TF-004 Use Terraform outside the core workflow Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are valid methods for importing existing infrastructure into Terraform management? (Choose two.)

Accepted Answer

Use a third-party tool like Terraformer to generate configuration. Option B is correct because Terraformer is a real third-party tool that reads existing cloud infrastructure via provider APIs and generates both Terraform configuration files and matching state, letting you bring resources under management without hand-writing everything. Option D is correct because the canonical native workflow is to write the resource block in your configuration first, then run terraform import

so Terraform maps the existing object into state and subsequent plans reconcile it. Option A is wrong because terraform apply only creates or updates resources described in configuration and state; it cannot discover or adopt pre-existing infrastructure. Option C is wrong because terraform state push writes a state file you supply, which is a state-manipulation operation, not a supported import mechanism, and it does not generate configuration. Option E is wrong because terraform import requires the target resource address to already exist in configuration (in modern Terraform), so importing without prior configuration fails or leaves the resource unmanaged in config.

Answer

Use terraform apply directly on existing resources

Answer

Use terraform state push to manually add state entries

Answer

Use terraform import without any prior configuration

Question 2

Refer to the exhibit. The user runs 'terraform plan' and sees that Terraform wants to create the instance. However, the instance already exists in the AWS account with the same configuration. What is the most likely reason?

Accepted Answer

The instance is not in the Terraform state. Terraform determines whether to create, update, or destroy resources by comparing the desired configuration in the .tf files against the current state stored in the state file. If the instance already exists in AWS but is not recorded in the Terraform state, Terraform has no knowledge of it and will plan to create a new resource. This is the most likely reason because the instance is present in the account but absent from the state, causing Terraform to treat it as a new resource.

Answer

The instance type has changed

Answer

The AMI ID has changed

Answer

The provider version is different

Question 3

Refer to the exhibit. A user encounters this error while running 'terraform plan'. What is the best course of action?

Accepted Answer

Run 'terraform force-unlock' with the lock ID after verifying no other process holds the lock. The error indicates that the state file is locked, which prevents concurrent operations to avoid corruption. Running 'terraform force-unlock' with the lock ID is the correct recovery step, but only after verifying that no other Terraform process is actively using the state. This command releases the lock from the backend (e.g., S3, Consul, or Terraform Cloud), allowing subsequent plans or applies to proceed.

Answer

Change the backend to local and run plan again

Answer

Delete the state file and run terraform init

Answer

Wait for 5 minutes and retry

Question 4

Refer to the exhibit. Which command was most likely executed?

Accepted Answer

terraform init. The exhibit shows Terraform downloading and installing provider plugins (e.g., hashicorp/aws) and initializing the backend configuration. This is the exact behavior of `terraform init`, which prepares the working directory for other commands by ensuring all required providers and modules are available.

Answer

terraform apply

Answer

terraform plan

Answer

terraform get

Question 5

A DevOps team is integrating Terraform into a CI/CD pipeline using Jenkins. They want to ensure that the pipeline fails if the Terraform plan contains destructive changes. Which approach best achieves this?

Accepted Answer

Run terraform plan -detailed-exitcode and fail pipeline if exit code is 2.. `terraform plan -detailed-exitcode` returns exit code 2 when there are any changes, including destructive changes. While it does not specifically detect only destructive changes, failing on any changes ensures that destructive changes are caught before apply, which is a common safety practice in CI/CD pipelines. Options A, B, and C are incorrect because A requires applying changes first, B does not detect changes, and C would actually destroy resources.

Answer

Run terraform apply and parse the output for destroy messages.

Answer

Run terraform validate and check output for errors.

Answer

Run terraform destroy --target and fail if any resources are destroyed.

Question 6

An organization uses Terraform Cloud and wants to automate run triggers when a new version of a module is published in a private module registry. What is the recommended method?

Accepted Answer

Configure a webhook in the private module registry to notify Terraform Cloud.. Terraform Cloud supports webhook notifications from private module registries. When a new module version is published, the registry can send an HTTP POST payload to a configured webhook URL in Terraform Cloud, which triggers a run in the associated workspace. This eliminates the need for polling or manual intervention, aligning with Terraform Cloud's event-driven automation model.

Answer

Create a Git repository with versioned modules and use GitOps.

Answer

Schedule terraform plan to run periodically via cron.

Answer

Use the Terraform Cloud API to poll the registry for new versions.

Question 7

A team using a remote S3 backend with DynamoDB locking is experiencing frequent 'Error acquiring the state lock' messages in their CI/CD pipeline. The pipeline runs multiple concurrent jobs for different workspaces. What is the most likely cause and solution?

Accepted Answer

The same workspace is being used for concurrent runs; use separate workspaces per environment.. The error 'Error acquiring the state lock' occurs when Terraform cannot obtain a lock on the state file for a specific workspace. In this scenario, the pipeline runs multiple concurrent jobs for different workspaces, but if the same workspace is inadvertently used across concurrent runs, Terraform's DynamoDB-based locking mechanism will prevent simultaneous access to that workspace's state. The solution is to ensure each environment (e.g., dev, staging, prod) uses a separate workspace, avoiding lock contention. Option B correctly identifies this as the most likely cause and solution.

Answer

The DynamoDB table lacks sufficient read/write capacity; increase it.

Answer

The pipeline is running too many jobs; increase the lock wait time.

Answer

The S3 bucket is not versioned; enable versioning.

Question 8

A developer wants to use Terraform in a CI pipeline where the pipeline runs on pull requests. They need to preview infrastructure changes without applying them. Which command should be used?

