TF-004 Understand Terraform basics Practice Test 4 — 15 Questions

Question 1

A company wants to use Terraform to create Azure resources. They have written a configuration file but when they run `terraform init`, they get a warning about an 'incomplete lock file'. What should they do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Delete the `.terraform.lock.hcl` and re-run `terraform init`. The warning about an 'incomplete lock file' indicates that the `.terraform.lock.hcl` file is corrupted, incomplete, or from an incompatible provider version. The correct first step is to delete the existing lock file and re-run `terraform init`, which will regenerate a fresh lock file based on the current configuration and provider requirements. This ensures dependency integrity before any planning or applying.

Answer

Change the provider version in the configuration

Answer

Run `terraform apply` immediately

Answer

Run `terraform plan` to update the lock file

Answer

Run `terraform validate` to fix the warning

Question 2

A Terraform configuration uses `count` to create multiple EC2 instances. After adding a new variable for instance type, the user runs `terraform plan` and sees that all instances are marked for recreation. What is the most likely cause?

Accepted Answer

The variable change triggers a new value for each resource, causing Terraform to see differences. When you change a variable that is referenced within a resource's configuration (such as `instance_type`), Terraform sees a diff between the current state and the new configuration for every resource created by `count`. Since `count` resources are identified by their index in the state, and the new variable value changes the desired configuration for each instance, Terraform plans to recreate all of them to apply the new instance type.

Answer

The `count` index changed, causing all resources to be re-indexed

Answer

The user forgot to run `terraform refresh` after changing the variable

Answer

The state file is corrupt and needs to be refreshed

Answer

The provider version is incompatible with the new variable type

Question 3

An organization uses Terraform with multiple workspaces to manage different environments (dev, staging, prod). They want to ensure that sensitive variables for prod are not exposed in the plan output. What should they do?

Accepted Answer

Mark the variable as `sensitive = true` in the variable definition. Marking a variable as `sensitive = true` in the variable definition prevents Terraform from displaying its value in CLI output, including plan and apply summaries. This is the direct and intended mechanism to protect sensitive data from exposure during Terraform operations, without affecting how the variable is stored or used.

Answer

Use an output block to display the variable only when needed

Answer

Store the variable in the state file

Answer

Store the variable in an environment variable instead of a .tfvars file

Answer

Use a data source to retrieve the secret at runtime

Question 4

Your team uses Terraform to manage a multi-region AWS deployment consisting of over 500 resources. The state file is stored in an S3 backend with DynamoDB locking. Recently, one of your colleagues accidentally deleted the state file from S3 while trying to clean up old backups. Fortunately, you have a backup from two days ago. However, after restoring the backup, you notice that several recent changes, including two new EC2 instances and a security group, are missing from the state. The actual resources still exist in AWS. You need to bring the state back in sync with the real-world infrastructure without recreating these resources. What should you do?

Accepted Answer

Use `terraform import` for each missing resource to add them to state. `terraform import` is the intended mechanism to bring existing infrastructure under Terraform management without recreating it. Since the missing EC2 instances and security group still exist in AWS but are absent from the state file, importing each resource by its AWS ID will add the corresponding state entries, allowing Terraform to manage them going forward. This avoids the downtime and potential configuration drift that would occur with `terraform apply` or manual state editing.

Answer

Run `terraform apply` to recreate the missing resources

Answer

Manually edit the state file to add the missing resource entries

Answer

Run `terraform refresh` to update the state with the missing resources

Question 5

A team is new to Terraform and wants to manage their cloud infrastructure. They have written configuration files but have not yet run any commands. What is the correct sequence of initial steps to deploy their infrastructure?

Accepted Answer

Run terraform init, then terraform plan, then terraform apply. The correct sequence is `terraform init`, `terraform plan`, then `terraform apply`. `terraform init` must be run first to initialize the working directory, download required provider plugins (e.g., AWS, Azure), and set up the backend state storage. Without initialization, subsequent commands like `plan` and `apply` will fail because Terraform cannot locate providers or configure the state backend. After initialization, `terraform plan` creates an execution plan showing what resources will be created, modified, or destroyed, and `terraform apply` executes that plan to deploy the infrastructure.

