TF-003 Use Terraform outside the core workflow — Timed 20 Questions

Question 1

A developer runs `terraform plan` and it fails with a provider plugin error. Which command should they run first to resolve the issue?

Accepted Answer

terraform init. The `terraform init` command is the correct first step because it initializes the working directory, downloads the required provider plugins, and sets up the backend configuration. A provider plugin error typically indicates that the provider plugins are missing, outdated, or not properly installed, and `terraform init` resolves this by fetching the correct versions from the Terraform registry.

Answer

terraform validate

Answer

terraform apply

Answer

terraform fmt

Question 2

A team uses Terraform Cloud for remote state management. They want to ensure that state file changes are only made through the Terraform Cloud API and not through direct access to the storage backend. Which feature should they enable?

Accepted Answer

Sentinel policy enforcement. Option A is correct because Sentinel policy enforcement allows the team to define rules that restrict direct modifications to the state file in the storage backend, ensuring that all state changes must go through the Terraform Cloud API. This prevents bypassing Terraform Cloud's access controls and audit logging, which is essential for maintaining integrity and compliance in remote state management.

Answer

Remote state locking

Answer

VCS integration

Answer

Team tokens

Question 3

A company uses Terraform with multiple cloud providers and wants to integrate with their existing CI/CD pipeline. They need to enforce that all infrastructure changes go through code review and automated testing before being applied to production. Which approach best meets these requirements?

Accepted Answer

Configure Terraform Cloud with run triggers and policy checks. Option B is correct because Terraform Cloud's run triggers and policy checks (e.g., Sentinel) enforce that all infrastructure changes must pass code review and automated testing before being applied. This integrates directly with the CI/CD pipeline by requiring a pull request to trigger a plan, which is then reviewed and approved via Terraform Cloud's governance controls, ensuring no change reaches production without validation.

Answer

Store state in a remote backend and use terraform apply in the pipeline

Answer

Use the Terraform CLI in the CI/CD pipeline with remote state

Answer

Run terraform apply locally after manual approval

Question 4

An operator runs `terraform apply` and receives an error that the state file is locked. What is the most likely cause?

Accepted Answer

Another user is running a Terraform operation. Option C is correct because Terraform uses a state locking mechanism (typically via a backend like S3 with DynamoDB, or Consul) to prevent concurrent operations from corrupting the state file. When another user or process is running a Terraform operation (e.g., `apply`, `plan`, `destroy`), the lock is held, and any subsequent `terraform apply` will fail with a 'state file is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The state file is outdated and needs refresh

Answer

The configuration has a syntax error

Answer

The user lacks write permissions to the state file

Question 5

An organization wants to use Terraform to manage infrastructure in multiple environments (dev, staging, prod) with the same configuration but different variable values. Which approach should they use?

Accepted Answer

Use Terraform workspaces and separate variable files. Terraform workspaces allow you to manage multiple distinct sets of infrastructure resources within the same configuration by maintaining separate state files. By combining workspaces with separate variable definition files (e.g., `dev.tfvars`, `prod.tfvars`), you can reuse the same configuration code while applying environment-specific variable values, avoiding duplication and ensuring consistency across environments.

Answer

Create separate directories with duplicated configurations

Answer

Use a single state file with environment variables

Answer

Use different versions of Terraform for each environment

Question 6

A team uses Terraform Cloud with a VCS-backed workflow. They notice that a recent commit triggered a run that failed because of an invalid configuration. The team fixed the configuration and wants to re-run the plan without committing again. Which action should they take?

Accepted Answer

Use the 'Queue Plan' button in the Terraform Cloud UI. Option C is correct because the 'Queue Plan' button in Terraform Cloud allows you to trigger a new speculative plan for the same commit without modifying the VCS history or creating a new commit. This is the intended workflow for re-running a plan after fixing configuration errors in a VCS-backed workspace, as it uses the existing commit but re-evaluates the configuration.

Answer

Amend the previous commit and force push

Answer

Create a new commit with the fix

Answer

Run terraform plan locally and apply

Question 7

A user wants to see the current state of resources in a human-readable format without making changes. Which command should they use?

Accepted Answer

terraform show. Option D, `terraform show`, is correct because it displays the current state of managed resources in a human-readable format (defaulting to plain text) without making any changes. This command reads the state file directly and presents its contents, making it ideal for inspection and debugging. Unlike `terraform plan`, it does not generate an execution plan or propose modifications.

Answer

terraform output

Answer

terraform state list

Answer

terraform plan

Question 8

A company wants to use Terraform to manage resources across AWS and Azure. They need a single workflow that can apply changes to both providers. What is the best practice?

