TF-003 Use Terraform outside the core workflow Practice Test 5 — 15 Questions

Question 1

A team using a remote S3 backend with DynamoDB locking is experiencing frequent 'Error acquiring the state lock' messages in their CI/CD pipeline. The pipeline runs multiple concurrent jobs for different workspaces. What is the most likely cause and solution?

Accepted Answer

The same workspace is being used for concurrent runs; use separate workspaces per environment.. The error 'Error acquiring the state lock' occurs when Terraform cannot obtain a lock on the state file for a specific workspace. In this scenario, the pipeline runs multiple concurrent jobs for different workspaces, but if the same workspace is inadvertently used across concurrent runs, Terraform's DynamoDB-based locking mechanism will prevent simultaneous access to that workspace's state. The solution is to ensure each environment (e.g., dev, staging, prod) uses a separate workspace, avoiding lock contention. Option B correctly identifies this as the most likely cause and solution.

Answer

The DynamoDB table lacks sufficient read/write capacity; increase it.

Answer

The pipeline is running too many jobs; increase the lock wait time.

Answer

The S3 bucket is not versioned; enable versioning.

Question 2

A developer wants to use Terraform in a CI pipeline where the pipeline runs on pull requests. They need to preview infrastructure changes without applying them. Which command should be used?

Accepted Answer

terraform plan. Option A is correct because `terraform plan` creates an execution plan that shows what actions Terraform will take to change infrastructure to match the configuration, without actually applying any changes. This is the standard command for previewing infrastructure changes in a CI pipeline triggered by pull requests, enabling developers to review proposed modifications before merging.

Answer

terraform validate

Answer

terraform init

Answer

terraform apply

Question 3

A company uses Terraform Cloud and wants to enforce policy checks before any apply. They have a set of Sentinel policies. Where should they configure these policies to run automatically on all runs?

Accepted Answer

Create a Policy Set in Terraform Cloud and attach to workspaces.. Option B is correct because Policy Sets in Terraform Cloud are managed at organization or workspace level. Option A is wrong because sentinel apply is not a command. Option C is wrong because Terraform Enterprise is on-prem, not cloud. Option D is wrong because VCS integration is for triggering runs, not policies.

Answer

In the terraform apply command with -policy flag.

Answer

Configure a webhook in the VCS to run policy checks.

Answer

Deploy a Terraform Enterprise instance with custom policy.

Question 4

During a CI/CD pipeline run, terraform apply fails halfway through due to a network error. The state file is locked. The team wants to resume from the last successful apply. What should they do?

Accepted Answer

Re-run terraform apply after solving the network issue; Terraform will handle partial state.. Option C is correct because `terraform apply -lock=false` is dangerous and not recommended. The correct approach is to fix the issue, then re-run `terraform apply` which will attempt to apply the remaining resources because state knows what was already created. Option A is wrong because forcing unlock without investigation can corrupt state. Option B is wrong because destroy will remove partially created resources. Option D is wrong because manual deletion is error-prone.

Answer

Run terraform destroy and then reapply.

Answer

Force unlock the state and then reapply.

Answer

Manually delete the partially created resources in the cloud console and reapply.

Question 5

A team is migrating from using local state to a remote backend for collaboration. They want to ensure that team members cannot overwrite each other's changes. Which feature should they enable?

Accepted Answer

State locking (e.g., DynamoDB). State locking prevents concurrent modifications by ensuring that only one operation can modify the Terraform state at a time. When using a remote backend like S3 with DynamoDB, Terraform acquires a lock before writing to the state file and releases it after completion, preventing race conditions and state corruption.

Answer

S3 bucket versioning

Answer

Force unlock command

Answer

Workspace isolation

Question 6

An organization uses Terraform to provision infrastructure and then Ansible to configure it. They want to pass dynamic IP addresses from Terraform to Ansible. What is a recommended approach?

Accepted Answer

Use terraform output -json and parse it in Ansible as an inventory.. Option B is correct because Terraform can output values as JSON and Ansible can read them. Option A is wrong because environment variables are not suitable for complex data. Option C is wrong because remote state data source is for other Terraform workspaces, not Ansible. Option D is wrong because consul kv store adds unnecessary complexity.

Answer

Use environment variables in the pipeline to pass IP addresses.

Answer

Use the terraform_remote_state data source in a dummy Terraform configuration.

Answer

Store outputs in Consul KV store and have Ansible read from there.

Question 7

A team has a monolithic Terraform configuration managing multiple AWS accounts. They want to decompose it into smaller configurations that can be managed independently. What is the recommended strategy?

Accepted Answer

Split the configuration into separate directories per account and resource type, and use remote state sharing.. Option D is correct because splitting by account and resource type into separate workspaces or directories is a common pattern. Option A is wrong because using a single configuration with many workspaces still has tight coupling. Option B is wrong because pulling all into one module increases complexity. Option C is wrong because Terraform Cloud workspaces alone do not decompose the code.

Answer

Use Terraform workspaces to separate environments within the same configuration.

Answer

Create a single super-module that contains all resources.

Answer

Move everything to Terraform Cloud and use different workspaces.

Question 8

Which TWO of the following are benefits of using Terraform Cloud Run Tasks?

Accepted Answer

Integrate with third-party tools for security scanning.. Options A and C are correct. Run Tasks allow integration with third-party tools during the plan/apply phase (A), and they can enforce compliance checks before approval (C). Option B is wrong because run tasks don't directly avoid costs. Option D is wrong because they don't simplify state management. Option E is wrong because approval is separate.