Accepted Answer

terraform plan. `terraform plan` creates an execution plan that shows what actions Terraform will take to change infrastructure to match the configuration, without actually applying any changes. This is the standard command for previewing infrastructure changes in a CI pipeline triggered by pull requests, enabling developers to review proposed modifications before merging.

Answer

terraform validate

Answer

terraform init

Answer

terraform apply

Question 9

A company uses Terraform Cloud and wants to enforce policy checks before any apply. They have a set of Sentinel policies. Where should they configure these policies to run automatically on all runs?

Accepted Answer

Create a Policy Set in Terraform Cloud and attach to workspaces.. Terraform Cloud uses Policy Sets to group Sentinel policies and enforce them automatically on all runs for attached workspaces. When a Policy Set is associated with one or more workspaces, the policies are evaluated during the plan phase before any apply, blocking the run if any policy fails. This is the native mechanism in Terraform Cloud for automated policy enforcement without manual intervention.

Answer

In the terraform apply command with -policy flag.

Answer

Configure a webhook in the VCS to run policy checks.

Answer

Deploy a Terraform Enterprise instance with custom policy.

Question 10

During a CI/CD pipeline run, terraform apply fails halfway through due to a network error. The state file is locked. The team wants to resume from the last successful apply. What should they do?

Accepted Answer

Re-run terraform apply after solving the network issue; Terraform will handle partial state.. Terraform's state file tracks all managed resources and their current status. When `terraform apply` fails mid-run, the state is locked to prevent corruption, but Terraform records any resources that were successfully created before the failure. After resolving the network issue, re-running `terraform apply` will use the existing state to detect already-created resources and continue from where it left off, creating only the remaining resources. This is the correct and intended workflow for handling partial state in Terraform.

Answer

Run terraform destroy and then reapply.

Answer

Force unlock the state and then reapply.

Answer

Manually delete the partially created resources in the cloud console and reapply.

Question 11

A team is migrating from using local state to a remote backend for collaboration. They want to ensure that team members cannot overwrite each other's changes. Which feature should they enable?

Accepted Answer

State locking (e.g., DynamoDB). State locking prevents concurrent modifications by ensuring that only one operation can modify the Terraform state at a time. When using a remote backend like S3 with DynamoDB, Terraform acquires a lock before writing to the state file and releases it after completion, preventing race conditions and state corruption.

Answer

S3 bucket versioning

Answer

Force unlock command

Answer

Workspace isolation

Question 12

A team has a monolithic Terraform configuration managing multiple AWS accounts. They want to decompose it into smaller configurations that can be managed independently. What is the recommended strategy?

Accepted Answer

Split the configuration into separate directories per account and resource type, and use remote state sharing.. Splitting a monolithic Terraform configuration into separate directories per account and resource type, combined with remote state sharing, enables independent management of each configuration while allowing them to consume outputs from one another via `terraform_remote_state` data sources. This approach aligns with the recommended practice of using separate root modules for distinct environments or accounts, avoiding tight coupling and state lock contention.

Answer

Use Terraform workspaces to separate environments within the same configuration.

Answer

Create a single super-module that contains all resources.

Answer

Move everything to Terraform Cloud and use different workspaces.

Question 13

Which TWO of the following are benefits of using Terraform Cloud Run Tasks?

Accepted Answer

Integrate with third-party tools for security scanning.. Terraform Cloud Run Tasks allow integration with third-party tools for security scanning, policy enforcement, or other validations during the plan/apply lifecycle. This is achieved by configuring run tasks that call external services via webhooks, enabling automated checks before provisioning proceeds.

Answer

Simplify state management by offloading to Terraform Cloud.

Answer

Provide an approval gate for manual intervention.

Answer

Automatically reduce costs by identifying unused resources.

Question 14

Which THREE of the following are necessary steps to configure OIDC (OpenID Connect) for authenticating Terraform in a CI/CD pipeline?

Accepted Answer

Set up an OIDC provider in the target cloud (e.g., AWS IAM OIDC provider).. To authenticate Terraform in a CI/CD pipeline using OIDC, you must first establish trust between the CI platform and the cloud provider by creating an OIDC identity provider (e.g., an AWS IAM OIDC provider). This provider validates the JSON Web Token (JWT) issued by the CI platform (e.g., GitHub Actions, GitLab CI) and maps it to an IAM role, enabling token-based authentication without long-lived secrets.

Answer

Generate a long-lived API token and store it as a secret.

Answer

Configure remote backend with static credentials.

Question 15

Which TWO of the following are valid ways to pass variables to Terraform in an automated pipeline?

Accepted Answer

Creating a .tfvars file and referencing it with -var-file.. Option A is correct because Terraform supports variable definition files (commonly with a .tfvars or .tfvars.json extension), and you can explicitly load one with the -var-file flag, e.g. terraform apply -var-file="prod.tfvars", which is ideal for automated pipelines where the file is committed or generated by the CI/CD system. Option C is correct because the -var flag lets you pass individual input variables directly on the command line, e.g. terraform apply -var="instance_type=t3.micro", which works non-interactively and is therefore suitable for pipeline execution. Option B is not valid for automation because interactive prompts require a human to type values at the terminal, which defeats unattended pipeline runs. Option D is incorrect because Terraform reads input variables from environment variables prefixed with TF_VAR_, not TERRAFORM_. Option E is incorrect because there is no -vars flag in Terraform; the correct flags are -var and -var-file.

Answer

Using interactive prompts during terraform apply.

Answer

Setting environment variables with prefix TERRAFORM_.

Answer

Using the -vars flag to pass JSON string.