TF-004 Understand IaC concepts Practice Test 3 — 15 Questions

Question 1

After applying the configuration above, the user changes the AMI to a new value and runs 'terraform apply'. Assuming the new AMI triggers a recreate, what happens during the apply?

Accepted Answer

The existing instance is deleted before the new one is created.. Terraform's default lifecycle for resource replacement is to destroy the existing resource first, then create the new one. This is the standard behavior unless `create_before_destroy` is explicitly set to `true`. The AMI change triggers a recreate, and by default, the old instance is deleted before the new one is provisioned.

Answer

Both instances run simultaneously only if the instance type allows it.

Answer

The new instance is created first, then the old one is deleted.

Answer

The plan fails because AMI change with create_before_destroy is not allowed.

Question 2

A team uses the backend configuration above. What is the primary benefit of storing state remotely in S3?

Accepted Answer

Enabling state sharing and locking across the team. Storing Terraform state remotely in S3 is the standard practice for team collaboration because it allows multiple team members to access and modify the same state file, preventing conflicts. Combined with DynamoDB for state locking, it ensures that only one person runs `terraform apply` at a time, avoiding race conditions and state corruption. This is the primary benefit over local state storage, which is single-user by design.

Answer

Automatic encryption of state files

Answer

Reducing the number of API calls to AWS

Answer

Faster Terraform execution times

Question 3

A team wants to ensure that their infrastructure configuration repeatedly results in the same environment regardless of the initial state. Which IaC concept is most directly associated with this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same configuration multiple times always results in the same desired state, regardless of the starting state. In Terraform, this is achieved by the provider's ability to detect drift and reconcile the real-world infrastructure with the declared configuration in the .tf files. Without idempotency, repeated runs could create duplicate resources or fail to correct unintended changes.

Answer

Version control

Answer

Orchestration

Answer

Provisioning

Question 4

A development team is using a declarative IaC tool. They make a change to the configuration file to add a new security group rule. When they apply the configuration, the tool automatically modifies the existing security group to add the rule. What is this behavior called?

Accepted Answer

Desired state reconciliation. This behavior is called desired state reconciliation because declarative IaC tools like Terraform or AWS CloudFormation compare the current state of infrastructure against the desired state defined in the configuration file. When a new security group rule is added to the configuration, the tool automatically computes the necessary changes to reconcile the actual state with the desired state, creating, updating, or deleting resources as needed. This is a core principle of declarative IaC, where the user specifies the 'what' and the tool handles the 'how'.

Answer

Provisioning

Answer

Imperative execution

Answer

Resource drift

Question 5

An organization is evaluating IaC tools and wants to minimize configuration drift. Which characteristic of a declarative IaC approach is most effective in preventing drift?

Accepted Answer

Periodic state comparison and correction. A declarative IaC approach defines the desired end state of infrastructure, and tools like Terraform use periodic state comparison (e.g., `terraform plan` and `terraform apply`) to detect and correct any configuration drift. This automated reconciliation ensures the actual infrastructure matches the declared configuration, directly preventing drift without manual intervention.

Answer

Manual approval gates

Answer

Tagging resources

Answer

Using modules

Question 6

Which of the following is a primary benefit of using Infrastructure as Code?

Accepted Answer

Faster provisioning through automation. Faster provisioning through automation (A) is a core benefit because IaC enables quick and repeatable deployments via code, reducing manual effort and time. Option B is false: IaC does not remove dependency on cloud providers; you still rely on them for infrastructure services. Option C is false: IaC helps manage updates but does not guarantee zero downtime. Option D is false: credentials are still required to authenticate with cloud providers.

Answer

Removes dependency on cloud providers

Answer

Guarantees zero downtime during updates

Answer

Eliminates the need for cloud credentials

Question 7

A company is managing multiple cloud environments (dev, test, prod) using Terraform. They want to ensure consistent configurations across environments while allowing environment-specific values. Which IaC practice best supports this?

Accepted Answer

Using variables and workspaces. Using variables and workspaces allows you to define a single set of Terraform configurations while dynamically injecting environment-specific values via variable definitions (e.g., terraform.tfvars or -var-file) and isolating state per environment using workspaces (terraform workspace). This avoids duplication and ensures consistent resource definitions across dev, test, and prod, with only the variable values differing.

Answer

Using data sources only

Answer

Hardcoding values

Answer

Duplicating configuration files

Question 8

A team uses Terraform to manage AWS resources. After a manual change to an S3 bucket policy through the AWS console, Terraform's next plan shows that it will revert the policy to the configuration. This is an example of which concept?

Accepted Answer

Configuration drift and correction. This scenario describes configuration drift, where a manual change to an S3 bucket policy via the AWS console creates a difference between the actual state of the resource and the desired state defined in Terraform code. Terraform's next plan detects this drift and will revert the policy to match the configuration, demonstrating its correction mechanism. This is a core principle of declarative IaC tools like Terraform, which enforce the desired state and automatically remediate any out-of-band changes.

