TF-003 Use Terraform outside the core workflow Practice Test 4 — 15 Questions

Question 1

A Terraform practitioner wants to ensure that the access keys used by a provider are not visible in plan output. Which Terraform attribute should be used when defining the provider?

Accepted Answer

sensitive. The `sensitive` attribute on provider configuration (via variables) prevents values from being displayed in CLI output, including plan output. There is no `secret` or `hidden` attribute. `encrypted` is not a Terraform attribute for this purpose.

Answer

encrypted

Answer

hidden

Answer

secret

Question 2

Which Terraform command is used to validate the syntax of configuration files without accessing any cloud provider?

Accepted Answer

terraform validate. `terraform validate` checks syntax and internal consistency of configuration files. `init` initializes backends and providers, `plan` accesses remote state, `fmt` formats code.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform init

Question 3

A team uses an S3 backend with DynamoDB for state locking. They notice that sometimes terraform plan fails because the state is locked. What is the best practice to handle this in an automated pipeline?

Accepted Answer

Serialize pipeline runs to avoid concurrent execution. The best practice is to prevent concurrent runs by serializing pipeline execution. Using -lock=false disables locking entirely, increasing lock timeout may help but doesn't address the root cause. force-unlock should only be used when the lock holder is known to have failed.

Answer

Use force-unlock before each plan

Answer

Increase the lock timeout

Answer

Use -lock=false in the pipeline

Question 4

An organization wants to use Terraform to manage resources across multiple accounts and regions, with different team members responsible for different environments. Which Terraform feature helps separate state and configuration for each environment?

Accepted Answer

Workspaces. Workspaces allow multiple state files within the same backend, isolating environments. Modules organize code but don't separate state. Providers define connectivity to cloud providers. Backends store state but don't inherently separate environments.

Answer

Providers

Answer

Modules

Answer

Backends

Question 5

A developer wants to see the list of resources currently managed by Terraform in the state file. Which command should they use?

Accepted Answer

terraform state list. `terraform state list` lists all resources in the state. `output` shows outputs, `show` shows state or plan details, `graph` creates a dependency graph.

Answer

terraform graph

Answer

terraform output

Answer

terraform show

Question 6

A company uses Terraform Cloud and wants to ensure that only approved modules from the private registry are used in configurations. How can they enforce this?

Accepted Answer

Use Sentinel policies to check module sources. Sentinel policies can inspect module declarations and block runs if modules come from unapproved sources. VCS restrictions are not always effective. Run tasks and workspace variables do not directly control module sources.

Answer

Restrict module sources in VCS

Answer

Configure workspace variables to limit module paths

Answer

Use run tasks to scan for module types

Question 7

A Terraform configuration uses a module from the public registry. After a provider update, the module's resources fail to create. What is the most probable cause?

Accepted Answer

The module is incompatible with the new provider version. Provider updates often introduce breaking changes, and modules may rely on older provider features. Incompatibility with a new provider version can cause failures. Other options are less likely.

Answer

The provider binary is corrupted

Answer

The state file is corrupted

Answer

The backend configuration is incorrect

Question 8

Which TWO of the following are best practices when using Terraform in a CI/CD pipeline? (Choose two.)

Accepted Answer

Use version control for configurations. Remote state with locking ensures consistency and prevents corruption. Version control tracks changes. Storing state in source repo is not secure. Auto-applying after plan is risky without approval. terraform import is for importing existing resources, not a CI/CD best practice.

Answer

Run terraform apply automatically after plan

Answer

Store state in the source repository

Answer

Use terraform import to manage existing resources

Question 9

Which THREE of the following are capabilities of Terraform Cloud's Sentinel policy framework? (Choose three.)

Accepted Answer

Enforce that resources have mandatory tags. Sentinel can enforce tags, restrict resource types, and check compliance. Cost estimation is a separate feature. Time-based blocking is not a built-in Sentinel capability.

Answer

Block Terraform runs based on the time of day

Answer

Estimate the cost of infrastructure changes

Question 10

Which TWO of the following are valid methods for importing existing infrastructure into Terraform management? (Choose two.)

Accepted Answer

Use a third-party tool like Terraformer to generate configuration. The typical method is to write configuration and run terraform import. Third-party tools can generate configuration from existing resources. terraform import requires configuration beforehand. terraform state push is not for importing; it pushes a state file. terraform apply would try to create new resources.

Answer

Use terraform apply directly on existing resources

Answer

Use terraform state push to manually add state entries

Answer

Use terraform import without any prior configuration

Question 11

Refer to the exhibit. The user runs 'terraform plan' and sees that Terraform wants to create the instance. However, the instance already exists in the AWS account with the same configuration. What is the most likely reason?

Accepted Answer

The instance is not in the Terraform state. Terraform tracks resources in its state file. If the existing instance is not in the state, Terraform will plan to create it. The AMI and instance type are the same, so changes in them wouldn't cause a create.

Answer

The instance type has changed

Answer

The AMI ID has changed

Answer

The provider version is different

Question 12

Refer to the exhibit. A user encounters this error while running 'terraform plan'. What is the best course of action?

Accepted Answer

Run 'terraform force-unlock' with the lock ID after verifying no other process holds the lock. The lock appears to be stale (operation type invalid). After verifying that no other process is using Terraform, force-unlock is the appropriate action. Deleting state is dangerous. Waiting might work but is not best practice. Changing backend could cause state mismatch.

Answer

Change the backend to local and run plan again

Answer

Delete the state file and run terraform init

Answer

Wait for 5 minutes and retry

Question 13

Refer to the exhibit. Which command was most likely executed?

Accepted Answer

terraform init. "Initializing modules" is part of terraform init. terraform get also downloads modules but does not initialize backends and providers. terraform plan and apply do not download modules.

Answer

terraform apply

Answer

terraform plan

Answer

terraform get

Question 14

A DevOps team is integrating Terraform into a CI/CD pipeline using Jenkins. They want to ensure that the pipeline fails if the Terraform plan contains destructive changes. Which approach best achieves this?

Accepted Answer

Run terraform plan -detailed-exitcode and fail pipeline if exit code is 2.. Option D is correct because `terraform plan -detailed-exitcode` returns exit code 2 if there are changes, allowing pipeline failure. Option A is wrong because `terraform validate` only checks syntax. Option B is wrong because `terraform apply` will apply changes, not just fail on destructive ones. Option C is wrong because `terraform destroy` destroys resources, not suitable.

Answer

Run terraform apply and parse the output for destroy messages.

Answer

Run terraform validate and check output for errors.

Answer

Run terraform destroy --target and fail if any resources are destroyed.

Question 15

An organization uses Terraform Cloud and wants to automate run triggers when a new version of a module is published in a private module registry. What is the recommended method?

Accepted Answer

Configure a webhook in the private module registry to notify Terraform Cloud.. Option A is correct because Terraform Cloud has a webhook integration to trigger runs on registry events. Option B is wrong because API calls would require polling. Option C is wrong because GitOps requires code changes. Option D is wrong because scheduler is not event-driven.

Answer

Create a Git repository with versioned modules and use GitOps.

Answer

Schedule terraform plan to run periodically via cron.

Answer

Use the Terraform Cloud API to poll the registry for new versions.