TF-003 Use Terraform outside the core workflow Practice Test 2 — 15 Questions

Question 1

You are managing a Terraform configuration that deploys resources across multiple AWS accounts using provider aliases. The configuration uses a single backend (S3) to store the state file. Recently, you discovered that the state file has become very large (over 100 MB) and is causing slow operations and timeouts. The team wants to improve performance without losing the ability to manage all resources with a single `terraform apply`. You need to propose a solution. Which approach should you take?

Accepted Answer

Use Terraform workspaces to separate environments into different state files. Option C is correct because Terraform workspaces allow you to maintain separate state files for different environments (e.g., dev, prod) while using the same configuration and backend. This reduces the size of each state file, improving performance and avoiding timeouts, while still enabling a single `terraform apply` to manage all resources by targeting the appropriate workspace.

Answer

Use state encryption to compress the state file

Answer

Switch the backend from S3 to Terraform Cloud to improve performance

Answer

Split the configuration into separate directories for each environment

Question 2

A DevOps team is using Terraform Cloud to manage infrastructure. They want to integrate Terraform into their CI/CD pipeline by triggering runs programmatically. Which approach should they use to invoke a Terraform run from an external system?

Accepted Answer

Use the Terraform Cloud API to trigger a run.. The Terraform Cloud API provides a programmatic endpoint to trigger runs, allowing external CI/CD systems to initiate Terraform operations without manual intervention. This is the correct approach because it directly invokes a run with full control over variables, configuration versions, and apply strategies, aligning with the requirement to integrate Terraform into a CI/CD pipeline programmatically.

Answer

Set up a webhook from the VCS provider to trigger runs.

Answer

Configure a remote backend to automatically run apply.

Answer

Execute 'terraform apply -auto-approve' in the CI pipeline.

Question 3

An organization uses Terraform Cloud for team collaboration. They have a workspace that manages production infrastructure. Due to a security policy, they must ensure that all changes go through a peer review process before they are applied. How can they enforce this requirement?

Accepted Answer

Enable 'apply on merge' and set the workspace to require approval before applying.. Option A is correct because enabling 'apply on merge' combined with requiring approval before applying enforces a peer review process: changes must be merged via a VCS pull request (triggering the plan), and then a separate approval step is needed before Terraform Cloud applies the changes. This ensures that no change is applied without explicit human approval after the plan is reviewed.

Answer

Require all changes to be submitted via a VCS pull request.

Answer

Use run triggers to automatically apply after a successful plan in another workspace.

Answer

Lock the workspace and only unlock it for approved changes.

Question 4

A company uses Terraform to manage multi-cloud infrastructure. They have separate Terraform configurations for AWS and Azure, each with its own state file. They want to share a common set of networking variables (e.g., allowed IP ranges) between these configurations without duplicating data. Which approach best achieves this?

Accepted Answer

Use a remote state data source to read the outputs from a dedicated 'globals' workspace.. Option D is correct because using a remote state data source allows you to read outputs from a dedicated 'globals' Terraform workspace that stores shared networking variables. This approach avoids data duplication and ensures that both AWS and Azure configurations can dynamically consume the same canonical set of values without manual copying or file sharing. It leverages Terraform's native remote state mechanism to securely and consistently share data across separate configurations.

Answer

Create a module that contains the variable definitions and reference it in both configurations.

Answer

Define the variables in a 'terraform.tfvars' file and copy it to each configuration directory.

Answer

Store the variables in a JSON file and use the 'jsondecode' function in each configuration.

Question 5

Which TWO of the following are valid ways to import existing infrastructure into Terraform management? (Choose TWO.)

Accepted Answer

Use the 'terraform import' command with the resource address and ID.. Option C is correct because 'terraform import' is the dedicated command to bring existing infrastructure under Terraform management by associating a real-world resource ID with a resource address in state. Option D is correct because you can manually write configuration that matches the existing resource, then run 'terraform plan' to refresh state and detect any drift, allowing you to adjust the configuration until the plan shows no changes.

