TF-004 Use Terraform outside the core workflow Practice Test 3 — 15 Questions

Question 1

A company uses Terraform to manage multi-cloud infrastructure. They have separate Terraform configurations for AWS and Azure, each with its own state file. They want to share a common set of networking variables (e.g., allowed IP ranges) between these configurations without duplicating data. Which approach best achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a remote state data source to read the outputs from a dedicated 'globals' workspace.. Using a remote state data source allows you to read outputs from a dedicated 'globals' Terraform workspace that stores shared networking variables. This approach avoids data duplication and ensures that both AWS and Azure configurations can dynamically consume the same canonical set of values without manual copying or file sharing. It leverages Terraform's native remote state mechanism to securely and consistently share data across separate configurations.

Answer

Create a module that contains the variable definitions and reference it in both configurations.

Answer

Define the variables in a 'terraform.tfvars' file and copy it to each configuration directory.

Answer

Store the variables in a JSON file and use the 'jsondecode' function in each configuration.

Question 2

Which TWO of the following are valid ways to import existing infrastructure into Terraform management? (Choose TWO.)

Accepted Answer

Use the 'terraform import' command with the resource address and ID.. 'terraform import' is the dedicated command to bring existing infrastructure under Terraform management by associating a real-world resource ID with a resource address in state. Option D is correct because you can manually write configuration that matches the existing resource, then run 'terraform plan' to refresh state and detect any drift, allowing you to adjust the configuration until the plan shows no changes.

Answer

Use 'terraform validate' to automatically import resources.

Answer

Use 'terraform state rm' to remove resources from state, then re-add them.

Answer

Run 'terraform apply' with an empty configuration to detect resources.

Question 3

You are a platform engineer at a large e-commerce company that uses Terraform Enterprise to manage thousands of infrastructure resources across multiple teams. The company has a central 'networking' workspace that provisions shared VPCs and subnets, and several application workspaces that consume these networking resources via remote state data sources. Recently, the networking team changed the CIDR block of a shared subnet from '10.0.1.0/24' to '10.0.2.0/24' and applied the change successfully. However, the application teams are now reporting that their Terraform runs are failing with errors indicating that the subnet ID they reference does not exist. The application workspaces use the following configuration to consume the subnet:

```hcl
data "terraform_remote_state" "networking" {
  backend = "remote"
  config = {
    organization = "mycompany"
    workspaces = {
      name = "networking"
    }
  }
}

resource "aws_instance" "app" {
  subnet_id = data.terraform_remote_state.networking.outputs.subnet_id
  ...
}
```

The application workspaces have not been modified recently. The networking workspace output 'subnet_id' now contains the ID of the updated subnet. What is the most likely cause of the failures?

Accepted Answer

The application workspaces are using a cached version of the remote state outputs and need to run 'terraform plan' to refresh.. Terraform caches remote state data during the planning phase, and the `terraform_remote_state` data source only fetches the latest state when `terraform plan` or `terraform apply` is executed. Since the application workspaces have not been modified or re-planned, they are using a stale cached version of the networking workspace's outputs, which still contains the old subnet ID. Running `terraform plan` forces a refresh of the remote state data, retrieving the updated `subnet_id` and resolving the error.

Answer

The application workspaces do not have permission to read the networking workspace's state.

Answer

The networking workspace output variable 'subnet_id' was removed or renamed.

Answer

The application workspaces need to update the remote state data source to reference the new subnet ID.

Question 4

An organization uses Terraform Cloud to manage infrastructure across multiple teams. They need to enforce that all workspaces use a specific version of Terraform and that no workspace can be deleted accidentally. Which approach meets these requirements without using Sentinel or Terraform Enterprise?

Accepted Answer

Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.. Terraform Cloud allows configuring the Terraform version at the workspace level, ensuring a specific version is used. The 'Prevent deletion' option in workspace settings protects against accidental deletion. While per-workspace, administrators can enforce these settings across workspaces via API or organization defaults. Options A and B do not prevent deletion; Option C is incorrect because OPA is not natively integrated—Sentinel is the built-in policy engine but is excluded.

