TF-004 Understand IaC concepts Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to upgrade Terraform providers in a configuration in the correct order.

Accepted Answer

Check current provider versions, then update version constraints, then run terraform init to upgrade, then run terraform plan to validate.. The correct sequence for upgrading Terraform providers is: first check current provider versions to establish a baseline, then update version constraints in the configuration to target the desired versions, then run terraform init to download and install those versions, and finally run terraform plan to verify that the upgrade does not introduce unexpected changes. This order ensures a controlled and validated upgrade process.

Answer

Check current provider versions, then run terraform init to upgrade, then update version constraints, then run terraform plan to validate.

Answer

Update version constraints, then check current provider versions, then run terraform init to upgrade, then run terraform plan to validate.

Answer

Check current provider versions, then update version constraints, then run terraform plan to validate, then run terraform init to upgrade.

Question 2

Match each Terraform command to its primary function.

Accepted Answer

terraform init: Initializes a working directory containing Terraform configuration files. The correct matches are: init initializes the workspace, plan creates an execution plan, apply executes changes, destroy tears down resources. Common mistakes include confusing init with apply or plan with destroy.

Answer

terraform init: Applies changes to infrastructure

Answer

terraform plan: Destroys all resources

Question 3

Match each Terraform cloud/enterprise feature to its purpose.

Accepted Answer

Workspaces: Manage multiple environments with separate state and variables.. Workspaces isolate state and variables per environment, Sentinel enforces policies, and Run Tasks integrate third-party tools. Common confusions include mixing the roles of Workspaces and Remote State, or Sentinel with Workspaces.

Answer

Workspaces: Store and share remote state files for collaboration.

Answer

Sentinel: Provide collaborative infrastructure management with separate environments.

Question 4

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 5

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

Accepted Answer

Declarative vs imperative. The difference between declarative and imperative paradigms is key: Terraform is declarative (you specify the desired end state, and Terraform figures out how to achieve it), while Ansible is imperative (you specify each step to reach the state). Option B (client-server vs agentless) refers to architecture, option C (immutable vs mutable) refers to update strategies, and option D (push vs pull) refers to deployment methods. Therefore, option A is correct.

Answer

Client-server vs agentless

Answer

Immutable vs mutable

Answer

Push vs pull

Question 6

A team of five engineers uses Terraform with a remote backend in AWS S3 with DynamoDB state locking. One engineer runs 'terraform apply' but it hangs at 'Acquiring state lock'. What is the most likely cause?

Accepted Answer

Another engineer has an active lock from a previous run that was not released.. The most likely cause is that another engineer has an active lock from a previous run that was not released. Terraform uses DynamoDB state locking to prevent concurrent modifications to the state file. When `terraform apply` hangs at 'Acquiring state lock', it indicates that the lock item in the DynamoDB table is still present, meaning a prior operation either crashed, was interrupted, or the lock was not explicitly released via `force-unlock`.

Answer

The S3 bucket policy denies the request.

Answer

A recent 'terraform init' was run without the proper backend configuration.

Answer

The DynamoDB table is in a different AWS region.

Question 7

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Accepted Answer

Use a module registry and specify a version constraint.. Using a module registry with a version constraint is the best practice for reusing Terraform modules across multiple AWS accounts. It provides a centralized, version-controlled source that can be referenced by any root configuration via a simple source address (e.g., `registry.terraform.io/org/module/aws`), ensuring consistency and enabling safe upgrades through semantic versioning. This approach avoids duplicating code and leverages Terraform's built-in dependency resolution and caching mechanisms.

Answer

Store the module in a shared S3 bucket and reference it with the module source.

Answer

Use a data source to fetch the module's output from another state.

Answer

Copy the module code into each root configuration's directory.

Question 8

During development, a Terraform user wants to check that their configuration is syntactically valid and internally consistent before running 'terraform plan'. Which command should they use?

Accepted Answer

terraform validate. The `terraform validate` command checks that a Terraform configuration is syntactically valid and internally consistent, such as verifying that resource names are unique and that references to other resources or data sources are correctly formed. It runs without requiring any cloud provider credentials or state, making it ideal for early-stage validation before `terraform plan`.

