TF-004 Understand Terraform basics — 20 Questions

Question 1

An organization uses Terraform Cloud for remote state management. They have a workspace that uses the CLI-driven run workflow. A developer runs `terraform plan` locally and sees that the plan succeeds. However, when they push the same configuration to the version control system (VCS) connected to the workspace, the plan fails with a state lock error. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The local `terraform plan` left the state locked in Terraform Cloud. In Terraform Cloud's CLI-driven workflow, a local `terraform plan` acquires a state lock only during the execution and releases it immediately afterward. Therefore, a local plan does not leave the state locked. The most likely cause of a state lock error when pushing to VCS is that a previous run (e.g., from another pipeline or manual trigger) is still in progress or a lock was not properly released due to a transient failure. This is a common scenario where concurrent runs conflict.

Answer

The Terraform version in the VCS pipeline is different

Answer

The VCS branch is not configured as the workspace's working branch

Answer

The VCS pipeline does not have access to the Terraform Cloud workspace

Question 2

Which TWO of the following are true about Terraform state? (Choose two.)

Accepted Answer

State can be used to improve performance by caching resource attributes.. Terraform state serves two primary functions. Firstly, it acts as a cache for resource attributes, allowing Terraform to avoid re-querying the provider for every attribute during planning and applying. This improves performance, especially when dealing with large infrastructures or APIs with rate limits, as the state file stores the last-known values of resource attributes. Secondly, the state file is crucial for mapping the real-world infrastructure resources (like a specific EC2 instance or S3 bucket) to the resources defined in your Terraform configuration files. It tracks the identity and attributes of these managed resources.

Answer

State never contains sensitive data, so it can be stored in version control.

Answer

State does not store resource IDs; it only stores metadata.

Answer

State should be stored locally by default for team collaboration.

Question 3

Which three of the following are valid ways to pass variable values to a Terraform configuration?

Accepted Answer

Using the -var flag on the command line.. The `-var` flag is a standard Terraform CLI option used to pass variable values directly on the command line, e.g., `terraform apply -var='region=us-east-1'`. This overrides any default variable values and is a core mechanism for supplying input variables during plan or apply operations.

Answer

Using the -assign flag on the command line.

Answer

Using a YAML file.

Question 4

Refer to the exhibit. What will happen when terraform plan is run?

Accepted Answer

It will fail with an error about missing required argument.. The Terraform configuration for an AWS S3 bucket requires the `bucket` argument to be explicitly set. If the `bucket` argument is omitted, Terraform will fail during `terraform plan` with an error indicating a missing required argument, as the provider cannot infer or generate a bucket name automatically without explicit configuration.

Answer

It will prompt for the bucket name.

Answer

It will create a bucket with a random name.

Answer

It will succeed because bucket name can be generated automatically.

Question 5

Refer to the exhibit. What does this output indicate?

Accepted Answer

There is one resource managed by Terraform in this state.. The output shows a Terraform state file listing a single resource (e.g., `aws_instance.web`). The `resources` array contains exactly one entry, and the `count` field (if present) or the structure indicates one managed resource. Option D is correct because the state file explicitly shows one resource being tracked by Terraform.

Answer

The state file contains multiple resources.

Answer

The resource is not in the state.

Answer

The configuration has a resource named web.

Question 6

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The provider block version constraint conflicts with the installed provider version.. The explanation describes an error scenario where a provider version constraint conflicts with an installed version, which would indeed make option A correct. However, this cannot be confirmed without seeing the specific error message from the exhibit.

Answer

The required_version block in the configuration is too strict.

Answer

The .terraform.lock.hcl file is corrupted.

Answer

The Terraform CLI version is incompatible with the provider.

Question 7

A team uses Terraform to manage AWS resources. They want to ensure that a security group is created before an EC2 instance that references it. What is the best practice?

Accepted Answer

Use `depends_on` meta-argument. `depends_on` is the explicit meta-argument in Terraform that allows you to define a hard dependency between resources. While Terraform often infers implicit dependencies when one resource directly references an attribute of another (e.g., an EC2 instance referencing a security group's ID), there are scenarios where an explicit dependency is required to ensure correct ordering. This is particularly true when references are indirect (e.g., via a variable or data source) or when a non-obvious ordering is critical. In such cases, `depends_on` is the best practice to explicitly ensure the security group is created before the EC2 instance, preventing plan/apply errors.

Answer

Use `for_each` to iterate over resources

Answer

Use `count` to create the security group first

Answer

Use `provisioner` to wait for the security group

Answer

Use a data source to reference the security group

Question 8

In Terraform, which command is used to format configuration files according to the HCL canonical style?

