TF-004 Use Terraform outside the core workflow Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are valid ways to use Terraform outside the core workflow (i.e., in automation or CI/CD pipelines)?

Accepted Answer

Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.. The Terraform CLI's `-auto-approve` flag is designed for non-interactive environments like CI/CD pipelines, allowing automated execution of `terraform apply` after a successful plan without manual confirmation. This bypasses the interactive approval step, making it suitable for automation where human input is not possible.

Answer

Using 'terraform state mv' to reorganize state files.

Answer

Using 'terraform init -from-module' to force module re-download.

Answer

Using 'terraform graph' to generate visual output.

Question 2

Which THREE of the following are best practices for Terraform state management?

Accepted Answer

Use workspaces to manage different environments.. Terraform workspaces allow you to manage multiple distinct state files for the same configuration, enabling environment separation (e.g., dev, staging, prod) without duplicating code or backends. Each workspace maintains its own state, preventing cross-environment interference and simplifying infrastructure lifecycle management.

Answer

Manually edit state files to fix configuration drift.

Answer

Commit state files to version control.

Question 3

Which TWO are valid methods to import existing infrastructure into Terraform?

Accepted Answer

Run 'terraform import' with the resource address and ID.. `terraform import` is the primary command for bringing existing infrastructure under Terraform management. It requires both the resource address (as defined in your configuration) and the provider-specific ID of the real-world object. This command maps the existing resource into the Terraform state, enabling subsequent `apply` operations to manage it.

Answer

Use 'terraform state rm' to remove existing state before running apply.

Answer

Use 'terraform console' to inspect and import.

Answer

Use 'terraform init -migrate-state' to import from another backend.

Question 4

Refer to the exhibit. A Terraform plan fails with the error shown. What is the most likely cause?

Accepted Answer

Another Terraform run is currently in progress.. The error message indicates that Terraform cannot acquire a state lock. This typically occurs when another Terraform run is already in progress and holds the lock on the state file. Terraform uses a locking mechanism (often via DynamoDB) to prevent concurrent modifications; if a lock is already held, subsequent runs will fail with this error until the lock is released or expires.

Answer

The S3 bucket does not have versioning enabled.

Answer

The DynamoDB table is not configured correctly.

Answer

The state file is corrupted.

Question 5

Refer to the exhibit. A team deploys this configuration. They run 'terraform apply' once and the instance is created. Later, they modify the instance type and run 'terraform apply' again. They notice the provisioner does not run on the second apply. Why?

Accepted Answer

Provisioners run only when the resource is created, not on subsequent updates.. Provisioners in Terraform are designed to run only during resource creation, not during subsequent updates. When the instance type is modified and 'terraform apply' is run again, Terraform updates the existing resource in place without triggering the provisioner again. This behavior is intentional because provisioners are typically used for initial setup tasks like bootstrapping, not for ongoing configuration changes.

Answer

Provisioners run only when the resource is destroyed.

Answer

The provisioner should be 'remote-exec' to run on updates.

Answer

The command syntax is incorrect.

Question 6

Refer to the exhibit. A Terraform Cloud plan includes an EC2 instance of type 't2.medium'. The team uses Sentinel policies. Which action should they take to proceed?

Accepted Answer

Change the instance type in the configuration to t2.micro or t2.small.. Sentinel policies enforce compliance rules, and if the policy explicitly denies 't2.medium', the team must modify their configuration to use an allowed instance type (e.g., t2.micro or t2.small) to pass the policy check. This aligns with the principle of infrastructure-as-code where policies are immutable guardrails, and the configuration must be adapted to meet them rather than bypassing the policy.

Answer

Modify the Sentinel policy to allow t2.medium.

Answer

Disable the policy check for this run.

Answer

Override the policy in the run using Terraform Cloud UI.

Question 7

A team needs to share a Terraform module across multiple projects within their organization. What is the best practice?

Accepted Answer

Use a remote module source such as a Git repository.. Using a remote module source such as a Git repository is the best practice because it allows the module to be versioned, centrally maintained, and consumed by multiple projects without duplication. Terraform's module system supports sources like Git, Mercurial, and HTTP URLs, enabling teams to pin specific versions via tags or refs, ensuring consistency across environments.

Answer

Copy the module code into each project's directory.

Answer

Use 'terraform state push' to share state.

Answer

Use workspace variables to store module code.