Answer

terraform init

Answer

terraform refresh

Answer

terraform fmt

Question 9

A Terraform configuration includes a variable for a database password marked as sensitive. When a user runs 'terraform apply', the password appears as (sensitive) in the plan output. However, they want to pass this password to a provisioner as an environment variable. What should they do?

Accepted Answer

Use the nonsensitive() function around the variable when assigning.. The `nonsensitive()` function explicitly marks a sensitive value as safe to use in contexts where Terraform would otherwise block its usage, such as passing it to a provisioner's environment variable. Even though the variable is marked as sensitive, Terraform still prevents it from being used in certain contexts unless you explicitly override that protection with `nonsensitive()`. This ensures the password is available to the provisioner while still hiding it from CLI output.

Answer

Use the variable directly; sensitive only affects CLI output.

Answer

Store the password in a local value with sensitive = false.

Answer

Remove the sensitive flag from the variable.

Question 10

A Terraform user wants to visualize the execution order of resources before applying changes. Which command provides a dependency graph view?

Accepted Answer

terraform graph. The `terraform graph` command generates a visual representation of the dependency graph for Terraform resources, showing the execution order based on implicit and explicit dependencies. This allows users to see which resources will be created, updated, or destroyed in sequence before applying changes. It outputs DOT format, which can be rendered with tools like Graphviz.

Answer

terraform show

Answer

terraform plan

Answer

terraform output

Question 11

A team uses Terraform to manage multiple AWS EC2 instances with a 'count' meta-argument. They need to reference the ID of the third instance in another resource's configuration. Which expression should they use?

Accepted Answer

aws_instance.example[2].id. In Terraform, the 'count' meta-argument creates a list of resources indexed starting from 0. To reference the third instance, you use index 2 (0, 1, 2). Option B correctly uses `aws_instance.example[2].id` to access the ID of the third EC2 instance.

Answer

aws_instance.example[1].id

Answer

element(aws_instance.example.*.id, 3)

Answer

aws_instance.example[3].id

Question 12

An organization uses Terraform Cloud with VCS-driven runs. They have two workspaces: network and application. They want a new run in the application workspace to automatically trigger whenever the network workspace completes a successful plan. What should they configure?

Accepted Answer

Run triggers in the application workspace pointing to the network workspace.. Run triggers in Terraform Cloud allow one workspace to automatically queue a run in another workspace after a successful plan. By configuring a run trigger in the application workspace that points to the network workspace, any successful plan in the network workspace will automatically initiate a new run in the application workspace, satisfying the requirement without external tools or manual steps.

Answer

A webhook from Terraform Cloud to an external CI system.

Answer

Use 'terraform apply' with '-target' to simulate dependency.

Answer

Run triggers in the network workspace pointing to the application workspace.

Question 13

Which three characteristics are associated with immutable infrastructure as practiced by Terraform?

Accepted Answer

New versions are deployed by creating new instances. Immutable infrastructure in Terraform involves deploying new versions by creating entirely new instances rather than modifying existing ones. This aligns with Terraform's resource lifecycle, where changes to certain attributes trigger destruction and recreation, ensuring a consistent and reproducible state.

Answer

Configuration drift is accepted

Answer

In-place updates are preferred

Question 14

Which two commands are part of the standard Terraform workflow for provisioning infrastructure?

Accepted Answer

terraform init. `terraform init` is correct because it initializes a working directory containing Terraform configuration files, downloading the required providers and modules. `terraform apply` is correct because it executes the actions proposed in a Terraform plan to provision or change infrastructure resources. These two commands form the core of the standard workflow: initialize, plan, and apply.

Answer

terraform fmt

Answer

terraform import

Answer

terraform taint

Question 15

Based on the exhibit, what can be inferred about the Terraform state and configuration?

Accepted Answer

The aws_instance.db resource is in state but not in configuration, so it will be destroyed.. The `terraform plan` output shows that `aws_instance.db` exists in the state file but is absent from the current configuration. Terraform interprets this as a resource that should be removed to align the real-world infrastructure with the configuration, so it will be destroyed. This is a core behavior of Terraform's desired-state management: any resource in state but not in configuration is marked for deletion.

Answer

The configuration for aws_instance.db has been added back to the .tf files.

Answer

The aws_instance.db resource was manually deleted from the AWS console.

Answer

The aws_instance.web resource is being imported into Terraform management.