Answer

Run terraform plan, then terraform apply, then terraform init

Answer

Run terraform validate, then terraform plan, then terraform apply

Answer

Run terraform apply, then terraform plan, then terraform init

Question 6

A company is using Terraform to manage secrets in AWS Secrets Manager. They want to ensure that sensitive values are not exposed in logs, the console, or plan output. Which two practices should they implement? (Choose two.)

Accepted Answer

Use the sensitive flag in variable definitions. Marking a variable with `sensitive = true` in its definition block tells Terraform to redact its value in CLI output, logs, and plan output. This prevents the secret from being displayed in plaintext during `terraform plan` or `terraform apply`, even if the variable is used in a resource argument. Option E is correct because setting `sensitive = true` on an output value instructs Terraform to suppress that output in the CLI and in any logs or console displays, ensuring the secret value is not exposed after apply.

Answer

Use a remote backend with encryption

Answer

Use a data source to fetch secrets at runtime instead of hardcoding

Answer

Store variable values in terraform.tfvars file

Question 7

A junior engineer cloned a Terraform repository from GitHub and ran terraform init inside the project directory. The command downloaded the required provider plugins successfully. Next, they ran terraform plan and received the following error: 'Error: No configuration files found in the current directory.' The engineer checked and confirmed that the main.tf file exists in the current directory. What is the most likely cause of this error?

Accepted Answer

The file is named main.tf.txt instead of main.tf. Terraform requires configuration files to have the `.tf` extension to be recognized. If the file is named `main.tf.txt` (e.g., due to Windows hiding known file extensions or accidental renaming), Terraform will not parse it as a configuration file, resulting in the 'No configuration files found' error even though the file exists in the directory. The `terraform init` command succeeded because it only downloads providers and modules, not requiring `.tf` files to be present.

Answer

The terraform init command was not run with -upgrade flag

Answer

The main.tf file contains syntax errors

Answer

The terraform plan command requires the -out flag

Question 8

Refer to the exhibit. Which change to the configuration would prevent this error in the future?

Accepted Answer

Use a data source to fetch the AMI dynamically.. Using a data source to dynamically fetch the correct AMI avoids hardcoding invalid IDs and ensures the AMI exists in the region.

Answer

Hardcode a different AMI ID.

Answer

Set the AMI to null.

Answer

Add a lifecycle rule to ignore changes.

Question 9

A company uses Terraform to manage infrastructure across dev, staging, and production environments. They use Terraform workspaces to separate state files. The backend is configured with an S3 bucket for state storage and a DynamoDB table for state locking. Recently, the team has grown from 2 to 10 developers, and they frequently encounter the error: 'Error acquiring the state lock' when running terraform apply in quick succession. The error message includes: 'Lock Info: ID: ... Operation: Apply. Who: user@company.com. Version: 1.0.0. Created: ...' The error occurs intermittently, especially during peak deployment times. The DynamoDB table is configured with 5 read and 5 write capacity units. The team's current workflow involves multiple developers running apply on different workspaces simultaneously. Which course of action should the team take to minimize state locking errors?

Accepted Answer

Increase the DynamoDB table's write capacity units to a higher value.. Increasing DynamoDB write capacity reduces contention and lock acquisition failures during concurrent applies. Option D (implementing a pre-apply hook) is not standard and could add complexity. Options A and C disable or bypass locking, which is dangerous.

Answer

Disable state locking to eliminate the error.

Answer

Use a different backend that does not support locking, such as local state.

Answer

Implement a pre-apply hook that checks if the state is already locked and waits.

Question 10

Refer to the exhibit. A user runs terraform init and receives an error about state data content. The state file in S3 has not been manually modified. What is the most likely cause?

Accepted Answer

The state file was written by a different Terraform workspace.. The error indicates that the state file content does not match what Terraform expects. This can happen when the state file has a different serial number (e.g., if another process wrote to it) or if the state file is corrupted. However, since the user hasn't manually modified it, the most likely cause is that the state file was modified by a different Terraform process (perhaps from another workspace or different version) that changed the state structure. Option D is correct because a conflicting workspace can write state with a different serial, causing the error.