Accepted Answer

terraform fmt. `terraform fmt` is the dedicated Terraform CLI command that rewrites configuration files to adhere to the HCL canonical style, ensuring consistent formatting (e.g., indentation, alignment of equals signs). It does not modify the logic or state of the configuration, only its visual layout.

Answer

terraform plan

Answer

terraform init

Answer

terraform validate

Answer

terraform apply

Question 9

Which of the following commands creates an execution plan that shows what resources will be created, updated, or destroyed?

Accepted Answer

terraform plan. The `terraform plan` command creates an execution plan by comparing the current state against the configuration, showing what resources will be created, updated, or destroyed without making any changes. This is the correct command for previewing infrastructure changes before applying them.

Answer

terraform apply

Answer

terraform output

Answer

terraform destroy

Answer

terraform validate

Question 10

A team manages infrastructure with Terraform. They recently updated the provider version in the configuration from 2.0 to 3.0. After running `terraform init`, they get errors that some resource arguments are no longer valid. What is the best approach to resolve this?

Accepted Answer

Run `terraform state replace-provider` to update the state. `terraform state replace-provider` updates the state file to reference the new provider version, ensuring Terraform can map existing resources to the updated provider schema without losing state. This is necessary when provider upgrades introduce breaking changes to resource arguments, as the state must reflect the new provider's expected format.

Answer

Revert the provider version back to 2.0

Answer

Delete the state file and re-import all resources

Answer

Run `terraform apply` to force the new provider

Answer

Change the backend configuration to use a new state file

Question 11

Which TWO of the following are valid variable types in Terraform? (Choose two.)

Accepted Answer

string. B is correct because `string` is one of the primitive variable types in Terraform, used to represent a sequence of Unicode characters. It is a fundamental type that can be used directly or as part of complex types like lists or maps.

Answer

tuple

Answer

integer

Answer

boolean

Question 12

Which TWO of the following are valid ways to pass variable values to a Terraform configuration? (Choose two.)

Accepted Answer

Use a `.tfvars` file and run `terraform apply`. Terraform automatically loads any file with the `.tfvars` extension in the working directory when running `terraform apply`, merging the variable definitions into the configuration. Option B is also correct because Terraform similarly loads `.tfvars.json` files automatically. Option E is correct because the `-var` flag allows passing variable values directly on the command line. Options C and D are incorrect: `variables.tf` is for declaring variables, not assigning values, and `.env` files are not recognized by Terraform.

Answer

Use a `.tfvars.json` file

Answer

Add variable values in the `variables.tf` file

Answer

Create a `.env` file in the working directory

Question 13

Which THREE of the following are characteristics of Terraform state? (Choose three.)

Accepted Answer

It can be stored remotely to enable team collaboration. Terraform state can be stored remotely using backends such as S3, Azure Storage, or Terraform Cloud, which enables multiple team members to access and update the same state file concurrently, ensuring collaboration and preventing conflicts through state locking mechanisms. The state file's primary role is to map the resources defined in your Terraform configuration to their real-world counterparts in the infrastructure, tracking their IDs and attributes. It also includes crucial metadata, such as resource dependencies, which Terraform uses to understand the order of operations during planning and applying changes.

Answer

It contains the entire Terraform configuration

Answer

It stores the provider source code

Question 14

A DevOps engineer is working on a Terraform project that manages resources across multiple AWS accounts. To reduce duplication and ensure consistency, they want to define common configurations like provider settings and variable definitions in a separate location that can be reused across root modules. What feature should they use?

Accepted Answer

Terraform modules. Terraform modules are the correct feature for defining reusable common configurations like provider settings and variable definitions. A root module can call a child module, which encapsulates provider configurations and variable definitions, allowing the same logic to be applied across multiple root modules without duplication. This directly addresses the need to reduce duplication and ensure consistency across AWS accounts.

Answer

Terraform Cloud workspaces

Answer

terraform_remote_state data source

Answer

Provisioners

Question 15

An organization uses Terraform Cloud to manage their infrastructure. They have a workspace configured with a VCS-backed workflow connected to their GitHub repository. They recently added a new AWS provider version requirement in their configuration. After committing and pushing the change, they notice that the plan in Terraform Cloud fails with an error indicating that the provider version is not found. However, the engineer can run the same configuration locally with terraform init and plan successfully. What is the most likely reason for the failure in Terraform Cloud?

Accepted Answer

The workspace's Terraform version is older than required by the provider. Terraform Cloud workspaces can pin a specific Terraform version. If the newly added AWS provider version requires a newer Terraform core version than the workspace uses, Terraform Cloud cannot select that provider version, causing the provider version to be reported as unavailable during initialization. Locally, the engineer likely has a newer Terraform version that satisfies the provider requirement, so the same configuration works. Option A is incorrect because the AWS region affects where resources are deployed, not provider version availability or compatibility. Option C is incorrect because a missing required_providers block would affect local and Terraform Cloud runs in the same way. Option D is incorrect because Terraform Cloud does support custom/private provider registries; in any case, the AWS provider is a public provider, so a custom registry is not the cause.