Answer

Use 'terraform validate' to automatically import resources.

Answer

Use 'terraform state rm' to remove resources from state, then re-add them.

Answer

Run 'terraform apply' with an empty configuration to detect resources.

Question 6

You are a platform engineer at a large e-commerce company that uses Terraform Enterprise to manage thousands of infrastructure resources across multiple teams. The company has a central 'networking' workspace that provisions shared VPCs and subnets, and several application workspaces that consume these networking resources via remote state data sources. Recently, the networking team changed the CIDR block of a shared subnet from '10.0.1.0/24' to '10.0.2.0/24' and applied the change successfully. However, the application teams are now reporting that their Terraform runs are failing with errors indicating that the subnet ID they reference does not exist. The application workspaces use the following configuration to consume the subnet:

```hcl
data "terraform_remote_state" "networking" {
  backend = "remote"
  config = {
    organization = "mycompany"
    workspaces = {
      name = "networking"
    }
  }
}

resource "aws_instance" "app" {
  subnet_id = data.terraform_remote_state.networking.outputs.subnet_id
  ...
}
```

The application workspaces have not been modified recently. The networking workspace output 'subnet_id' now contains the ID of the updated subnet. What is the most likely cause of the failures?

Accepted Answer

The application workspaces are using a cached version of the remote state outputs and need to run 'terraform plan' to refresh.. Option C is correct because Terraform caches remote state data during the planning phase, and the `terraform_remote_state` data source only fetches the latest state when `terraform plan` or `terraform apply` is executed. Since the application workspaces have not been modified or re-planned, they are using a stale cached version of the networking workspace's outputs, which still contains the old subnet ID. Running `terraform plan` forces a refresh of the remote state data, retrieving the updated `subnet_id` and resolving the error.

Answer

The application workspaces do not have permission to read the networking workspace's state.

Answer

The networking workspace output variable 'subnet_id' was removed or renamed.

Answer

The application workspaces need to update the remote state data source to reference the new subnet ID.

Question 7

An organization uses Terraform Cloud to manage infrastructure across multiple teams. They need to enforce that all workspaces use a specific version of Terraform and that no workspace can be deleted accidentally. Which approach meets these requirements without using Sentinel or Terraform Enterprise?

Accepted Answer

Use the Terraform Cloud API to write an OPA policy that enforces Terraform version and prevents workspace deletion.. Option C is correct because the Terraform Cloud API allows you to write OPA (Open Policy Agent) policies that can enforce Terraform version constraints and prevent workspace deletion, even without Sentinel or Terraform Enterprise. OPA policies are evaluated during runs and API calls, providing a flexible, code-based approach to governance that meets both requirements.

Answer

Include `required_version` in each workspace's root module and configure workspace locks in the UI.

Answer

Set `required_providers` with version constraints in a global Terraform file.

Answer

Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.

Question 8

Which TWO of the following are valid ways to use Terraform outside the core workflow? (Choose two.)

Accepted Answer

Using Terraform outputs as inputs for other tools like Ansible.. Option B is correct because Terraform outputs can be consumed by other tools like Ansible via the `terraform output` command or by referencing the state file, enabling integration in multi-tool workflows. Option E is correct because the Terraform state file (`.tfstate`) contains all resource attributes and dependencies, which can be parsed programmatically or with tools like `terraform graph` to generate infrastructure diagrams, extending Terraform's use beyond provisioning.

Answer

Using Terraform to manage application secrets lifecycle.

Answer

Using Terraform to install software on existing servers.

Answer

Using Terraform as a CI/CD pipeline tool.

Question 9

The user runs `terraform init` successfully, but then `terraform plan` still fails with a different error: "Error: No configuration files found in this directory." The directory contains backend.tf and main.tf. What is the most likely cause?

Accepted Answer

The user is not in the same directory as the .tf files.. The error 'No configuration files found in this directory' indicates that Terraform cannot locate any .tf files in the current working directory. Even though the directory contains backend.tf and main.tf, the user must be in that directory when running `terraform plan`. This is a common path issue, not a configuration or syntax problem.