Accepted Answer

Define both providers in a single configuration. Option D is correct because Terraform allows multiple providers to be defined in a single configuration, enabling a unified workflow to manage resources across AWS and Azure. By declaring both providers in the same root module, a single `terraform apply` can create, update, or destroy resources from both clouds in the correct order, leveraging Terraform's dependency graph to handle cross-provider dependencies. This is the recommended best practice for multi-cloud management with a single workflow.

Answer

Use separate Terraform configurations for each provider

Answer

Use Terraform Cloud workspaces with different providers

Answer

Use Terraform workspaces to separate providers

Question 9

During a `terraform apply`, the operation fails mid-way due to a network outage, leaving some resources created. The operator wants to resume applying from where it left off without destroying the already-created resources. What should they do?

Accepted Answer

Run terraform apply again. Option A is correct because Terraform uses a state file to track the resources it manages. When `terraform apply` fails mid-way, the state file is updated to reflect the resources that were successfully created. Running `terraform apply` again will cause Terraform to compare the current state with the configuration, detect that the already-created resources exist, and proceed to create only the remaining resources, effectively resuming from where it left off without destroying anything.

Answer

Run terraform destroy and then apply

Answer

Run terraform refresh

Answer

Run terraform apply -auto-approve

Question 10

Which TWO of the following are valid use cases for using Terraform Cloud's Sentinel policies? (Choose two.)

Accepted Answer

Enforce that all AWS instances are of a specific type. Option C is correct because Sentinel policies can enforce that all AWS instances are of a specific type by using a `validate` rule that checks the `aws_instance` resource's `instance_type` attribute against an allowed list. This is a common compliance use case for Sentinel in Terraform Cloud, where policy-as-code ensures infrastructure adheres to organizational standards before provisioning.

Answer

Provide cost estimates for infrastructure changes

Answer

Enforce that all Terraform code follows a specific formatting style

Answer

Automatically rotate database passwords

Question 11

Which THREE of the following are valid methods to manage Terraform state in a team environment? (Choose three.)

Accepted Answer

Using a remote backend like S3 with DynamoDB locking. Option B is correct because using a remote backend like Amazon S3 with DynamoDB locking provides a centralized, durable, and consistent state storage solution. DynamoDB implements a distributed lock mechanism using conditional writes to prevent concurrent state modifications, ensuring state integrity in team environments.

Answer

Storing state in a version control system

Answer

Storing state locally and sharing via network drive

Question 12

Which TWO of the following are true about Terraform Cloud's run lifecycle? (Choose two.)

Accepted Answer

A plan can be discarded without applying. Option B is correct because Terraform Cloud allows users to discard a plan without applying it, which is useful when the proposed changes are not desired or need to be revised. This is a standard part of the run lifecycle where a plan can be reviewed and then discarded, preventing any infrastructure changes from being made.

Answer

Policy checks can be skipped for emergency changes

Answer

Cost estimation is automatically generated for every run

Answer

A plan that fails due to policy violations can still be applied with admin override

Question 13

Based on the exhibit, what will happen to the existing Elastic IP (aws_eip.web_eip) when this plan is applied?

Accepted Answer

It will be destroyed. Option D is correct because the Terraform configuration shows that the `aws_eip.web_eip` resource is no longer defined in the configuration after the plan is applied. Terraform will detect that the resource exists in the state but is absent from the configuration, and by default, it will destroy the Elastic IP to reconcile the state with the configuration. This is standard Terraform behavior for resources removed from `.tf` files.

Answer

It will remain unchanged

Answer

It will be updated in-place

Answer

It will be created

Question 14

A user receives the error shown in the exhibit when running `terraform init`. The user is behind a corporate proxy. Which environment variable should be set to resolve this issue?

Accepted Answer

HTTP_PROXY=http://proxy:8080. Option C is correct because Terraform uses the standard `HTTP_PROXY` environment variable to route HTTP/HTTPS requests through a corporate proxy when downloading providers and modules. Setting `HTTP_PROXY=http://proxy:8080` instructs Terraform's underlying HTTP client to connect via the specified proxy, resolving the connectivity error during `terraform init`.

Answer

TF_VAR_proxy=http://proxy:8080

Answer

AWS_ACCESS_KEY_ID

Answer

TF_LOG=DEBUG

Question 15

You are a platform engineer at a large enterprise that uses Terraform Cloud with a VCS-backed workflow for all infrastructure. Your team manages a configuration that provisions AWS EC2 instances for a critical application. Recently, a junior team member accidentally committed a change that removed a required tag from the EC2 instance resource. The change passed the plan stage but was blocked by a Sentinel policy during the apply, preventing the infrastructure from being updated. The team needs to fix the configuration and apply the change. However, the repository is configured to automatically trigger runs on every push to the main branch. The team wants to avoid triggering an unwanted run while they work on the fix. What should the team do?

