TF-004 Understand IaC concepts Practice Test 3 — 15 Questions

Question 1

Based on the exhibit, what can be inferred about the Terraform state and configuration?

Accepted Answer

The aws_instance.db resource is in state but not in configuration, so it will be destroyed.. The `terraform plan` output shows that `aws_instance.db` exists in the state file but is absent from the current configuration. Terraform interprets this as a resource that should be removed to align the real-world infrastructure with the configuration, so it will be destroyed. This is a core behavior of Terraform's desired-state management: any resource in state but not in configuration is marked for deletion.

Answer

The configuration for aws_instance.db has been added back to the .tf files.

Answer

The aws_instance.db resource was manually deleted from the AWS console.

Answer

The aws_instance.web resource is being imported into Terraform management.

Question 2

After applying the configuration above, the user changes the AMI to a new value and runs 'terraform apply'. Assuming the new AMI triggers a recreate, what happens during the apply?

Accepted Answer

The existing instance is deleted before the new one is created.. Terraform's default lifecycle for resource replacement is to destroy the existing resource first, then create the new one. This is the standard behavior unless `create_before_destroy` is explicitly set to `true`. The AMI change triggers a recreate, and by default, the old instance is deleted before the new one is provisioned.

Answer

Both instances run simultaneously only if the instance type allows it.

Answer

The new instance is created first, then the old one is deleted.

Answer

The plan fails because AMI change with create_before_destroy is not allowed.

Question 3

A team uses the backend configuration above. What is the primary benefit of storing state remotely in S3?

Accepted Answer

Enabling state sharing and locking across the team. Storing Terraform state remotely in S3 is the standard practice for team collaboration because it allows multiple team members to access and modify the same state file, preventing conflicts. Combined with DynamoDB for state locking, it ensures that only one person runs `terraform apply` at a time, avoiding race conditions and state corruption. This is the primary benefit over local state storage, which is single-user by design.

Answer

Automatic encryption of state files

Answer

Reducing the number of API calls to AWS

Answer

Faster Terraform execution times

Question 4

A team wants to ensure that their infrastructure configuration repeatedly results in the same environment regardless of the initial state. Which IaC concept is most directly associated with this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the starting state. In Terraform, this is achieved by the provider's ability to detect drift and reconcile the real-world infrastructure with the declared configuration in the .tf files. Without idempotency, repeated runs could create duplicate resources or fail to correct unintended changes.

Answer

Version control

Answer

Orchestration

Answer

Provisioning

Question 5

A development team is using a declarative IaC tool. They make a change to the configuration file to add a new security group rule. When they apply the configuration, the tool automatically modifies the existing security group to add the rule. What is this behavior called?

Accepted Answer

Desired state reconciliation. This behavior is called desired state reconciliation because declarative IaC tools like Terraform or AWS CloudFormation compare the current state of infrastructure against the desired state defined in the configuration file. When a new security group rule is added to the configuration, the tool automatically computes the necessary changes to reconcile the actual state with the desired state, creating, updating, or deleting resources as needed. This is a core principle of declarative IaC, where the user specifies the 'what' and the tool handles the 'how'.

Answer

Provisioning

Answer

Imperative execution

Answer

Resource drift

Question 6

An organization is evaluating IaC tools and wants to minimize configuration drift. Which characteristic of a declarative IaC approach is most effective in preventing drift?

Accepted Answer

Periodic state comparison and correction. A declarative IaC approach defines the desired end state of infrastructure, and tools like Terraform use periodic state comparison (e.g., `terraform plan` and `terraform apply`) to detect and correct any configuration drift. This automated reconciliation ensures the actual infrastructure matches the declared configuration, directly preventing drift without manual intervention.

Answer

Manual approval gates

Answer

Tagging resources

Answer

Using modules

Question 7

Which of the following is a primary benefit of using Infrastructure as Code?

Accepted Answer

Faster provisioning through automation. Infrastructure as Code (IaC) defines infrastructure in declarative templates or scripts that can be version-controlled and applied automatically, which dramatically speeds up provisioning compared to manual portal or CLI setup. Tools like Terraform, Bicep, and CloudFormation can deploy entire environments in minutes and reproduce them consistently. Faster provisioning through automation is the primary, universally cited benefit of IaC.

Answer

Removes dependency on cloud providers

Answer

Guarantees zero downtime during updates

Answer

Eliminates the need for cloud credentials

Question 8

A company is managing multiple cloud environments (dev, test, prod) using Terraform. They want to ensure consistent configurations across environments while allowing environment-specific values. Which IaC practice best supports this?

Accepted Answer

Using variables and workspaces. Using variables and workspaces allows you to define a single set of Terraform configurations while dynamically injecting environment-specific values via variable definitions (e.g., terraform.tfvars or -var-file) and isolating state per environment using workspaces (terraform workspace). This avoids duplication and ensures consistent resource definitions across dev, test, and prod, with only the variable values differing.

Answer

Using data sources only

Answer

Hardcoding values

Answer

Duplicating configuration files

Question 9

A team uses Terraform to manage AWS resources. After a manual change to an S3 bucket policy through the AWS console, Terraform's next plan shows that it will revert the policy to the configuration. This is an example of which concept?

