TF-003 Understand IaC concepts Practice Test 2 — 15 Questions

Question 1

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 2

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

Accepted Answer

Declarative vs imperative. Option C correctly identifies the declarative vs imperative paradigm. Option A (immutable vs mutable) describes update strategies. Options B and D are architectural patterns.

Answer

Client-server vs agentless

Answer

Immutable vs mutable

Answer

Push vs pull

Question 3

A team of five engineers uses Terraform with a remote backend in AWS S3 with DynamoDB state locking. One engineer runs 'terraform apply' but it hangs at 'Acquiring state lock'. What is the most likely cause?

Accepted Answer

Another engineer has an active lock from a previous run that was not released.. The most likely cause is that another engineer has an active lock from a previous run that was not released. Terraform uses DynamoDB state locking to prevent concurrent modifications to the state file. When `terraform apply` hangs at 'Acquiring state lock', it indicates that the lock item in the DynamoDB table is still present, meaning a prior operation either crashed, was interrupted, or the lock was not explicitly released via `force-unlock`.

Answer

The S3 bucket policy denies the request.

Answer

A recent 'terraform init' was run without the proper backend configuration.

Answer

The DynamoDB table is in a different AWS region.

Question 4

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Accepted Answer

The workspace does not exist.. Option C is correct because the absence of a state file indicates the workspace does not exist or is empty. Option A would cause corruption, not absence. Option B would cause a backend mismatch. Option D would cause a lock conflict.

Answer

The backend configuration changed after the last apply.

Answer

The state file was manually edited in S3.

Answer

Another user ran 'terraform apply' concurrently.

Question 5

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Accepted Answer

Use a module registry and specify a version constraint.. Option B is correct because using a module registry with version constraints ensures consistency and easy updates. Option A leads to duplication and drift. Option C is for sharing data, not modules. Option D is possible but lacks native versioning and registry features.

Answer

Store the module in a shared S3 bucket and reference it with the module source.

Answer

Use a data source to fetch the module's output from another state.

Answer

Copy the module code into each root configuration's directory.

Question 6

During development, a Terraform user wants to check that their configuration is syntactically valid and internally consistent before running 'terraform plan'. Which command should they use?

Accepted Answer

terraform validate. The `terraform validate` command checks that a Terraform configuration is syntactically valid and internally consistent, such as verifying that resource names are unique and that references to other resources or data sources are correctly formed. It runs without requiring any cloud provider credentials or state, making it ideal for early-stage validation before `terraform plan`.

Answer

terraform init

Answer

terraform refresh

Answer

terraform fmt

Question 7

A Terraform configuration includes a variable for a database password marked as sensitive. When a user runs 'terraform apply', the password appears as (sensitive) in the plan output. However, they want to pass this password to a provisioner as an environment variable. What should they do?

Accepted Answer

Use the nonsensitive() function around the variable when assigning.. Option A is correct because 'nonsensitive()' allows using the value while preserving the sensitive flag in state. Option B would expose the password in logs. Option C is false; sensitive affects output. Option D does not help.

Answer

Use the variable directly; sensitive only affects CLI output.

Answer

Store the password in a local value with sensitive = false.

Answer

Remove the sensitive flag from the variable.

Question 8

A Terraform user wants to visualize the execution order of resources before applying changes. Which command provides a dependency graph view?

Accepted Answer

terraform graph. The `terraform graph` command generates a visual representation of the dependency graph for Terraform resources, showing the execution order based on implicit and explicit dependencies. This allows users to see which resources will be created, updated, or destroyed in sequence before applying changes. It outputs DOT format, which can be rendered with tools like Graphviz.

Answer

terraform show

Answer

terraform plan

Answer

terraform output

Question 9

A team uses Terraform to manage multiple AWS EC2 instances with a 'count' meta-argument. They need to reference the ID of the third instance in another resource's configuration. Which expression should they use?

Accepted Answer

aws_instance.example[2].id. Option D is correct because indices are zero-based, so 'aws_instance.example[2]' refers to the third instance. Option A (index 3) is the fourth. Option B (index 1) is the second. Option C uses 'element' with index 3, also the fourth.