Question 8

A company uses Terraform with a remote backend (AWS S3). They want to ensure that the state file is encrypted at rest. Which configuration approach guarantees this?

Accepted Answer

Configure the S3 backend with server-side encryption enabled (e.g., 'encrypt = true' and 'kms_key_id').. The S3 backend configuration block supports the `encrypt` and `kms_key_id` arguments, which enable server-side encryption (SSE-S3 or SSE-KMS) for the state file stored in the S3 bucket. This ensures that the state file is encrypted at rest, meeting the requirement without any additional steps or external commands.

Answer

Enable encryption in the AWS provider block.

Answer

Use 'terraform state encrypt' command.

Answer

Use 'terraform init -encrypt-state' flag.

Question 9

A company wants to integrate Terraform with their CI/CD pipeline to automatically deploy infrastructure. Which Terraform feature should they use to ensure state files are stored securely and accessible by the pipeline?

Accepted Answer

Terraform Cloud remote state. Using a remote state backend (like Terraform Cloud) ensures state is stored securely and can be accessed by pipeline runs. Local state with .gitignore is not secure or accessible. Terraform import is for adding existing resources, not state storage. terraform state push is used to manually upload state.

Answer

Terraform import

Answer

Local state with .gitignore

Answer

terraform state push

Question 10

A team is using Terraform Cloud and wants to enforce that all AWS resources created by Terraform have a specific tag. Which feature should they use?

Accepted Answer

Sentinel policies. Sentinel policies are Terraform Cloud's policy-as-code framework that allows teams to enforce mandatory rules on infrastructure configurations before they are applied. By writing a Sentinel policy that checks for the presence and value of a specific tag on all AWS resources, the team can reject any run that does not comply, ensuring consistent tagging across all resources created by Terraform.

Answer

Cost estimation

Answer

Workspace variables

Answer

Run tasks

Question 11

Which Terraform command is used to validate the syntax of configuration files without accessing any cloud provider?

Accepted Answer

terraform validate. `terraform validate` checks syntax and internal consistency of configuration files. `init` initializes backends and providers, `plan` accesses remote state, `fmt` formats code.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform init

Question 12

A team uses an S3 backend with DynamoDB for state locking. They notice that sometimes terraform plan fails because the state is locked. What is the best practice to handle this in an automated pipeline?

Accepted Answer

Serialize pipeline runs to avoid concurrent execution. Serializing pipeline runs is the best practice to prevent concurrent Terraform operations from competing for the same state lock. When multiple pipeline jobs attempt to run `terraform plan` or `terraform apply` simultaneously, DynamoDB-based state locking ensures only one operation holds the lock at a time, causing the others to fail. By enforcing sequential execution (e.g., via CI/CD stage dependencies or a mutex), you avoid lock contention entirely without risking data corruption or bypassing safety mechanisms.

Answer

Use force-unlock before each plan

Answer

Increase the lock timeout

Answer

Use -lock=false in the pipeline

Question 13

An organization wants to use Terraform to manage resources across multiple accounts and regions, with different team members responsible for different environments. Which Terraform feature helps separate state and configuration for each environment?

Accepted Answer

Workspaces. Workspaces in Terraform allow you to manage multiple distinct sets of infrastructure resources (state files) within the same configuration. By using separate workspaces for each environment (e.g., dev, staging, prod), you can isolate state and configuration without duplicating code, making it the correct feature for this multi-environment scenario.

Answer

Providers

Answer

Modules

Answer

Backends

Question 14

A developer wants to see the list of resources currently managed by Terraform in the state file. Which command should they use?

Accepted Answer

terraform state list. `terraform state list` is the dedicated command to list all resources tracked in the Terraform state file. It reads the state directly and outputs the resource addresses (e.g., `aws_instance.web`), giving the developer a clear view of what Terraform currently manages.

Answer

terraform graph

Answer

terraform output

Answer

terraform show

Question 15

A company uses Terraform Cloud and wants to ensure that only approved modules from the private registry are used in configurations. How can they enforce this?

Accepted Answer

Use Sentinel policies to check module sources. Sentinel is HashiCorp's policy-as-code framework that can enforce governance rules on Terraform Cloud runs. By writing a Sentinel policy that inspects the `module` block's `source` attribute, you can restrict configurations to only use modules from the approved private registry, rejecting any run that references external or unapproved sources.

Answer

Restrict module sources in VCS

Answer

Configure workspace variables to limit module paths

Answer

Use run tasks to scan for module types