Answer

Immutable infrastructure

Answer

Resource tagging

Answer

Imperative provisioning

Question 9

Which statement best describes 'immutable infrastructure' in the context of IaC?

Accepted Answer

Servers are never modified after deployment; new ones are created for updates. Immutable infrastructure means that servers are never modified after deployment; instead, new servers are created for any updates or changes. Option B correctly states this. Option A describes mutable infrastructure where configuration is changed via patches. Option C is about resource sharing, not immutable infrastructure. Option D is about version control, which is a separate IaC practice.

Answer

Configuration is changed via patches and updates

Answer

Resources are shared across environments

Answer

Infrastructure is version-controlled

Question 10

A company uses Terraform to deploy virtual machines. They want to ensure that the same exact operating system and software versions are used every time. Which practice supports this?

Accepted Answer

Using a golden image and referencing it in the configuration. Using a golden image—a pre-configured virtual machine template containing the exact operating system and software versions—ensures consistency across deployments. Terraform can reference this image via the `source_image` or `image_id` argument in a resource like `azurerm_virtual_machine` or `aws_instance`, guaranteeing that every provisioned VM starts from the same immutable baseline.

Answer

Manually installing software

Answer

Using inline userdata scripts

Answer

Running configuration management after provisioning

Question 11

In Terraform, the `terraform plan` command compares the current state with the configuration. This is an example of which IaC principle?

Accepted Answer

Desired state enforcement. The `terraform plan` command compares the current state (what is deployed) with the configuration (what is declared) and computes the changes needed to align the real-world infrastructure with the declared configuration. This is the essence of desired state enforcement: the tool continuously reconciles the actual state toward the user-defined desired state, rather than executing imperative steps. Option D is correct because Terraform's core loop—plan, apply, refresh—is built around this declarative, state-driven model.

Answer

Version control integration

Answer

Continuous delivery

Answer

Modular architecture

Question 12

Which two are benefits of using Infrastructure as Code? (Choose two.)

Accepted Answer

Reproducible environments. Reproducible environments (C) are a key benefit because IaC allows you to consistently provision identical infrastructure from the same configuration, eliminating environment drift. Automated documentation (D) is another benefit because IaC code serves as a living, version-controlled description of your infrastructure. A is false: IaC does not guarantee cost optimization; costs depend on resource usage, not just code. B is false: IaC does not remove the need for cloud providers; it relies on them. E is false: while IaC reduces manual errors, it does not eliminate all of them (e.g., logic errors in code).

Answer

Guaranteed cost optimization

Answer

Removes need for cloud providers

Answer

Elimination of all manual errors

Question 13

Which three practices help maintain consistency and reduce configuration drift in IaC? (Choose three.)

Accepted Answer

Storing state files remotely and locking them. Storing state files remotely (e.g., in an S3 bucket with DynamoDB locking) prevents concurrent modifications and ensures that the state file reflects the true infrastructure state. This practice eliminates the risk of conflicting changes and configuration drift caused by local or stale state files.

Answer

Using manual changes to fix minor issues

Answer

Allowing multiple team members to run apply simultaneously

Question 14

Which two statements accurately describe the difference between declarative and imperative IaC approaches? (Choose two.)

Accepted Answer

Declarative focuses on the desired outcome, while imperative specifies step-by-step commands. Declarative IaC, as used in Terraform with HCL, allows you to define the desired end state of infrastructure (e.g., 'I want an AWS EC2 instance with AMI ami-0c55b159cbfafe1f0 and instance type t2.micro'), and the tool automatically determines the necessary steps to achieve that state. In contrast, imperative IaC, such as using AWS CLI commands or Ansible playbooks with explicit 'command' modules, requires you to specify each step (e.g., 'run aws ec2 run-instances, then wait, then tag'). This fundamental difference in approach is a core concept in the TF-003 exam.

Answer

Imperative is only used for scripting, not IaC

Answer

Declarative tools are always faster than imperative tools

Answer

Declarative eliminates the need for idempotency

Question 15

Refer to the exhibit. A team is using this S3 backend configuration. During a deployment, they receive an error that the state file is locked. What is the most likely cause?

Accepted Answer

The DynamoDB table is not provisioned or the IAM role lacks permissions. The error message 'state file is locked' directly indicates that Terraform is attempting to acquire a lock on the state using DynamoDB, but the lock table either does not exist or the IAM role used by Terraform lacks the required permissions (dynamodb:PutItem, dynamodb:GetItem, dynamodb:DeleteItem, dynamodb:DescribeTable). Without a properly provisioned DynamoDB table or sufficient IAM permissions, the locking mechanism fails, producing this specific error.

Answer

The S3 bucket does not exist

Answer

The region is incorrect

Answer

The key path is incorrect