TF-003 Understand IaC concepts Practice Test 3 — 15 Questions

Question 1

A team uses the backend configuration above. What is the primary benefit of storing state remotely in S3?

Accepted Answer

Enabling state sharing and locking across the team. Storing Terraform state remotely in S3 is the standard practice for team collaboration because it allows multiple team members to access and modify the same state file, preventing conflicts. Combined with DynamoDB for state locking, it ensures that only one person runs `terraform apply` at a time, avoiding race conditions and state corruption. This is the primary benefit over local state storage, which is single-user by design.

Answer

Automatic encryption of state files

Answer

Reducing the number of API calls to AWS

Answer

Faster Terraform execution times

Question 2

A team wants to ensure that their infrastructure configuration repeatedly results in the same environment regardless of the initial state. Which IaC concept is most directly associated with this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the starting state. In Terraform, this is achieved by the provider's ability to detect drift and reconcile the real-world infrastructure with the declared configuration in the .tf files. Without idempotency, repeated runs could create duplicate resources or fail to correct unintended changes.

Answer

Version control

Answer

Orchestration

Answer

Provisioning

Question 3

A development team is using a declarative IaC tool. They make a change to the configuration file to add a new security group rule. When they apply the configuration, the tool automatically modifies the existing security group to add the rule. What is this behavior called?

Accepted Answer

Desired state reconciliation. This behavior is called desired state reconciliation because declarative IaC tools like Terraform or AWS CloudFormation compare the current state of infrastructure against the desired state defined in the configuration file. When a new security group rule is added to the configuration, the tool automatically computes the necessary changes to reconcile the actual state with the desired state, creating, updating, or deleting resources as needed. This is a core principle of declarative IaC, where the user specifies the 'what' and the tool handles the 'how'.

Answer

Provisioning

Answer

Imperative execution

Answer

Resource drift

Question 4

An organization is evaluating IaC tools and wants to minimize configuration drift. Which characteristic of a declarative IaC approach is most effective in preventing drift?

Accepted Answer

Periodic state comparison and correction. A declarative IaC approach defines the desired end state of infrastructure, and tools like Terraform use periodic state comparison (e.g., `terraform plan` and `terraform apply`) to detect and correct any configuration drift. This automated reconciliation ensures the actual infrastructure matches the declared configuration, directly preventing drift without manual intervention.

Answer

Manual approval gates

Answer

Tagging resources

Answer

Using modules

Question 5

Which of the following is a primary benefit of using Infrastructure as Code?

Accepted Answer

Faster provisioning through automation. Faster provisioning through automation (B) is a core benefit because IaC allows quick and repeatable deployments. A is false because credentials are still needed. C is false because IaC does not guarantee zero downtime. D is false because you still depend on cloud providers.

Answer

Removes dependency on cloud providers

Answer

Guarantees zero downtime during updates

Answer

Eliminates the need for cloud credentials

Question 6

A company is managing multiple cloud environments (dev, test, prod) using Terraform. They want to ensure consistent configurations across environments while allowing environment-specific values. Which IaC practice best supports this?

Accepted Answer

Using variables and workspaces. Using variables and workspaces (C) allows parameterization and separation of environments without duplicating code. Duplicating configuration (A) leads to drift. Data sources (B) fetch data but don't manage environments. Hardcoding (D) is inflexible.

Answer

Using data sources only

Answer

Hardcoding values

Answer

Duplicating configuration files

Question 7

A team uses Terraform to manage AWS resources. After a manual change to an S3 bucket policy through the AWS console, Terraform's next plan shows that it will revert the policy to the configuration. This is an example of which concept?

Accepted Answer

Configuration drift and correction. Configuration drift and correction (B) - the manual change caused drift, and Terraform plans to correct it. Immutable infrastructure (A) would involve replacing the resource, not modifying it. Imperative provisioning (C) is not relevant. Resource tagging (D) is unrelated.

Answer

Immutable infrastructure

Answer

Resource tagging

Answer

Imperative provisioning

Question 8

Which statement best describes 'immutable infrastructure' in the context of IaC?

Accepted Answer

Servers are never modified after deployment; new ones are created for updates. Immutable infrastructure means never modifying servers after deployment; instead, new servers are created for any changes (D). A describes mutable. B is generally true but not specific to immutable. C is not related.

Answer

Configuration is changed via patches and updates

Answer

Resources are shared across environments

Answer

Infrastructure is version-controlled

Question 9

A company uses Terraform to deploy virtual machines. They want to ensure that the same exact operating system and software versions are used every time. Which practice supports this?