Answer

The S3 bucket policy denies access to the state file.

Answer

Terraform version mismatch between local and state file.

Answer

The state file is locked by another process.

Question 11

Refer to the exhibit. A user applies this configuration and then runs 'terraform state list'. Which resource addresses would appear in the output?

Accepted Answer

aws_instance.web and aws_eip.web. The configuration defines two resources: aws_instance.web and aws_eip.web. Both will be in the state after apply. Option A lists both correct addresses.

Answer

aws_instance.web only

Answer

aws_instance.web and aws_eip.web (but aws_eip.web might not appear if the EIP fails to associate)

Answer

aws_eip.web only

Question 12

Refer to the exhibit. An engineer runs 'terraform plan' and receives an error: 'Error refreshing state: state data in S3 does not have the expected content.' The state file exists and is not corrupted. What is the most likely cause?

Accepted Answer

The state file was written by a different backend configuration (e.g., different key or workspace).. The error 'state data in S3 does not have the expected content' indicates a mismatch between the state file's content and what Terraform expects based on the current backend configuration. This typically occurs when the state file was written using a different backend key, workspace, or bucket path, causing Terraform to read a state that does not match the expected serial or lineage. The state file itself is not corrupted, but the backend configuration (e.g., different `key` or `workspace_key_prefix`) points to a different state object in S3.

Answer

The state file is locked by another process.

Answer

The DynamoDB table does not exist.

Answer

The S3 bucket is in a different region.

Question 13

Refer to the exhibit. A user runs 'terraform plan' and sees this output. However, when they run 'terraform apply', they get an error: 'Error creating EC2 instance: UnauthorizedOperation: You are not authorized to perform this operation.' The user's IAM permissions allow ec2:RunInstances. What is the most likely missing permission?

Accepted Answer

ec2:CreateNetworkInterface. Creating an EC2 instance often requires permissions for related resources like network interfaces, security groups, etc. The error 'UnauthorizedOperation' despite having ec2:RunInstances suggests missing permissions for other actions. Option A is correct because the instance might require a subnet and network interface, and without ec2:CreateNetworkInterface permission, the operation fails.

Answer

iam:PassRole

Answer

ec2:TerminateInstances

Answer

ec2:DescribeInstances

Question 14

Refer to the exhibit. A user applies this configuration. They then run 'terraform destroy' but the destroy fails with an error: 'Error deleting load balancer: DependencyViolation: The load balancer 'arn:aws:elasticloadbalancing:...' cannot be deleted because it is currently associated with another resource.' The user has not made any changes to the resources. What is the most likely cause?

Accepted Answer

The aws_lb_listener is missing an explicit depends_on for the aws_lb.. The destroy fails because Terraform attempts to delete the load balancer before the listener that is associated with it. The listener has an implicit dependency on the load balancer via the `load_balancer_arn` attribute, but Terraform may not always recognize this implicit dependency, especially if the reference is indirect. Therefore, an explicit `depends_on` from the listener to the load balancer is required to ensure the listener is destroyed first, releasing the association and allowing the load balancer to be deleted. Option D correctly identifies this missing dependency on the listener.

Answer

The aws_lb_listener does not have explicit depends_on for the aws_lb_target_group.

Answer

The aws_lb_target_group is missing an explicit depends_on for the aws_lb_listener.

Answer

The aws_lb_target_group is missing an explicit depends_on for the aws_lb.

Question 15

Refer to the exhibit. After running terraform apply, the output shows:

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Outputs:

instance_id = "i-1234567890abcdef0"

However, the engineer notices that the instance type is t2.micro, but the expected instance type was t2.medium. What is the most likely reason for this discrepancy?

Accepted Answer

The configuration file specified t2.micro, so Terraform created the instance accordingly.. The configuration explicitly sets instance_type to t2.micro, so Terraform will use that value. The engineer may have expected a different value but the configuration is authoritative.

Answer

The engineer applied a different configuration file by mistake.

Answer

Terraform ignored the instance_type argument because it is not supported for the given AMI.

Answer

The instance_type was overridden by a default value in the provider.