Answer

Simplify state management by offloading to Terraform Cloud.

Answer

Provide an approval gate for manual intervention.

Answer

Automatically reduce costs by identifying unused resources.

Question 9

Which THREE of the following are necessary steps to configure OIDC (OpenID Connect) for authenticating Terraform in a CI/CD pipeline?

Accepted Answer

Set up an OIDC provider in the target cloud (e.g., AWS IAM OIDC provider).. Option B is correct because to authenticate Terraform in a CI/CD pipeline using OIDC, you must first establish trust between the CI platform and the cloud provider by creating an OIDC identity provider (e.g., an AWS IAM OIDC provider). This provider validates the JSON Web Token (JWT) issued by the CI platform (e.g., GitHub Actions, GitLab CI) and maps it to an IAM role, enabling token-based authentication without long-lived secrets.

Answer

Generate a long-lived API token and store it as a secret.

Answer

Configure remote backend with static credentials.

Question 10

Which TWO of the following are valid ways to pass variables to Terraform in an automated pipeline?

Accepted Answer

Creating a .tfvars file and referencing it with -var-file.. Option A is correct because `-var-file` allows you to pass a `.tfvars` file containing variable definitions, which is ideal for automated pipelines where you want to load multiple variables from a version-controlled or dynamically generated file without manual interaction. This approach supports repeatable, non-interactive deployments.

Answer

Using interactive prompts during terraform apply.

Answer

Setting environment variables with prefix TERRAFORM_.

Answer

Using the -vars flag to pass JSON string.

Question 11

A company uses Terraform with remote state stored in an S3 bucket. An operator accidentally runs 'terraform destroy' on a production workspace and wants to recover the state before the operation. What is the best course of action?

Accepted Answer

Restore the state file from the S3 bucket's versioning if enabled.. Option B is correct because S3 versioning allows restoring previous versions of the state file. Option A is wrong because DynamoDB is used for locking, not state storage. Option C is wrong because terraform state pull would retrieve the current (post-destroy) state. Option D is wrong because re-running apply would attempt to recreate resources using the current state, which is empty.

Answer

Re-run 'terraform apply' to recreate resources.

Answer

Restore the state file from a DynamoDB backup.

Answer

Use 'terraform state pull' to retrieve the last known state.

Question 12

A DevOps engineer is troubleshooting a failed 'terraform plan' command. The error message is: 'Error: Error acquiring the state lock' followed by a message that the lock is held by another process. The team uses Terraform Cloud with remote state. Which of the following is the most likely cause and correct resolution?

Accepted Answer

Identify the lock holder via Terraform Cloud UI and use 'terraform force-unlock' to release it.. Option D is correct because the state lock in Terraform Cloud is held by another run or process; using the 'force-unlock' command with the correct lock ID from the Terraform Cloud UI can release it. Option A is wrong because there is no such option on the apply command. Option B is wrong because waiting may be indefinite if the lock is stuck. Option C is wrong because you cannot disable locking in Terraform Cloud.

Answer

Disable state locking in the backend configuration.

Answer

Wait for the lock to be released automatically.

Answer

Add the '-lock=false' flag to the plan command.

Question 13

Which Terraform command is used to bring existing infrastructure that was created outside of Terraform under Terraform management?

Accepted Answer

terraform import. Option A is correct because 'terraform import' is specifically designed to import existing infrastructure into Terraform state. Option B is wrong because 'terraform state push' is for manually updating state. Option C is wrong because 'terraform apply' creates resources, not imports. Option D is wrong because 'terraform refresh' updates state but does not import new resources.

Answer

terraform state push

Answer

terraform apply

Answer

terraform refresh

Question 14

A team uses Terraform workspaces to manage multiple environments (dev, staging, prod). They are currently in the 'dev' workspace and want to run a plan for the 'staging' workspace without switching workspaces. Which command sequence should they use?

Accepted Answer

terraform workspace select staging && terraform plan. Option C is correct because you must select the workspace first with 'terraform workspace select staging' and then run plan. Option A is wrong because '-workspace' is not a valid flag. Option B is wrong because the variable approach does not change workspace. Option D is wrong because 'terraform plan -state=staging.tfstate' does not switch workspaces.

Answer

terraform plan -workspace=staging

Answer

terraform plan -var=workspace=staging

Answer

terraform plan -state=staging.tfstate

Question 15

An organization uses Terraform Cloud with a VCS-backed workspace connected to a GitHub repository. They want to trigger a speculative plan without creating a run (i.e., without costing compute resources or being displayed in the workspace). Which approach is appropriate?

Accepted Answer

Run 'terraform plan' from a local CLI configured with the same workspace and a remote backend.. Option B is correct because running 'terraform plan' from a local CLI that is configured with the same workspace and a remote backend will produce a speculative plan that is displayed locally and does not create a run in Terraform Cloud by default. Option A is wrong because VCS pushes create formal runs. Option C is wrong because the API creates runs. Option D is wrong because there is no built-in '--speculative' flag.

Answer

Push a new commit to the GitHub repository with a 'plan' label.

Answer

Use the 'plan -out' flag with a special path to avoid creating a run.

Answer

Use the Terraform Cloud API to queue a plan with 'auto-apply' disabled.