minutes, and prevents configuration drift by enforcing a single source of truth for infrastructure state.

Answer

Improve SSH key management and use configuration management tools like Ansible to apply changes.

Answer

Migrate all applications to containers and use Kubernetes for orchestration.

Answer

Create more detailed runbooks and require peer review for all manual changes.

Question 10

Which three statements correctly describe concepts of Infrastructure as Code (IaC) as implemented by Terraform? (Choose three.)

Accepted Answer

IaC enables consistent and repeatable provisioning of infrastructure by defining resources in declarative configuration files.. The first three options are correct because they accurately describe core IaC principles as implemented by Terraform. IaC uses declarative configuration files to define infrastructure, enabling consistent and repeatable provisioning. Version control of these files allows changes to be reviewed and rolled back like application code. Terraform's execution plan is a critical feature that previews changes before applying them, reducing risk of unintended modifications.

Answer

In Terraform, the desired state is described imperatively, meaning you specify the exact commands to create, modify, or delete resources in order.

Answer

IaC eliminates the need for manual configuration entirely by automatically detecting and fixing all configuration drift without human intervention.

Answer

Terraform relies on a mutable infrastructure model, where changes are applied directly to existing resources without destroying and recreating them.

Question 11

Which of the following are key benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management? (Choose four.)

Accepted Answer

Enables repeatable and consistent infrastructure deployments. Infrastructure as Code (IaC) enables repeatable and consistent deployments by defining infrastructure in declarative or procedural configuration files, eliminating the variability of manual steps. It reduces human error by automating provisioning tasks that are prone to typos or omissions when performed manually. Version control systems like Git allow infrastructure configurations to be tracked, audited, and rolled back, while code reviews and shared modules promote team collaboration and standardization.

Answer

Automatically fixes all security vulnerabilities in the infrastructure

Answer

Provides self-healing infrastructure without any additional tooling

Question 12

Drag and drop the steps to initialize a Terraform working directory in the correct order.

Question 13

Drag and drop the steps to upgrade Terraform providers in a configuration in the correct order.

Question 14

Match each Terraform command to its primary function.

Question 15

Match each Terraform cloud/enterprise feature to its purpose.

Question 16

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 17

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

Accepted Answer

Declarative vs imperative. Option C correctly identifies the declarative vs imperative paradigm. Option A (immutable vs mutable) describes update strategies. Options B and D are architectural patterns.

Answer

Client-server vs agentless

Answer

Immutable vs mutable

Answer

Push vs pull

Question 18

A team of five engineers uses Terraform with a remote backend in AWS S3 with DynamoDB state locking. One engineer runs 'terraform apply' but it hangs at 'Acquiring state lock'. What is the most likely cause?

Accepted Answer

Another engineer has an active lock from a previous run that was not released.. The most likely cause is that another engineer has an active lock from a previous run that was not released. Terraform uses DynamoDB state locking to prevent concurrent modifications to the state file. When `terraform apply` hangs at 'Acquiring state lock', it indicates that the lock item in the DynamoDB table is still present, meaning a prior operation either crashed, was interrupted, or the lock was not explicitly released via `force-unlock`.

Answer

The S3 bucket policy denies the request.

Answer

A recent 'terraform init' was run without the proper backend configuration.

Answer

The DynamoDB table is in a different AWS region.

Question 19

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Accepted Answer

The workspace does not exist.. Option C is correct because the absence of a state file indicates the workspace does not exist or is empty. Option A would cause corruption, not absence. Option B would cause a backend mismatch. Option D would cause a lock conflict.

Answer

The backend configuration changed after the last apply.

Answer

The state file was manually edited in S3.

Answer

Another user ran 'terraform apply' concurrently.

Question 20

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Accepted Answer

Use a module registry and specify a version constraint.. Option B is correct because using a module registry with version constraints ensures consistency and easy updates. Option A leads to duplication and drift. Option C is for sharing data, not modules. Option D is possible but lacks native versioning and registry features.

Answer

Store the module in a shared S3 bucket and reference it with the module source.

Answer

Use a data source to fetch the module's output from another state.

Answer

Copy the module code into each root configuration's directory.