TF-004 Understand IaC concepts — Timed 25 Questions

Question 1

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Accepted Answer

Automated testing and deployment pipelines can be integrated.. IaC defines infrastructure in code, allowing it to be stored in version control systems like Git, enabling change tracking, collaboration, and rollbacks. This code can be integrated into automated CI/CD pipelines for validation, testing, and deployment, significantly reducing human error and speeding up delivery. By defining infrastructure declaratively, IaC ensures that environments can be replicated consistently and reliably across development, staging, and production, preventing configuration drift.

Answer

The same code can be used for any cloud provider without modification.

Answer

No learning curve is required; existing knowledge of manual processes applies directly.

Question 2

A developer runs terraform apply with the configuration above. The resource is created successfully, but the provisioner fails because the public_ip attribute is not yet known at plan time. What is the most likely cause?

Accepted Answer

The provisioner references a computed attribute that is not known until after resource creation.. The `public_ip` attribute of an AWS instance is a computed attribute that is not known until the resource is created and the cloud provider assigns an IP address. In Terraform, provisioners run during resource creation, but if they reference attributes that are only available after the resource is fully created (i.e., after the cloud provider has assigned the value and Terraform has processed it), the provisioner will fail with an error indicating the value is unknown. This is a fundamental behavior of Terraform's execution model: provisioners execute in the same context as the resource creation, and any attribute that is not known at plan time cannot be used in a provisioner if it's still unknown at the time the provisioner executes.

Answer

The AMI ID is incorrect.

Answer

The local-exec provisioner requires network access to the instance.

Answer

The provisioner runs before the state file is written.

Question 3

Which three statements correctly describe concepts of Infrastructure as Code (IaC) as implemented by Terraform? (Choose three.)

Accepted Answer

Terraform's execution plan is a key IaC feature that allows you to preview changes before applying them, reducing the risk of unintended modifications.. Options 2, 3, and 6 are correct because they accurately describe core IaC principles as implemented by Terraform. IaC uses declarative configuration files to define infrastructure, enabling consistent and repeatable provisioning. Version control of these files allows changes to be reviewed and rolled back like application code. Terraform's execution plan is a critical feature that previews changes before applying them, reducing risk of unintended modifications.

Answer

Terraform relies on a mutable infrastructure model, where changes are applied directly to existing resources without destroying and recreating them.

Answer

In Terraform, the desired state is described imperatively, meaning you specify the exact commands to create, modify, or delete resources in order.

Answer

IaC eliminates the need for manual configuration entirely by automatically detecting and fixing all configuration drift without human intervention.

Question 4

Which of the following are key benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management? (Choose four.)

Accepted Answer

Reduces the risk of human error in configuration. Infrastructure as Code (IaC) enables repeatable and consistent deployments by defining infrastructure in declarative or procedural configuration files, eliminating the variability of manual steps. It reduces human error by automating provisioning tasks that are prone to typos or omissions when performed manually. Version control systems like Git allow infrastructure configurations to be tracked, audited, and rolled back, while code reviews and shared modules promote team collaboration and standardization. Statements like automatically fixing all security vulnerabilities or providing self-healing infrastructure without additional tooling are not core benefits of IaC; they require extra tools and practices.

Answer

Provides self-healing infrastructure without any additional tooling

Answer

Automatically fixes all security vulnerabilities in the infrastructure

Question 5

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Accepted Answer

The workspace does not exist.. The explanation correctly identifies 'not initialized' as a cause for a missing state file, which is a common scenario for the error 'No state file was found!'. However, the option 'The workspace does not exist' is less direct. While a non-existent workspace would indeed lack a state file, Terraform typically provides a more specific error message for a non-existent workspace (e.g., 'Error: Workspace "name" does not exist.'). The error 'No state file was found!' more commonly indicates that `terraform apply` has not been run for the current workspace, or the state file has been manually deleted, which aligns better with the 'not initialized' part of the explanation than with 'workspace does not exist.' Despite this imprecision, options A, B, and C are definitively incorrect for the given error message, making D the intended, albeit imperfect, answer.

Answer

The backend configuration changed after the last apply.

Answer

The state file was manually edited in S3.

Answer

Another user ran 'terraform apply' concurrently.

Question 6

Which two are primary benefits of using Infrastructure as Code (IaC) with Terraform?

Accepted Answer

Consistent and repeatable deployments. Terraform's declarative configuration files define the desired state of infrastructure, enabling consistent and repeatable deployments across environments. These configuration files are typically stored in version control systems, allowing for tracking changes, collaboration, and rollbacks, which are core benefits of treating infrastructure as code. By applying the same version-controlled configuration, Terraform ensures that the infrastructure is provisioned identically every time, eliminating configuration drift and manual errors.