Accepted Answer

Configuration drift and correction. This scenario describes configuration drift, where a manual change to an S3 bucket policy via the AWS console creates a difference between the actual state of the resource and the desired state defined in Terraform code. Terraform's next plan detects this drift and will revert the policy to match the configuration, demonstrating its correction mechanism. This is a core principle of declarative IaC tools like Terraform, which enforce the desired state and automatically remediate any out-of-band changes.

Answer

Immutable infrastructure

Answer

Resource tagging

Answer

Imperative provisioning

Question 10

Which statement best describes 'immutable infrastructure' in the context of IaC?

Accepted Answer

Servers are never modified after deployment; new ones are created for updates. Immutable infrastructure means servers, once deployed, are never modified in place; any change (patch, config update, new version) results in building a new image and replacing the old instance. This eliminates configuration drift and makes deployments reproducible and rollback-friendly. It is a core IaC pattern where infrastructure is treated like disposable, versioned artifacts.

Answer

Configuration is changed via patches and updates

Answer

Resources are shared across environments

Answer

Infrastructure is version-controlled

Question 11

A company uses Terraform to deploy virtual machines. They want to ensure that the same exact operating system and software versions are used every time. Which practice supports this?

Accepted Answer

Using a golden image and referencing it in the configuration. Using a golden image—a pre-configured virtual machine template containing the exact operating system and software versions—ensures consistency across deployments. Terraform can reference this image via the `source_image` or `image_id` argument in a resource like `azurerm_virtual_machine` or `aws_instance`, guaranteeing that every provisioned VM starts from the same immutable baseline.

Answer

Manually installing software

Answer

Using inline userdata scripts

Answer

Running configuration management after provisioning

Question 12

In Terraform, the `terraform plan` command compares the current state with the configuration. This is an example of which IaC principle?

Accepted Answer

Desired state enforcement. The `terraform plan` command compares the current state (what is deployed) with the configuration (what is declared) and computes the changes needed to align the real-world infrastructure with the declared configuration. This is the essence of desired state enforcement: the tool continuously reconciles the actual state toward the user-defined desired state, rather than executing imperative steps. Option D is correct because Terraform's core loop—plan, apply, refresh—is built around this declarative, state-driven model.

Answer

Version control integration

Answer

Continuous delivery

Answer

Modular architecture

Question 13

Which two are benefits of using Infrastructure as Code? (Choose two.)

Accepted Answer

Reproducible environments. Option C (Reproducible environments) is correct because IaC defines infrastructure in versioned template/code files (e.g., Terraform HCL, CloudFormation YAML), so the same configuration can be applied repeatedly to produce identical, consistent environments across dev, test, and prod. Option D (Automated documentation) is correct because the declarative code itself serves as living documentation of the infrastructure's desired state, and tools can generate diagrams or docs directly from those definitions, keeping documentation in sync with reality. Option A is wrong because IaC does not guarantee cost optimization—it enables consistent, auditable provisioning, but cost savings depend on design choices and rightsizing. Option B is wrong because IaC still relies on cloud providers (or other target platforms) to actually host the resources; it automates how they are provisioned, not whether a provider is needed. Option E is wrong because IaC reduces configuration drift and many manual errors, but it cannot eliminate all errors—mistakes in the code, parameters, or logic can still be deployed.

Answer

Guaranteed cost optimization

Answer

Removes need for cloud providers

Answer

Elimination of all manual errors

Question 14

Which three practices help maintain consistency and reduce configuration drift in IaC? (Choose three.)

Accepted Answer

Storing state files remotely and locking them. Storing state files remotely (e.g., in an S3 bucket with DynamoDB locking) prevents concurrent modifications and ensures that the state file reflects the true infrastructure state. This practice eliminates the risk of conflicting changes and configuration drift caused by local or stale state files.

Answer

Using manual changes to fix minor issues

Answer

Allowing multiple team members to run apply simultaneously

Question 15

Which two statements accurately describe the difference between declarative and imperative IaC approaches? (Choose two.)

Accepted Answer

Declarative focuses on the desired outcome, while imperative specifies step-by-step commands. Option C is correct because declarative IaC (e.g., Terraform HCL, CloudFormation templates) defines the desired end state of the infrastructure and lets the tool determine the execution path, whereas imperative IaC (e.g., shell scripts, AWS CLI command sequences) explicitly lists the ordered commands needed to reach that state. Option D is correct because imperative approaches execute fixed steps without inherently reconciling actual versus desired state, so re-running or partially failing scripts can leave resources in unintended configurations, producing configuration drift. Option A is wrong because imperative techniques are widely used in IaC, such as provisioning with AWS CLI or Ansible ad-hoc commands. Option B is wrong because speed depends on implementation, provider APIs, and parallelism, not on whether the approach is declarative or imperative. Option E is wrong because declarative tools still rely on idempotency mechanisms (state files, resource providers, or reconciliation loops) to avoid duplicate changes; declarative syntax alone does not eliminate the need for idempotent behavior.

Answer

Imperative is only used for scripting, not IaC

Answer

Declarative tools are always faster than imperative tools

Answer

Declarative eliminates the need for idempotency