TF-004 Read, generate and modify configuration Practice Test 3 — 15 Questions

Question 1

A Terraform plan shows that an AWS EC2 instance will be destroyed and recreated. The team wants to ensure zero downtime during the update. Which lifecycle attribute should be added?

Accepted Answer

create_before_destroy. `create_before_destroy` is a lifecycle attribute that instructs Terraform to create the replacement resource first, then destroy the old one. This ensures that the new EC2 instance is fully operational before the original is terminated, achieving zero downtime during the update.

Answer

depends_on

Answer

ignore_changes

Answer

prevent_destroy

Question 2

A developer has a module that outputs a list of subnet IDs. They want to use this list to create an EC2 instance in each subnet using for_each. Which for_each expression is correct?

Accepted Answer

toset(module.my_module.ids). `for_each` in Terraform requires a map or a set of strings to iterate over, and `toset()` converts the list of subnet IDs into a set, which is a valid input for `for_each`. A plain list (as in option A) is not directly supported by `for_each`, which expects a map or set to ensure unique keys and deterministic behavior.

Answer

module.my_module.ids

Answer

{ for id in module.my_module.ids : id => id }

Answer

module.my_module.ids[*]

Question 3

Which command displays the output values defined in the configuration after apply?

Accepted Answer

terraform output. The `terraform output` command is specifically designed to display the output values defined in the configuration after an apply. These outputs are declared in the `output` blocks of the root module and are stored in the state file; running `terraform output` retrieves and prints them in a human-readable format, optionally with `-json` for machine parsing.

Answer

terraform state

Answer

terraform plan

Answer

terraform show

Question 4

A team has two resources: an AWS security group and an EC2 instance that uses it. Terraform does not automatically detect the dependency. Which argument should be added to the instance resource?

Accepted Answer

depends_on = [aws_security_group.sg]. Terraform requires explicit dependency declarations when it cannot infer them from resource references. The `depends_on` argument must be a list of resource references, and `[aws_security_group.sg]` correctly references the security group resource as a single-element list. This ensures Terraform creates the security group before the EC2 instance that depends on it.

Answer

depends_on = [aws_security_group.sg.*]

Answer

depends_on = aws_security_group.sg

Answer

depends_on = [aws_security_group.sg.id]

Question 5

A team wants to reuse a VPC module across multiple environments. They need to pass outputs from one module as inputs to another. Which configuration is correct?

Accepted Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.subnet_id }. In Terraform, module outputs are accessed using the syntax `module..`, not `module..outputs.` or `vpc.output.`. The `outputs` attribute is not a valid path; Terraform automatically exposes all declared outputs of a module as attributes of the module object. Therefore, `module.vpc.subnet_id` correctly references the `subnet_id` output from the `vpc` module.

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.outputs.subnet_id }

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = vpc.output.subnet_id }

Answer

module "app" { source = "./app" subnet_id = module.vpc.subnet_id }

Question 6

Which command initializes a Terraform working directory by downloading providers and modules?

Accepted Answer

terraform init. `terraform init` is the command that initializes a Terraform working directory by downloading and installing the required providers and modules specified in the configuration files. It also sets up the backend for state storage and locks, ensuring the environment is ready for subsequent operations like planning and applying.

Answer

terraform plan

Answer

terraform apply

Answer

terraform get

Question 7

A module requires an input variable named 'vpc_id'. How should the calling configuration pass the VPC ID from another module's output?

Accepted Answer

vpc_id = module.vpc.vpc_id. In Terraform, when you need to reference an output from a child module, the syntax is `module..`. The `.outputs.` prefix is not used; Terraform automatically exposes module outputs as direct attributes of the module resource. Therefore, `module.vpc.vpc_id` correctly retrieves the `vpc_id` output from the module named `vpc`.

Answer

vpc_id = module.vpc.outputs.vpc_id

Answer

vpc_id = var.vpc_id

Answer

vpc_id = vpc.module.vpc_id

Question 8

Which TWO statements about Terraform data sources are correct?