Answer

Real-time monitoring of infrastructure

Answer

Manual configuration of each resource

Answer

Automatic scaling based on CPU usage

Question 7

A company manages a microservices application across multiple AWS accounts using Terraform. They have a dedicated 'infrastructure' repository with Terraform configurations for each account. The team recently migrated their Terraform state to a centralized S3 backend with DynamoDB locking. After the migration, they notice that when two developers run `terraform apply` simultaneously in the same workspace, one of them receives a lock error, but the other proceeds normally. The team wants to ensure that only one apply runs at a time across all workspaces. However, they also need to allow concurrent operations on different workspaces. The current backend configuration uses a single DynamoDB table for all workspaces. What should the team do to achieve their goals?

Accepted Answer

Use a separate DynamoDB table for each workspace to isolate locks. The explanation correctly describes Terraform's default DynamoDB locking behavior. Terraform automatically includes the workspace name in the LockID, ensuring locks are isolated per workspace even with a single DynamoDB table. The observed lock error when two developers apply in the same workspace is the expected and correct behavior for this per-workspace isolation. Therefore, the team's current configuration already achieves the goal of allowing concurrent operations on different workspaces while preventing simultaneous operations on the same workspace. The explanation correctly concludes that no change is needed and that none of the provided options are necessary or correct, directly contradicting the marked correct answer (C).

Answer

Use a single DynamoDB table but increase the lock timeout

Answer

Remove the backend configuration and use local state with manual locking

Answer

Disable locking to allow parallel operations

Question 8

A team is adopting Terraform to manage infrastructure. One requirement is that all configuration changes must be reviewed and approved before being applied. The team wants to ensure that the Terraform state file reflects the actual deployed infrastructure at all times. Which practice should they implement to meet these requirements?

Accepted Answer

Store state remotely and use a version control system with pull requests to review changes before applying.. Storing state remotely (e.g., in S3, Azure Storage, or Terraform Cloud) enables state locking and versioning, which is essential for team collaboration. Using a version control system with pull requests ensures that all configuration changes are reviewed and approved before being applied, meeting the requirement for change control. This combination also ensures the state file accurately reflects deployed infrastructure by preventing concurrent modifications and providing an audit trail.

Answer

Store state locally and use a manual approval process outside of Terraform.

Answer

Store state locally and use a shared network drive for team access.

Answer

Have each team member run terraform apply from their local machine after informal discussion.

Question 9

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. It leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 10

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Accepted Answer

The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. Even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.

Answer

The instance type chosen does not support public IP addresses.

Answer

The terraform init command failed and the apply did not actually create resources.

Answer

The subnet is configured as private and does not have a route to the internet.

Question 11

A company uses Terraform to manage infrastructure on AWS. They have a configuration that creates an S3 bucket and a DynamoDB table for state locking. The team notices that sometimes when two members run terraform apply simultaneously, they get a state locking error. However, they want to allow concurrent operations on different workspaces. What is the best approach?

Accepted Answer

Use separate state files per workspace and ensure each workspace has its own lock entry in DynamoDB; the current setup already supports this.. Terraform natively supports per-workspace state files, and when using a remote backend like S3 with DynamoDB for state locking, each workspace's state file is stored at a distinct path in S3. The DynamoDB lock entry is tied to the specific state file path via the LockID, so concurrent operations on different workspaces acquire separate locks and do not conflict. This setup allows multiple team members to run terraform apply simultaneously as long as they are working in different workspaces.

Answer

Remove the DynamoDB table and use local state files to avoid locking issues.

Answer

Configure all team members to use the same workspace so that only one person can apply at a time.

Answer

Keep the current setup because the error is harmless and users can retry.

Question 12

You are a DevOps engineer at a growing startup. The infrastructure currently consists of a single AWS EC2 instance running a web application, manually configured. The company plans to scale to multiple instances and environments (development, staging, production). They want to adopt Infrastructure as Code using Terraform. The team has limited experience with Terraform and wants to start small, then gradually adopt more advanced features. The current manual infrastructure must be imported into Terraform. The team also wants to ensure that code changes are reviewed via pull requests before being applied. Which of the following is the best course of action to meet these requirements?

Accepted Answer

Create a Git repository with a main branch. Write a minimal Terraform configuration that describes the existing EC2 instance. Use terraform import to bring the instance under Terraform management. Store the state file remotely in S3 with DynamoDB locking. Set up a CI pipeline that runs terraform plan on pull requests and requires approval before merging.. It follows the best practices for adopting Infrastructure as Code with Terraform in a team setting. It starts by writing a minimal configuration that matches the existing EC2 instance, uses `terraform import` to bring it under management without downtime, stores state remotely in S3 with DynamoDB locking for collaboration and consistency, and sets up a CI pipeline to run `terraform plan` on pull requests with approval gates, ensuring code review before changes are applied.

Answer

Install Terraform on the existing instance, run terraform init and apply directly to manage it, and store state locally. Have team members share the state file via a shared folder.

Answer

Write Terraform configuration from scratch to match the existing instance, but do not import; instead, destroy the old instance and recreate it with Terraform.