Accepted Answer

Create a feature branch, fix the configuration, and merge via pull request. Option C is correct because using a feature branch and pull request allows the team to fix the configuration without triggering a run on the main branch, since Terraform Cloud’s VCS integration only auto-triggers runs on pushes to the configured branch (typically main). Once the fix is merged via pull request, the change will be applied through the normal VCS-backed workflow, maintaining audit trails and policy enforcement. This approach avoids disrupting the VCS connection or bypassing Terraform Cloud’s governance.

Answer

Temporarily disable the VCS connection in Terraform Cloud to prevent runs

Answer

Run terraform apply locally with the fixed configuration to bypass Terraform Cloud

Answer

Amend the commit on main and force push to overwrite history

Question 16

You are managing a Terraform configuration that deploys resources across multiple AWS accounts using provider aliases. The configuration uses a single backend (S3) to store the state file. Recently, you discovered that the state file has become very large (over 100 MB) and is causing slow operations and timeouts. The team wants to improve performance without losing the ability to manage all resources with a single `terraform apply`. You need to propose a solution. Which approach should you take?

Accepted Answer

Use Terraform workspaces to separate environments into different state files. Option C is correct because Terraform workspaces allow you to maintain separate state files for different environments (e.g., dev, prod) while using the same configuration and backend. This reduces the size of each state file, improving performance and avoiding timeouts, while still enabling a single `terraform apply` to manage all resources by targeting the appropriate workspace.

Answer

Use state encryption to compress the state file

Answer

Switch the backend from S3 to Terraform Cloud to improve performance

Answer

Split the configuration into separate directories for each environment

Question 17

A DevOps team is using Terraform Cloud to manage infrastructure. They want to integrate Terraform into their CI/CD pipeline by triggering runs programmatically. Which approach should they use to invoke a Terraform run from an external system?

Accepted Answer

Use the Terraform Cloud API to trigger a run.. The Terraform Cloud API provides a programmatic endpoint to trigger runs, allowing external CI/CD systems to initiate Terraform operations without manual intervention. This is the correct approach because it directly invokes a run with full control over variables, configuration versions, and apply strategies, aligning with the requirement to integrate Terraform into a CI/CD pipeline programmatically.

Answer

Set up a webhook from the VCS provider to trigger runs.

Answer

Configure a remote backend to automatically run apply.

Answer

Execute 'terraform apply -auto-approve' in the CI pipeline.

Question 18

An organization uses Terraform Cloud for team collaboration. They have a workspace that manages production infrastructure. Due to a security policy, they must ensure that all changes go through a peer review process before they are applied. How can they enforce this requirement?

Accepted Answer

Enable 'apply on merge' and set the workspace to require approval before applying.. Option A is correct because enabling 'apply on merge' combined with requiring approval before applying enforces a peer review process: changes must be merged via a VCS pull request (triggering the plan), and then a separate approval step is needed before Terraform Cloud applies the changes. This ensures that no change is applied without explicit human approval after the plan is reviewed.

Answer

Require all changes to be submitted via a VCS pull request.

Answer

Use run triggers to automatically apply after a successful plan in another workspace.

Answer

Lock the workspace and only unlock it for approved changes.

Question 19

A company uses Terraform to manage multi-cloud infrastructure. They have separate Terraform configurations for AWS and Azure, each with its own state file. They want to share a common set of networking variables (e.g., allowed IP ranges) between these configurations without duplicating data. Which approach best achieves this?

Accepted Answer

Use a remote state data source to read the outputs from a dedicated 'globals' workspace.. Option D is correct because using a remote state data source allows you to read outputs from a dedicated 'globals' Terraform workspace that stores shared networking variables. This approach avoids data duplication and ensures that both AWS and Azure configurations can dynamically consume the same canonical set of values without manual copying or file sharing. It leverages Terraform's native remote state mechanism to securely and consistently share data across separate configurations.

Answer

Create a module that contains the variable definitions and reference it in both configurations.

Answer

Define the variables in a 'terraform.tfvars' file and copy it to each configuration directory.

Answer

Store the variables in a JSON file and use the 'jsondecode' function in each configuration.

Question 20

Which TWO of the following are valid ways to import existing infrastructure into Terraform management? (Choose TWO.)

Accepted Answer

Use the 'terraform import' command with the resource address and ID.. Option C is correct because 'terraform import' is the dedicated command to bring existing infrastructure under Terraform management by associating a real-world resource ID with a resource address in state. Option D is correct because you can manually write configuration that matches the existing resource, then run 'terraform plan' to refresh state and detect any drift, allowing you to adjust the configuration until the plan shows no changes.

Answer

Use 'terraform validate' to automatically import resources.

Answer

Use 'terraform state rm' to remove resources from state, then re-add them.

Answer

Run 'terraform apply' with an empty configuration to detect resources.