TF-003 Use Terraform outside the core workflow Practice Test 3 — 15 Questions

Question 1

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. Option C is correct because the error indicates the state lock cannot be acquired because another process holds the lock. Options A and B are configuration issues that would cause different errors. Option D is unlikely; a corrupted state file would cause other errors.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.

Question 2

A developer wants to use a module from the Terraform Registry in their configuration. Which block is required in the root module?

Accepted Answer

module "my-module" { source = "..." }. Option B is correct because modules are called using the 'module' block with a 'source' argument. Option A is a provider block used for providers. Option C is a data source. Option D is a resource block.

Answer

resource "my-module" { ... }

Answer

provider "my-module" { source = "..." }

Answer

data "my-module" { ... }

Question 3

A company uses Terraform Cloud and wants to enforce policies that all EC2 instances must be of type t2.micro or t2.small. Which feature should they use?

Accepted Answer

Sentinel policies. Option D is correct because Sentinel is the policy-as-code framework in Terraform Cloud/Enterprise. Option A is for cost tracking. Option B is for security analysis. Option C is not a Terraform Cloud feature.

Answer

Run tasks

Answer

Cost estimation

Answer

Terraform validate

Question 4

A team uses Terraform with multiple workspaces and wants to automatically trigger a plan when a pull request is opened in their Git repository. They use Terraform Cloud. Which feature enables this?

Accepted Answer

VCS-driven workflow. Option B is correct because the VCS-driven workflow in Terraform Cloud automatically runs speculative plans on pull requests. Options A, C, and D are incorrect because they require manual triggering or are not workflows.

Answer

API-driven workflow

Answer

CLI-driven workflow

Answer

Registry-driven workflow

Question 5

A company has a Terraform configuration that creates many AWS resources. They want to check the estimated cost of the plan before applying. Which approach should they use?

Accepted Answer

Enable cost estimation in Terraform Cloud.. Option A is correct because Terraform Cloud provides cost estimation as a built-in feature. Options B and D are not available. Option C is a manual analysis but not a built-in feature.

Answer

Use 'terraform plan -cost' command.

Answer

Manually use 'terraform show -json' and parse pricing.

Answer

Use 'terraform validate' with a custom script.

Question 6

Which TWO of the following are valid ways to use Terraform outside the core workflow (i.e., in automation or CI/CD pipelines)?

Accepted Answer

Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.. Options A and D are correct. A uses the CLI with -auto-approve in a pipeline. D uses the Terraform Cloud API to trigger runs. B is not a common pattern. C is for state migration. E is a tool for visualization, not automation.

Answer

Using 'terraform state mv' to reorganize state files.

Answer

Using 'terraform init -from-module' to force module re-download.

Answer

Using 'terraform graph' to generate visual output.

Question 7

Which THREE of the following are best practices for Terraform state management?

Accepted Answer

Use workspaces to manage different environments.. Options A, C, and E are correct. A ensures state is shared and locked. C enables environment separation. E allows removing resources from state for import or drift correction. B is wrong because state files contain sensitive data and should not be in VCS. D is wrong because manual editing is error-prone.

Answer

Manually edit state files to fix configuration drift.

Answer

Commit state files to version control.

Question 8

Which TWO are valid methods to import existing infrastructure into Terraform?

Accepted Answer

Run 'terraform import' with the resource address and ID.. Options B and D are correct. B involves writing resource blocks manually and then using terraform import. D is the direct import command. A is not a command. C migrates state, not imports. E is not for import.

Answer

Use 'terraform state rm' to remove existing state before running apply.

Answer

Use 'terraform console' to inspect and import.

Answer

Use 'terraform init -migrate-state' to import from another backend.

Question 9

Refer to the exhibit. A Terraform plan fails with the error shown. What is the most likely cause?

Accepted Answer

Another Terraform run is currently in progress.. Option C is correct because the error indicates that the state lock cannot be acquired, meaning another process holds the lock. Options A and B would cause different errors. Option D is unlikely.

Answer

The S3 bucket does not have versioning enabled.

Answer

The DynamoDB table is not configured correctly.

Answer

The state file is corrupted.

Question 10

Refer to the exhibit. A team deploys this configuration. They run 'terraform apply' once and the instance is created. Later, they modify the instance type and run 'terraform apply' again. They notice the provisioner does not run on the second apply. Why?

Accepted Answer

Provisioners run only when the resource is created, not on subsequent updates.. Option A is correct because provisioners only run during resource creation, not updates. Option B is wrong because provisioners run on create or destroy, but only if specified. Option C is wrong because the command is valid. Option D is wrong because the issue is not the type of provisioner.

Answer

Provisioners run only when the resource is destroyed.

Answer

The provisioner should be 'remote-exec' to run on updates.

Answer

The command syntax is incorrect.

Question 11

Refer to the exhibit. A Terraform Cloud plan includes an EC2 instance of type 't2.medium'. The team uses Sentinel policies. Which action should they take to proceed?

Accepted Answer

Change the instance type in the configuration to t2.micro or t2.small.. Option B is correct because the policy must be satisfied by using an allowed instance type. Options A, C, and D are not appropriate: A would change policy which may be against organization rules; C implies override but policy is enforced; D disables checks entirely.

Answer

Modify the Sentinel policy to allow t2.medium.

Answer

Disable the policy check for this run.

Answer

Override the policy in the run using Terraform Cloud UI.

Question 12

A team needs to share a Terraform module across multiple projects within their organization. What is the best practice?

Accepted Answer

Use a remote module source such as a Git repository.. Option C is correct because using a remote source like a Git repository allows easy sharing and versioning. Option A leads to duplication. Option B is not a standard sharing method. Option D is for variables, not modules.

Answer

Copy the module code into each project's directory.

Answer

Use 'terraform state push' to share state.

Answer

Use workspace variables to store module code.

Question 13

A company uses Terraform with a remote backend (AWS S3). They want to ensure that the state file is encrypted at rest. Which configuration approach guarantees this?

Accepted Answer

Configure the S3 backend with server-side encryption enabled (e.g., 'encrypt = true' and 'kms_key_id').. Option A is correct because S3 can be configured with server-side encryption, either via bucket policy or default encryption. Options B and D are not real Terraform commands. Option C is incorrect because provider block does not control state encryption.

Answer

Enable encryption in the AWS provider block.

Answer

Use 'terraform state encrypt' command.

Answer

Use 'terraform init -encrypt-state' flag.

Question 14

A company wants to integrate Terraform with their CI/CD pipeline to automatically deploy infrastructure. Which Terraform feature should they use to ensure state files are stored securely and accessible by the pipeline?

Accepted Answer

Terraform Cloud remote state. Using a remote state backend (like Terraform Cloud) ensures state is stored securely and can be accessed by pipeline runs. Local state with .gitignore is not secure or accessible. Terraform import is for adding existing resources, not state storage. terraform state push is used to manually upload state.

Answer

Terraform import

Answer

Local state with .gitignore

Answer

terraform state push

Question 15

A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies allow you to define rules that check configurations before they are applied. Workspace variables store values, cost estimation estimates costs, run tasks integrate third-party tools – none of them enforce tagging rules.

Answer

Cost estimation

Answer

Workspace variables

Answer

Run tasks