Answer

Create separate Git branches for each environment (dev, staging, prod) and have each team member work independently on their branch, merging occasionally.

Question 13

Which TWO statements about Infrastructure as Code (IaC) are correct?

Accepted Answer

IaC enables automated provisioning and management of infrastructure.. Infrastructure as Code (IaC) automates the provisioning and management of infrastructure through machine-readable definition files, enabling consistent and repeatable deployments without manual intervention. Tools like Terraform use a declarative approach to define resources, and the IaC engine handles creation, modification, and deletion based on the desired state. Option D is correct because IaC configurations are idempotent—applying the same configuration multiple times yields the same result. This is achieved through state management and drift detection, ensuring that infrastructure remains in the specified state regardless of how many times the configuration is applied.

Answer

IaC is only applicable to cloud-based infrastructure.

Answer

IaC eliminates configuration drift entirely.

Answer

IaC tools require manual execution of scripts.

Question 14

You are a platform engineer at a growing startup. The company currently manages infrastructure manually by SSH-ing into servers to install packages and update configurations. As the team grows, this approach has led to frequent configuration drift, inconsistent environments, and manual errors. Deploying a new environment takes several days and requires detailed runbooks. The CTO has asked you to propose a solution that improves consistency, reduces deployment time, and enables version control of infrastructure. You are evaluating Infrastructure as Code (IaC) tools like Terraform. Which course of action best addresses the CTO's requirements?

Accepted Answer

Adopt Terraform to define all infrastructure as code, store configurations in a Git repository, and use a CI/CD pipeline to apply changes automatically.. Terraform directly addresses the CTO's requirements by enabling infrastructure as code (IaC), which ensures consistent, repeatable deployments through declarative configuration files stored in Git for version control. Using a CI/CD pipeline to automatically apply changes eliminates manual SSH errors, reduces deployment time from days to minutes, and prevents configuration drift by enforcing a single source of truth for infrastructure state.

Answer

Improve SSH key management and use configuration management tools like Ansible to apply changes.

Answer

Migrate all applications to containers and use Kubernetes for orchestration.

Answer

Create more detailed runbooks and require peer review for all manual changes.

Question 15

Drag and drop the steps to initialize a Terraform working directory in the correct order.

Accepted Answer

Write Terraform configuration files, then run terraform init, then run terraform validate.. Initialization begins after writing configs; terraform init downloads providers/modules, creates .terraform directory, and validate checks syntax.

Answer

Run terraform init, then write Terraform configuration files, then run terraform validate.

Answer

Write Terraform configuration files, then run terraform validate, then run terraform init.

Answer

Run terraform validate, then write Terraform configuration files, then run terraform init.

Question 16

Drag and drop the steps to upgrade Terraform providers in a configuration in the correct order.

Accepted Answer

Check current provider versions, then update version constraints, then run terraform init to upgrade, then run terraform plan to validate.. The correct sequence for upgrading Terraform providers is: first check current provider versions to establish a baseline, then update version constraints in the configuration to target the desired versions, then run terraform init to download and install those versions, and finally run terraform plan to verify that the upgrade does not introduce unexpected changes. This order ensures a controlled and validated upgrade process.

Answer

Check current provider versions, then run terraform init to upgrade, then update version constraints, then run terraform plan to validate.

Answer

Update version constraints, then check current provider versions, then run terraform init to upgrade, then run terraform plan to validate.

Answer

Check current provider versions, then update version constraints, then run terraform plan to validate, then run terraform init to upgrade.

Question 17

Match each Terraform command to its primary function.

Accepted Answer

terraform init: Initializes a working directory containing Terraform configuration files. The correct matches are: init initializes the workspace, plan creates an execution plan, apply executes changes, destroy tears down resources. Common mistakes include confusing init with apply or plan with destroy.

Answer

terraform init: Applies changes to infrastructure

Answer

terraform plan: Destroys all resources

Question 18

Match each Terraform cloud/enterprise feature to its purpose.

Accepted Answer

Workspaces: Manage multiple environments with separate state and variables.. Workspaces isolate state and variables per environment, Sentinel enforces policies, and Run Tasks integrate third-party tools. Common confusions include mixing the roles of Workspaces and Remote State, or Sentinel with Workspaces.

Answer

Workspaces: Store and share remote state files for collaboration.

Answer

Sentinel: Provide collaborative infrastructure management with separate environments.

Question 19

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 20

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

Accepted Answer

Declarative vs imperative. The difference between declarative and imperative paradigms is key: Terraform is declarative (you specify the desired end state, and Terraform figures out how to achieve it), while Ansible is imperative (you specify each step to reach the state). Option B (client-server vs agentless) refers to architecture, option C (immutable vs mutable) refers to update strategies, and option D (push vs pull) refers to deployment methods. Therefore, option A is correct.

Answer

Client-server vs agentless

Answer

Immutable vs mutable

Answer

Push vs pull