TF-004 Use Terraform outside the core workflow — 10 Questions

Question 1

Which TWO of the following are valid use cases for using Terraform Cloud's Sentinel policies? (Choose two.)

Accepted Answer

Enforce that all AWS instances are of a specific type. Sentinel policies can enforce that all AWS instances are of a specific type by using a `validate` rule that checks the `aws_instance` resource's `instance_type` attribute against an allowed list. This is a common compliance use case for Sentinel in Terraform Cloud, where policy-as-code ensures infrastructure adheres to organizational standards before provisioning. Similarly, Sentinel can enforce that all resources have required tags by inspecting the `tags` attribute in the Terraform plan and ensuring specific keys and values are present, which is another common compliance and governance use case.

Answer

Provide cost estimates for infrastructure changes

Answer

Enforce that all Terraform code follows a specific formatting style

Answer

Automatically rotate database passwords

Question 2

Which TWO of the following are true about Terraform Cloud's run lifecycle? (Choose two.)

Accepted Answer

A plan can be discarded without applying. Terraform Cloud allows users to discard a plan without applying it, which is useful when the proposed changes are not desired or need to be revised. This is a standard part of the run lifecycle where a plan can be reviewed and then discarded, preventing any infrastructure changes from being made. Additionally, if auto-apply is disabled for a workspace, every plan requires explicit manual confirmation before the apply phase can proceed, giving users control over when changes are deployed.

Answer

Policy checks can be skipped for emergency changes

Answer

Cost estimation is automatically generated for every run

Answer

A plan that fails due to policy violations can still be applied with admin override

Question 3

Which three of the following are valid ways to use Terraform outside the core provisioning workflow? (Choose three.)

Accepted Answer

Using `terraform import` to bring existing infrastructure under Terraform management.. The correct options are `terraform import`, `terraform state push`, `terraform plan -out=tfplan`, and `terraform console`. `terraform import` is a non‑provisioning workflow that maps existing infrastructure into Terraform state without creating or destroying resources. `terraform state push` manually uploads a state file to a remote backend, bypassing the normal `apply` workflow. `terraform plan -out=tfplan` generates a plan file that can be applied later, decoupling the planning phase from the apply phase and thus operating outside the core provisioning loop. `terraform console` is a utility for interactively evaluating expressions in the Terraform language, which is also outside the core provisioning workflow.

Answer

Using `terraform console` to interactively evaluate expressions in the Terraform language.

Answer

Using `terraform fmt` to automatically rewrite configuration files into a canonical format.

Answer

Using `terraform validate` to check configuration syntax before any state operations.

Question 4

Which four of the following are valid ways to integrate Terraform into an automated pipeline or use it outside the core manual workflow? (Choose all that apply.)

Accepted Answer

Using Terraform Cloud's API-driven run workflow to trigger plans and applies via a REST API call.. All four correct options represent valid methods for using Terraform outside the core interactive manual workflow. Running `terraform plan` and `terraform apply` in a CI/CD pipeline with environment variables for backend configuration is a standard automation pattern. Terraform Cloud's API-driven run workflow allows programmatic triggering of runs, which is essential for integration with external systems. The `-auto-approve` flag skips the interactive approval prompt, enabling non-interactive execution in scripts. Using `terraform output` in shell scripts is a common way to extract and pass infrastructure data to downstream tools.

Answer

Editing the `.tfstate` file directly to modify resource attributes before applying changes in automation.

Answer

Using `terraform init` with the `-from-module` flag to import existing infrastructure into state without a configuration file.

Question 5

A Terraform practitioner wants to ensure that the access keys used by a provider are not visible in plan output. Which Terraform attribute should be used when defining the provider?

Accepted Answer

sensitive. To prevent sensitive information like access keys from appearing in Terraform plan output, the values should be defined as `sensitive` variables. These variables are then referenced within the provider configuration. The `sensitive` attribute itself is applied to the `variable` block (e.g., `variable "access_key" { sensitive = true }`), not directly to the `provider` block. Therefore, none of the provided options are attributes that can be used directly on a `provider` block for this purpose.

