TF-004 Multiple Select — 60 Questions

Question 1

Which THREE statements about module configuration are correct?

Accepted Answer

Module sources can be local paths or remote URLs.. Terraform module sources can be either local file paths (e.g., `./modules/network`) or remote URLs (e.g., `git::https://example.com/repo.git`, `registry.terraform.io/hashicorp/consul/aws`). The `source` argument supports multiple protocols including local, Git, HTTP, and the Terraform Registry, making it flexible for version control and distribution.

Answer

Version constraints can be specified for any module source.

Answer

The outputs of a module are available after apply only.

Question 2

Which TWO statements are correct when refactoring a monolithic Terraform configuration into modules?

Accepted Answer

Module outputs are necessary to expose values to the root module.. Module outputs are the mechanism by which a root module accesses values from child modules. Without outputs, any resource attributes created inside a module remain encapsulated and inaccessible to the calling configuration, making it impossible to use those values for interpolation or to pass them to other resources or modules.

Answer

All modules must reside in a separate directory outside the root module.

Answer

A module should contain only one resource to keep it simple.

Answer

Variables are optional in modules if hardcoded values are acceptable.

Question 3

Which TWO statements about Terraform provisioners are correct?

Accepted Answer

Provisioners should be used as a last resort when no other Terraform resource or data source fits.. Terraform provisioners are considered a last resort for tasks that cannot be accomplished with Terraform's declarative resource model. The official Terraform documentation explicitly states that provisioners should be used sparingly, as they introduce procedural logic and can cause state drift or failures that are hard to debug. This aligns with the principle of keeping configurations idempotent and relying on native resource attributes or data sources first.

Answer

Provisioners can only be used with the 'local-exec' and 'remote-exec' provisioners.

Answer

Provisioners are the primary way to configure resources after creation.

Answer

Provisioners run only once during initial creation by default.

Question 4

Which THREE are considered Terraform's best practices?

Accepted Answer

Use variables to parameterize configurations. A is correct because using variables to parameterize configurations is a core Terraform best practice that enables reusability, flexibility, and separation of concerns. By defining input variables in `variables.tf` and passing values via `terraform.tfvars` or environment variables, you avoid hardcoding values like instance types or region names, making configurations portable across environments (dev, staging, prod). This aligns with Terraform's principle of writing infrastructure as code that is modular and maintainable.

Answer

Use latest version of all modules

Answer

Use provisioners for all software installs

Question 5

Which TWO are benefits of using Terraform modules?

Accepted Answer

Encapsulation of complexity, providing a clean interface.. Terraform modules encapsulate complex infrastructure logic into a single, reusable abstraction. By defining input variables and output values, modules provide a clean interface that hides internal resource configurations, making configurations easier to manage and maintain.

Answer

Faster execution of terraform plan and apply.

Answer

Reduction in state file size.

Answer

Enhanced security by automatically encrypting state files.

Question 6

Which two of the following are correct statements about Terraform providers?

Accepted Answer

Providers are plugins that Terraform uses to manage resources.. Terraform providers are plugins that enable Terraform to manage resources for a specific cloud or service (e.g., AWS, Azure). They can be sourced from the Terraform Registry or other locations. The correct statements are B and C. A is incorrect because a provider is not required in every configuration; some configurations may use only data sources or child modules that already have providers defined. D is incorrect because multiple providers can be used in a single configuration to manage resources across different platforms. E is incorrect because providers are installed by `terraform init`, not `terraform plan`.

Answer

A provider must be defined in every Terraform configuration.

Answer

Only one provider can be used per configuration.

Answer

Providers are automatically installed by terraform plan.

Question 7

Which TWO tasks are better suited for configuration management tools than Terraform?

Accepted Answer

Installing software packages. Installing software packages and configuring web server settings are typical tasks for configuration management tools like Ansible or Puppet, as they operate on existing servers. Terraform, by contrast, is designed for provisioning infrastructure resources such as VPCs, IAM roles, and network ACLs. Therefore, options A and E are correct.

Answer

Managing network ACLs

Answer

Provisioning a VPC

Answer

Creating IAM roles

Question 8

A company is using Terraform to manage secrets in AWS Secrets Manager. They want to ensure that sensitive values are not exposed in logs, the console, or plan output. Which two practices should they implement? (Choose two.)

Accepted Answer

Use the sensitive flag in variable definitions. Marking a variable with `sensitive = true` in its definition block tells Terraform to redact its value in CLI output, logs, and plan output. This prevents the secret from being displayed in plaintext during `terraform plan` or `terraform apply`, even if the variable is used in a resource argument. Option E is correct because setting `sensitive = true` on an output value instructs Terraform to suppress that output in the CLI and in any logs or console displays, ensuring the secret value is not exposed after apply.

Answer

Use a remote backend with encryption

Answer

Use a data source to fetch secrets at runtime instead of hardcoding

Answer

Store variable values in terraform.tfvars file

Question 9

Which TWO module source types support version constraints in Terraform?

Accepted Answer

Terraform Public Registry. The Terraform Public Registry supports version constraints via the `source` argument using the `registry.terraform.io` namespace, allowing you to specify a version range (e.g., `~> 1.0`) in the module block. Option E is correct because the Terraform Cloud Private Registry also supports version constraints, enabling you to pin or constrain module versions from private repositories using the same syntax as the public registry.