Accepted Answer

Using a golden image and referencing it in the configuration. Option B is correct because using a golden image—a pre-configured virtual machine template containing the exact operating system and software versions—ensures consistency across deployments. Terraform can reference this image via the `source_image` or `image_id` argument in a resource like `azurerm_virtual_machine` or `aws_instance`, guaranteeing that every provisioned VM starts from the same immutable baseline.

Answer

Manually installing software

Answer

Using inline userdata scripts

Answer

Running configuration management after provisioning

Question 10

In Terraform, the `terraform plan` command compares the current state with the configuration. This is an example of which IaC principle?

Accepted Answer

Desired state enforcement. The `terraform plan` command compares the current state (what is deployed) with the configuration (what is declared) and computes the changes needed to align the real-world infrastructure with the declared configuration. This is the essence of desired state enforcement: the tool continuously reconciles the actual state toward the user-defined desired state, rather than executing imperative steps. Option D is correct because Terraform's core loop—plan, apply, refresh—is built around this declarative, state-driven model.

Answer

Version control integration

Answer

Continuous delivery

Answer

Modular architecture

Question 11

Which two are benefits of using Infrastructure as Code? (Choose two.)

Accepted Answer

Reproducible environments. A (Reproducible environments) and C (Automated documentation) are key benefits. B is false because manual errors are reduced but not eliminated. D is false because cost optimization is not a direct benefit of IaC. E is false because IaC still requires cloud providers.

Answer

Guaranteed cost optimization

Answer

Removes need for cloud providers

Answer

Elimination of all manual errors

Question 12

Which three practices help maintain consistency and reduce configuration drift in IaC? (Choose three.)

Accepted Answer

Storing state files remotely and locking them. Regularly running terraform plan/apply (B) enforces desired state. Storing state remotely with locking (D) prevents concurrent modifications. CI/CD pipelines with automated testing (E) validate changes. A is wrong because manual changes cause drift. C is wrong because simultaneous applies cause conflicts.

Answer

Using manual changes to fix minor issues

Answer

Allowing multiple team members to run apply simultaneously

Question 13

Which two statements accurately describe the difference between declarative and imperative IaC approaches? (Choose two.)

Accepted Answer

Declarative focuses on the desired outcome, while imperative specifies step-by-step commands. Option C is correct because declarative IaC, as used in Terraform with HCL, allows you to define the desired end state of infrastructure (e.g., 'I want an AWS EC2 instance with AMI ami-0c55b159cbfafe1f0 and instance type t2.micro'), and the tool automatically determines the necessary steps to achieve that state. In contrast, imperative IaC, such as using AWS CLI commands or Ansible playbooks with explicit 'command' modules, requires you to specify each step (e.g., 'run aws ec2 run-instances, then wait, then tag'). This fundamental difference in approach is a core concept in the TF-003 exam.

Answer

Imperative is only used for scripting, not IaC

Answer

Declarative tools are always faster than imperative tools

Answer

Declarative eliminates the need for idempotency

Question 14

Refer to the exhibit. A team is using this S3 backend configuration. During a deployment, they receive an error that the state file is locked. What is the most likely cause?

Accepted Answer

The DynamoDB table is not provisioned or the IAM role lacks permissions. Option C is correct because the error message 'state file is locked' directly indicates that Terraform is attempting to acquire a lock on the state using DynamoDB, but the lock table either does not exist or the IAM role used by Terraform lacks the required permissions (dynamodb:PutItem, dynamodb:GetItem, dynamodb:DeleteItem, dynamodb:DescribeTable). Without a properly provisioned DynamoDB table or sufficient IAM permissions, the locking mechanism fails, producing this specific error.

Answer

The S3 bucket does not exist

Answer

The region is incorrect

Answer

The key path is incorrect

Question 15

Refer to the exhibit. After applying this configuration, a team member manually changes the instance type to 't2.small' via the AWS console. The next `terraform plan` shows a change to revert to 't2.micro'. What does this demonstrate?

Accepted Answer

Terraform's desired state reconciliation. Terraform has detected configuration drift (the manual change) and plans to reconcile back to the desired state defined in configuration (C). A is incorrect because immutable infrastructure would replace the instance entirely. B is partially true but the key point is reconciliation, not just detection. D is false.

Answer

Terraform's drift detection only

Answer

Immutable infrastructure pattern

Answer

A misconfiguration in the Terraform code

TF-003 Understand IaC concepts Practice Test 3 — 15 Questions

Exhibit

TF-003 Understand IaC concepts Practice Test 3 — 15 Questions

Exhibit