Answer

The run in Terraform Cloud is executing in a different AWS region

Answer

The provider version constraint is missing a required_providers block

Answer

Terraform Cloud does not support custom provider registries

Question 16

A platform team manages a large Terraform codebase with hundreds of resources across multiple environments (dev, staging, prod). They use terraform workspaces to manage environment-specific state files. Recently, an engineer made changes to the production workspace but forgot to switch from the dev workspace before applying. The apply was successful, but now the production resources are in an inconsistent state. The team wants to recover the production state to match the actual infrastructure. The previous state file for production was backed up in an S3 bucket before the accidental apply. What is the best course of action?

Accepted Answer

Use terraform state push with the backup state file to overwrite the current state. `terraform state push` directly overwrites the current state file in the workspace with a provided state file. Since the team has a backup of the production state file taken before the accidental apply, pushing that backup restores the state to exactly match the actual infrastructure, assuming no other changes occurred. This is the fastest and most reliable method to recover from an incorrect state overwrite, as it bypasses any reconciliation logic and replaces the state wholesale.

Answer

Use terraform state mv to correct the state entries by mapping resources from the backup to the current state

Answer

Use terraform import to manually import each production resource based on the backup state

Answer

Use terraform workspace select prod then terraform apply with the backup state file

Question 17

Which TWO of the following statements about Terraform state are correct? (Choose two.)

Accepted Answer

Terraform state can be stored remotely using backends like S3 or Azure Storage.. Terraform state is stored locally by default in terraform.tfstate, and can be shared via remote backends like S3. State is not encrypted by default and may contain sensitive data.

Answer

Terraform state can be shared across team members using a local file.

Answer

Terraform state is always encrypted at rest by default.

Question 18

Refer to the exhibit. The engineer runs terraform plan and gets:

Error: Reference to undeclared data source
  on main.tf line 6, in resource "aws_security_group" "example":
   6:   vpc_id = data.aws_vpc.selected.id

A data source "aws_vpc" "selected" is declared but not yet read. What is the most likely cause?

Accepted Answer

The provider is not configured, so Terraform cannot query the VPC.. The explanation incorrectly states that 'Without a valid provider configuration, Terraform cannot read the data source, and as a result, it treats the reference as if the data source does not exist.' In actual Terraform behavior, if a data source block is declared but its provider is not configured, Terraform typically produces an error like 'Error: No provider for data.aws_vpc.selected', not 'Error: Reference to undeclared data source'. The 'Reference to undeclared data source' error specifically indicates that the data source block itself is missing, misspelled, or commented out, which directly contradicts the stem's assertion that the data source is 'declared'. Therefore, the explanation does not accurately justify option B given the specific error message provided in the stem.

Answer

The data source must be defined after the resource that uses it.

Answer

The 'default = true' argument is invalid for aws_vpc data source.

Answer

The data source name 'selected' conflicts with a reserved keyword.

Question 19

A DevOps engineer is writing a Terraform configuration to provision an AWS EC2 instance. They want to ensure that the instance is replaced if the AMI ID changes, but not if the instance type changes. Which lifecycle meta-argument should be used?

Accepted Answer

Set `create_before_destroy = true` and add `instance_type` to `ignore_changes`. `create_before_destroy = true` ensures the new instance is created before the old one is destroyed, which is a best practice for zero-downtime deployments when the AMI changes. Adding `instance_type` to `ignore_changes` tells Terraform to ignore changes to the instance type attribute during plan/apply, so the instance is not replaced when only the instance type changes. This combination precisely meets the requirement: replacement on AMI change, no replacement on instance type change.

Answer

Set `prevent_destroy = true`

Answer

Set `ignore_changes = all`

Answer

Set `create_before_destroy = true` only

Question 20

A team is using Terraform to manage infrastructure across multiple environments (dev, staging, prod). They want to reuse the same root module configuration but with different variable values. Which approach is the most efficient?

Accepted Answer

Use Terraform workspaces. Terraform workspaces allow you to manage multiple distinct sets of infrastructure resources (e.g., dev, staging, prod) from the same root module configuration by maintaining separate state files for each workspace. This avoids duplicating code or manually managing state file switching, making it the most efficient approach for reusing configuration with different variable values across environments.

Answer

Use environment variables to switch between configurations

Answer

Use a single state file that includes all environments

Answer

Copy the entire configuration into separate directories for each environment