Answer

HTTP URL to a zip archive

Answer

Local file path

Answer

Git URL with a branch reference

Question 10

Which TWO actions are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform plan. The core Terraform workflow consists of three main steps: `terraform init` to initialize the working directory, `terraform plan` to preview changes, and `terraform apply` to execute those changes. Option B (`terraform plan`) is correct because it creates an execution plan showing what actions Terraform will take to reach the desired state defined in configuration files. Option D (`terraform apply`) is correct because it applies the changes required to reach the desired state, either by using a previously generated plan or by creating a new plan and prompting for approval.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform destroy

Question 11

Which TWO of the following are valid ways to reference a resource attribute in Terraform?

Accepted Answer

`module.vpc.vpc_id`. `module.vpc.vpc_id` directly references an output attribute from a module. In Terraform, module outputs are accessed using the syntax `module..`, and `vpc_id` is a common output from VPC modules that exposes the ID of the created VPC resource.

Answer

`module.vpc.output`

Answer

`data.aws_ami.ubuntu.id`

Answer

`var.instance_type`

Question 12

Which TWO of the following are valid strategies to migrate Terraform state from a local backend to a remote backend?

Accepted Answer

Manually copy the local state file to the remote backend storage. The valid strategies for migrating state from local to remote backend are: manually copying the state file to the remote location (B) or using `terraform init -migrate-state` (D). Option C is incorrect because `terraform init -reconfigure` only reconfigures the backend without migrating the existing state.

Answer

Use terraform import for each resource

Answer

Change backend configuration and run terraform init -reconfigure

Answer

Use the terraform state push command

Question 13

A team is defining their Infrastructure as Code strategy. Which two of the following are key benefits of using IaC compared to manual configuration?

Accepted Answer

Faster deployment and provisioning.. IaC automates the provisioning and configuration of infrastructure through code, eliminating the need for manual, error-prone steps. This enables rapid deployment of resources, often reducing setup times from hours to minutes by leveraging tools like Terraform to apply declarative configurations in parallel across multiple providers.

Answer

Reduced need for monitoring.

Answer

Elimination of all security vulnerabilities.

Answer

Automatic recovery from any infrastructure failure.

Question 14

Which TWO are benefits of Terraform's immutable infrastructure approach?

Accepted Answer

Easier rollbacks. Terraform's immutable infrastructure approach replaces entire resources rather than modifying them in-place. This means the previous version of the infrastructure is preserved as a state snapshot, allowing you to roll back by simply reapplying the prior configuration from your version control system. This eliminates the complexity of tracking incremental changes and ensures a clean, predictable rollback process.

Answer

Better performance

Answer

Faster provisioning

Answer

Lower cost

Question 15

Which TWO commands are part of the core Terraform workflow? (Choose two.)

Accepted Answer

terraform init. `terraform init`, is correct because it initializes a working directory containing Terraform configuration files, downloading and installing the required providers and modules. This is the first command in the core Terraform workflow, which follows the sequence: init, plan, apply. Without `init`, subsequent commands like `plan` or `apply` will fail due to missing provider plugins and backend configuration.

Answer

terraform fmt

Answer

terraform console

Answer

terraform get

Question 16

Which three practices help maintain consistency and reduce configuration drift in IaC? (Choose three.)

Accepted Answer

Storing state files remotely and locking them. Storing state files remotely (e.g., in an S3 bucket with DynamoDB locking) prevents concurrent modifications and ensures that the state file reflects the true infrastructure state. This practice eliminates the risk of conflicting changes and configuration drift caused by local or stale state files.

Answer

Using manual changes to fix minor issues

Answer

Allowing multiple team members to run apply simultaneously

Question 17

Which three of the following are true regarding Terraform state?

Accepted Answer

State can be stored in a local file or remotely.. Terraform state is the mechanism by which Terraform maps real-world resources to your configuration, and it can be stored either in a local file (e.g., terraform.tfstate) or remotely in a backend such as S3, Azure Storage, or Terraform Cloud. This flexibility allows teams to share state and enable collaboration, while local storage is suitable for single-user or testing scenarios.

Answer

State can be manually edited with a text editor without risk.

Answer

State must be stored in a file named terraform.tfstate.

Question 18

Which three characteristics are associated with immutable infrastructure as practiced by Terraform?

Accepted Answer

New versions are deployed by creating new instances. Immutable infrastructure in Terraform involves deploying new versions by creating entirely new instances rather than modifying existing ones. This aligns with Terraform's resource lifecycle, where changes to certain attributes trigger destruction and recreation, ensuring a consistent and reproducible state.

Answer

Configuration drift is accepted

Answer

In-place updates are preferred

Question 19

Which THREE of the following are necessary steps to configure OIDC (OpenID Connect) for authenticating Terraform in a CI/CD pipeline?

Accepted Answer

Set up an OIDC provider in the target cloud (e.g., AWS IAM OIDC provider).. To authenticate Terraform in a CI/CD pipeline using OIDC, you must first establish trust between the CI platform and the cloud provider by creating an OIDC identity provider (e.g., an AWS IAM OIDC provider). This provider validates the JSON Web Token (JWT) issued by the CI platform (e.g., GitHub Actions, GitLab CI) and maps it to an IAM role, enabling token-based authentication without long-lived secrets.

Answer

Generate a long-lived API token and store it as a secret.

Answer

Configure remote backend with static credentials.

Question 20

Which TWO of the following are required when configuring a Terraform backend for remote state storage?

Accepted Answer

A backend type (e.g., s3, azurerm, gcs). Every Terraform backend configuration must specify a backend type (e.g., s3, azurerm, gcs) to define where state is stored. Option E is correct because authentication credentials are required to access the remote backend; without valid credentials, Terraform cannot read or write state to the configured storage location.

Answer

Encryption at rest configuration

Answer

State locking support

Answer

Workspace configuration