Answer

Include `required_version` in each workspace's root module and configure workspace locks in the UI.

Answer

Set `required_providers` with version constraints in a global Terraform file.

Answer

Use the Terraform Cloud API to write an OPA policy that enforces Terraform version and prevents workspace deletion.

Question 5

Which TWO of the following are valid ways to use Terraform outside the core workflow? (Choose two.)

Accepted Answer

Using Terraform outputs as inputs for other tools like Ansible.. Terraform outputs can be consumed by other tools like Ansible via the `terraform output` command or by referencing the state file, enabling integration in multi-tool workflows. Option E is correct because the Terraform state file (`.tfstate`) contains all resource attributes and dependencies, which can be parsed programmatically or with tools like `terraform graph` to generate infrastructure diagrams, extending Terraform's use beyond provisioning.

Answer

Using Terraform to manage application secrets lifecycle.

Answer

Using Terraform to install software on existing servers.

Answer

Using Terraform as a CI/CD pipeline tool.

Question 6

The user runs `terraform init` successfully, but then `terraform plan` still fails with a different error: "Error: No configuration files found in this directory." The directory contains backend.tf and main.tf. What is the most likely cause?

Accepted Answer

The user is not in the same directory as the .tf files.. The error 'No configuration files found in this directory' indicates that Terraform cannot locate any .tf files in the current working directory. Even though the directory contains backend.tf and main.tf, the user must be in that directory when running `terraform plan`. This is a common path issue, not a configuration or syntax problem.

Answer

The backend block is misconfigured.

Answer

The workspace name in the backend configuration is incorrect.

Answer

The main.tf file contains invalid syntax.

Question 7

Drag and drop the steps to use Terraform workspaces for environment separation in the correct order.

Accepted Answer

Create workspace, then Select workspace, then Set environment-specific variables, then Run terraform plan and apply. The correct sequence for using Terraform workspaces is: first create the workspace (if it doesn't exist) to isolate state, then select it to switch to that workspace's state, then set environment-specific variables (e.g., via .tfvars files) to tailor configuration, and finally run terraform plan and apply to manage resources. Workspaces are essential for environment separation, ensuring state isolation and preventing cross-environment interference.

Answer

Select workspace, then Create workspace, then Set environment-specific variables, then Run terraform plan and apply

Answer

Set environment-specific variables, then Create workspace, then Select workspace, then Run terraform plan and apply

Answer

Create workspace, then Set environment-specific variables, then Select workspace, then Run terraform plan and apply

Question 8

Match each Terraform meta-argument to its purpose.

Accepted Answer

depends_on: Specifies hidden dependencies on other resources. Terraform meta-arguments are available across all resource types. depends_on declares hidden dependencies, count creates N copies, for_each creates copies from a collection, and lifecycle controls behavior like create_before_destroy. Common confusions include mixing the purposes of count and depends_on, or associating lifecycle with instance creation.

Answer

count: Specifies hidden dependencies on other resources

Answer

lifecycle: Creates multiple resource instances based on a count

Question 9

A CI/CD pipeline runs 'terraform plan' and needs to automatically approve only if no resources will be destroyed. Which approach should be used?

Accepted Answer

Run 'terraform plan -out=plan.tfplan', then 'terraform show -json plan.tfplan' and parse the output for destroy actions.. 'terraform plan -out=plan.tfplan' generates a plan file, and 'terraform show -json plan.tfplan' outputs it in JSON format, which can be parsed to detect destroy actions. If no destroy actions are present, the pipeline can proceed to apply. Option A is wrong because 'terraform apply -auto-approve' would apply any changes without checking for destroys. Option B is wrong because 'terraform plan -destroy' always shows a destroy plan, not a way to detect destroys in a normal plan. Option C is wrong because 'terraform fmt' only formats code, not checks for destroys. Option D is wrong because 'terraform validate' only checks syntax, not planned changes.