Answer

aws_instance.example[1].id

Answer

element(aws_instance.example.*.id, 3)

Answer

aws_instance.example[3].id

Question 10

An organization uses Terraform Cloud with VCS-driven runs. They have two workspaces: network and application. They want a new run in the application workspace to automatically trigger whenever the network workspace completes a successful plan. What should they configure?

Accepted Answer

Run triggers in the application workspace pointing to the network workspace.. Run triggers in Terraform Cloud allow one workspace to automatically queue a run in another workspace after a successful plan. By configuring a run trigger in the application workspace that points to the network workspace, any successful plan in the network workspace will automatically initiate a new run in the application workspace, satisfying the requirement without external tools or manual steps.

Answer

A webhook from Terraform Cloud to an external CI system.

Answer

Use 'terraform apply' with '-target' to simulate dependency.

Answer

Run triggers in the network workspace pointing to the application workspace.

Question 11

Which two are primary benefits of using Infrastructure as Code (IaC) with Terraform?

Accepted Answer

Consistent and repeatable deployments. Option A is correct because Terraform's declarative configuration files define the desired state of infrastructure, enabling consistent and repeatable deployments across environments. By applying the same configuration, Terraform ensures that the infrastructure is provisioned identically every time, eliminating configuration drift and manual errors.

Answer

Real-time monitoring of infrastructure

Answer

Manual configuration of each resource

Answer

Automatic scaling based on CPU usage

Question 12

Which three characteristics are associated with immutable infrastructure as practiced by Terraform?

Accepted Answer

New versions are deployed by creating new instances. Option A is correct because immutable infrastructure in Terraform involves deploying new versions by creating entirely new instances rather than modifying existing ones. This aligns with Terraform's resource lifecycle, where changes to certain attributes trigger destruction and recreation, ensuring a consistent and reproducible state.

Answer

Configuration drift is accepted

Answer

In-place updates are preferred

Question 13

Which two commands are part of the standard Terraform workflow for provisioning infrastructure?

Accepted Answer

terraform init. `terraform init` is correct because it initializes a working directory containing Terraform configuration files, downloading the required providers and modules. `terraform apply` is correct because it executes the actions proposed in a Terraform plan to provision or change infrastructure resources. These two commands form the core of the standard workflow: initialize, plan, and apply.

Answer

terraform fmt

Answer

terraform import

Answer

terraform taint

Question 14

Based on the exhibit, what can be inferred about the Terraform state and configuration?

Accepted Answer

The aws_instance.db resource is in state but not in configuration, so it will be destroyed.. The `terraform plan` output shows that `aws_instance.db` exists in the state file but is absent from the current configuration. Terraform interprets this as a resource that should be removed to align the real-world infrastructure with the configuration, so it will be destroyed. This is a core behavior of Terraform's desired-state management: any resource in state but not in configuration is marked for deletion.

Answer

The configuration for aws_instance.db has been added back to the .tf files.

Answer

The aws_instance.db resource was manually deleted from the AWS console.

Answer

The aws_instance.web resource is being imported into Terraform management.

Question 15

After applying the configuration above, the user changes the AMI to a new value and runs 'terraform apply'. Assuming the new AMI triggers a recreate, what happens during the apply?

Accepted Answer

The new instance is created first, then the old one is deleted.. Option C is correct because Terraform's default lifecycle behavior for most resources is 'create_before_destroy = false', meaning the old resource is destroyed before the new one is created. However, when a resource's configuration change triggers a recreate (like an AMI change for an AWS instance), Terraform first creates the new instance, then destroys the old one, ensuring minimal downtime. This is the standard behavior for resources that support replacement, as Terraform plans the creation of the new resource before destroying the old one to maintain availability.

Answer

The existing instance is deleted before the new one is created.

Answer

Both instances run simultaneously only if the instance type allows it.

Answer

The plan fails because AMI change with create_before_destroy is not allowed.