Answer

encrypted

Answer

hidden

Answer

secret

Question 6

A team using a remote S3 backend with DynamoDB locking is experiencing frequent 'Error acquiring the state lock' messages in their CI/CD pipeline. The pipeline runs multiple concurrent jobs for different workspaces. What is the most likely cause and solution?

Accepted Answer

The same workspace is being used for concurrent runs; use separate workspaces per environment.. The error 'Error acquiring the state lock' occurs when Terraform cannot obtain a lock on the state file for a specific workspace. In this scenario, the pipeline runs multiple concurrent jobs for different workspaces, but if the same workspace is inadvertently used across concurrent runs, Terraform's DynamoDB-based locking mechanism will prevent simultaneous access to that workspace's state. The solution is to ensure each environment (e.g., dev, staging, prod) uses a separate workspace, avoiding lock contention. Option B correctly identifies this as the most likely cause and solution.

Answer

The DynamoDB table lacks sufficient read/write capacity; increase it.

Answer

The pipeline is running too many jobs; increase the lock wait time.

Answer

The S3 bucket is not versioned; enable versioning.

Question 7

Which TWO of the following are valid ways to pass variables to Terraform in an automated pipeline?

Accepted Answer

Creating a .tfvars file and referencing it with -var-file.. The `-var-file` flag allows you to pass a `.tfvars` file containing variable definitions, which is ideal for automated pipelines where you want to load multiple variables from a version-controlled or dynamically generated file without manual interaction. This approach supports repeatable, non-interactive deployments. The `-var` flag allows you to specify individual variables directly on the command line, which is also suitable for automation, especially for overriding specific values or passing dynamically generated single variables.

Answer

Using interactive prompts during terraform apply.

Answer

Setting environment variables with prefix TERRAFORM_.

Answer

Using the -vars flag to pass JSON string.

Question 8

A DevOps engineer is troubleshooting a failed 'terraform plan' command. The error message is: 'Error: Error acquiring the state lock' followed by a message that the lock is held by another process. The team uses Terraform Cloud with remote state. Which of the following is the most likely cause and correct resolution?

Accepted Answer

Identify the lock holder via Terraform Cloud UI and use 'terraform force-unlock' to release it.. The state lock in Terraform Cloud is held by another run or process; using the 'force-unlock' command with the correct lock ID from the Terraform Cloud UI can release it. Option A is wrong because state locking is a fundamental and non-disableable feature of Terraform Cloud's remote state management, ensuring state consistency. Option B is wrong because waiting may be indefinite if the lock is stuck. Option C is wrong because you cannot disable locking in Terraform Cloud.

Answer

Disable state locking in the backend configuration.

Answer

Wait for the lock to be released automatically.

Answer

Add the '-lock=false' flag to the plan command.

Question 9

A team uses Terraform workspaces to manage multiple environments (dev, staging, prod). They are currently in the 'dev' workspace and want to run a plan for the 'staging' workspace without switching workspaces. Which command sequence should they use?

Accepted Answer

terraform workspace select staging && terraform plan. The explanation correctly states that 'terraform plan' operates within the currently selected workspace and that 'terraform workspace select staging' is necessary to change the active workspace. This accurately describes the functionality and justifies option C as the intended answer, despite the stem's contradictory phrasing. There is no direct flag on 'terraform plan' to target a different workspace without first selecting it.

Answer

terraform plan -workspace=staging

Answer

terraform plan -var=workspace=staging

Answer

terraform plan -state=staging.tfstate

Question 10

Which TWO Terraform backends support remote state locking?

Accepted Answer

s3. The S3 backend supports remote state locking via DynamoDB. When you configure the S3 backend with a `dynamodb_table` parameter, Terraform uses DynamoDB's conditional writes to acquire and release locks. Similarly, the Consul backend also provides native state locking capabilities, leveraging Consul's key-value store for distributed locks, ensuring that only one user or process can modify the state at a time for both backends.

Answer

local

Answer

inmem

Answer

http