Answer

Run 'terraform apply -auto-approve' after a successful plan.

Answer

Run 'terraform plan -destroy' and check the exit code.

Answer

Run 'terraform fmt' to check for formatting issues.

Answer

Run 'terraform validate' to ensure no destroys are needed.

Question 10

A team wants to import an existing AWS S3 bucket named 'my-bucket' into Terraform state. The resource block is defined as 'aws_s3_bucket.my_bucket'. Which command should be used?

Accepted Answer

terraform import aws_s3_bucket.my_bucket my-bucket. The correct syntax for `terraform import` is `terraform import `, where the resource address is the Terraform resource block identifier (e.g., `aws_s3_bucket.my_bucket`) and the ID is the actual AWS resource identifier (e.g., the bucket name `my-bucket`). Option C follows this exact order: `terraform import aws_s3_bucket.my_bucket my-bucket`, making it the correct command to import the existing S3 bucket into Terraform state.

Answer

terraform import my-bucket aws_s3_bucket.my_bucket

Answer

terraform import 'aws_s3_bucket.my_bucket' 'my-bucket'

Answer

terraform import aws_s3_bucket.my-bucket my-bucket

Question 11

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. The error 'ConditionalCheckFailedException' occurs when DynamoDB's conditional put operation fails, which happens when a lock item already exists in the DynamoDB table. This indicates another Terraform process currently holds the state lock, preventing concurrent operations. Terraform uses DynamoDB's conditional writes to ensure only one process can acquire the lock at a time.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.

Question 12

A developer wants to use a module from the Terraform Registry in their configuration. Which block is required in the root module?

Accepted Answer

module "my-module" { source = "..." }. To use a module from the Terraform Registry, you must declare a `module` block in your root configuration. The `source` argument inside that block specifies the module's location (e.g., a registry path like `hashicorp/consul/aws`). This is the only way Terraform knows to fetch, version, and instantiate the module's resources.

Answer

resource "my-module" { ... }

Answer

provider "my-module" { source = "..." }

Answer

data "my-module" { ... }

Question 13

A company uses Terraform Cloud and wants to enforce policies that all EC2 instances must be of type t2.micro or t2.small. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies are HashiCorp's policy-as-code framework integrated with Terraform Cloud. They allow organizations to define fine-grained, logic-based rules that are enforced during the plan phase, such as restricting EC2 instance types to t2.micro or t2.small. This is the correct feature because it provides mandatory, automated policy enforcement across all workspaces, ensuring compliance before any infrastructure is provisioned.

Answer

Run tasks

Answer

Cost estimation

Answer

Terraform validate

Question 14

A team uses Terraform with multiple workspaces and wants to automatically trigger a plan when a pull request is opened in their Git repository. They use Terraform Cloud. Which feature enables this?

Accepted Answer

VCS-driven workflow. The VCS-driven workflow in Terraform Cloud automatically triggers a plan when a pull request is opened in a connected Git repository. This is configured by linking a VCS provider (e.g., GitHub, GitLab) to a workspace and enabling speculative plans on pull requests, which allows Terraform Cloud to run a plan without applying changes.

Answer

API-driven workflow

Answer

CLI-driven workflow

Answer

Registry-driven workflow

Question 15

A company has a Terraform configuration that creates many AWS resources. They want to check the estimated cost of the plan before applying. Which approach should they use?

Accepted Answer

Enable cost estimation in Terraform Cloud.. Terraform Cloud provides a built-in cost estimation feature that analyzes the resources in a plan against current cloud provider pricing APIs to estimate monthly costs. This is the recommended approach because it is integrated directly into the Terraform workflow and does not require manual parsing or external scripts. Option C is correct because it leverages Terraform Cloud's native capability to estimate costs before applying.

Answer

Use 'terraform plan -cost' command.

Answer

Manually use 'terraform show -json' and parse pricing.

Answer

Use 'terraform validate' with a custom script.