Answer

The backend block is misconfigured.

Answer

The workspace name in the backend configuration is incorrect.

Answer

The main.tf file contains invalid syntax.

Question 10

Which three of the following are valid ways to use Terraform outside the core provisioning workflow? (Choose three.)

Accepted Answer

Using `terraform import` to bring existing infrastructure under Terraform management.. The three correct options are `terraform import`, `terraform state push`, and `terraform plan -out=tfplan`. `terraform import` is a non‑provisioning workflow that maps existing infrastructure into Terraform state without creating or destroying resources. `terraform state push` manually uploads a state file to a remote backend, bypassing the normal `apply` workflow. `terraform plan -out=tfplan` generates a plan file that can be applied later, decoupling the planning phase from the apply phase and thus operating outside the core provisioning loop.

Answer

Using `terraform console` to interactively evaluate expressions in the Terraform language.

Answer

Using `terraform validate` to check configuration syntax before any state operations.

Answer

Using `terraform fmt` to automatically rewrite configuration files into a canonical format.

Question 11

Which four of the following are valid ways to integrate Terraform into an automated pipeline or use it outside the core manual workflow? (Choose all that apply.)

Accepted Answer

Using Terraform Cloud's API-driven run workflow to trigger plans and applies via a REST API call.. All four correct options represent valid methods for using Terraform outside the core interactive manual workflow. Running `terraform plan` and `terraform apply` in a CI/CD pipeline with environment variables for backend configuration is a standard automation pattern. Terraform Cloud's API-driven run workflow allows programmatic triggering of runs, which is essential for integration with external systems. The `-auto-approve` flag skips the interactive approval prompt, enabling non-interactive execution in scripts. Using `terraform output` in shell scripts is a common way to extract and pass infrastructure data to downstream tools.

Answer

Editing the `.tfstate` file directly to modify resource attributes before applying changes in automation.

Answer

Using `terraform init` with the `-from-module` flag to import existing infrastructure into state without a configuration file.

Question 12

Drag and drop the steps to use Terraform workspaces for environment separation in the correct order.

Question 13

Match each Terraform meta-argument to its purpose.

Question 14

A CI/CD pipeline runs 'terraform plan' and needs to automatically approve only if no resources will be destroyed. Which approach should be used?

Accepted Answer

Run 'terraform plan -out=plan.tfplan', then 'terraform show -json plan.tfplan' and parse the output for destroy actions.. Option A is correct because 'terraform show -json plan.tfplan' outputs the plan in JSON format, which can be parsed to detect destroy actions. Option B is wrong because '-destroy' flag always shows destroy actions, not a detection method. Option C is wrong because auto-approve would apply without checking. Option D is wrong because validate only checks syntax, not changes. Option E is wrong because fmt only formats code.

Answer

Run 'terraform apply -auto-approve' after a successful plan.

Answer

Run 'terraform plan -destroy' and check the exit code.

Answer

Run 'terraform fmt' to check for formatting issues.

Answer

Run 'terraform validate' to ensure no destroys are needed.

Question 15

A team wants to import an existing AWS S3 bucket named 'my-bucket' into Terraform state. The resource block is defined as 'aws_s3_bucket.my_bucket'. Which command should be used?

Accepted Answer

terraform import aws_s3_bucket.my_bucket my-bucket. Option D is correct because the import command syntax is 'terraform import '. The resource address is 'aws_s3_bucket.my_bucket' and the ID is the bucket name 'my-bucket'. Option A has the wrong order. Option B uses a hyphen in the resource name. Option C is correct syntax but with unnecessary quotes. Option D is the standard syntax.

Answer

terraform import my-bucket aws_s3_bucket.my_bucket

Answer

terraform import 'aws_s3_bucket.my_bucket' 'my-bucket'

Answer

terraform import aws_s3_bucket.my-bucket my-bucket