Accepted Answer

Data sources can be used in count and for_each.. Terraform data sources are regular resources that support the `count` and `for_each` meta-arguments, allowing you to dynamically fetch data for multiple instances or conditional logic. This enables patterns like iterating over a list of external IDs to retrieve corresponding data from a provider, such as fetching multiple AMI IDs for different regions.

Answer

Data sources are only available after applying the configuration.

Answer

Data sources are used to create new infrastructure.

Answer

Data sources cannot be used inside modules.

Question 9

Which THREE variable declarations are valid in Terraform?

Accepted Answer

variable "enabled" { type = bool default = true }. Terraform variable declarations require a `type` argument and optionally a `default` value. Here, `type = bool` is a valid primitive type, and `default = true` provides a boolean default, which matches the type constraint. This syntax follows Terraform's variable block specification, where the default value must be compatible with the declared type.

Answer

variable "names" { type = list(string) default = "name" }

Answer

variable "count" { type = number default = "1" }

Question 10

Which TWO scenarios require the use of the depends_on argument?

Accepted Answer

When a provisioner creates resources that other resources depend on.. When a provisioner (such as a local-exec or remote-exec) creates resources outside of Terraform's state, Terraform cannot automatically detect the dependency. The depends_on argument explicitly tells Terraform to wait for that provisioner-created resource before proceeding. Option C is correct because depends_on is the mechanism to declare a dependency when Terraform's resource graph analysis cannot infer an implicit dependency from attribute references.

Answer

When a resource uses the output of another resource in its arguments.

Answer

When a resource uses the output of a data source in its arguments.

Answer

When a resource uses a module output as an input.

Question 11

Refer to the exhibit. A terraform plan shows that the instance will be replaced. What will be the order of operations?

Accepted Answer

Destroy the old instance first, then create the new one.. By default, when Terraform replaces a resource (e.g., due to a forced-new change like `ami` or `instance_type`), it destroys the old instance first and then creates the new one. This 'destroy-before-create' behavior is the default because it ensures Terraform can cleanly remove the old resource before provisioning the replacement. To achieve zero-downtime deployments, you must explicitly set `lifecycle { create_before_destroy = true }`.

Answer

The instance will be updated in-place without replacement.

Answer

Both instances will be created and destroyed simultaneously.

Answer

Create the new instance first, then destroy the old one.

Question 12

Refer to the exhibit. You need to add a security group to each instance. You have a local value defined as 'security_group_map = { "subnet-1" = "sg-1", "subnet-2" = "sg-2" }'. Which expression should be used to reference the security group ID in the resource block?

Accepted Answer

vpc_security_group_ids = [local.security_group_map[var.subnet_ids[count.index]]]. It properly references the local value `security_group_map` using the `local.` prefix, which is required in Terraform to access local values. It then uses the subnet ID from `var.subnet_ids[count.index]` as the key to look up the corresponding security group ID. This ensures each instance gets the correct security group based on its subnet index.

Answer

vpc_security_group_ids = [lookup(security_group_map, var.subnet_ids[count.index])]

Answer

vpc_security_group_ids = [security_group_map[var.subnet_ids[count.index]]]

Answer

vpc_security_group_ids = [lookup(local.security_group_map, var.subnet_ids[count.index])]

Question 13

Refer to the exhibit. What is the purpose of this output block?

Accepted Answer

To display the public IP address of the instance after apply.. The output block shown in the exhibit is a Terraform output value, which is defined using the `output` block in a configuration file. Its purpose is to display the public IP address of the instance in the terminal after `terraform apply` completes, providing a quick reference for the user. Option D correctly identifies this behavior, as outputs are designed to surface resource attributes to the user without storing them or creating external records.

Answer

To store the public IP in a local file.

Answer

To set the public IP as a variable for use in other configurations.

Answer

To create a DNS record with the public IP.

Question 14

A developer needs to retrieve the current state of an AWS EC2 instance that was created by Terraform but the configuration file is missing. Which command will output the attributes of the instance in a format suitable for generating a configuration?

Accepted Answer

terraform state show -json aws_instance.example. `terraform state show -json aws_instance.example` retrieves the current state of the specified resource from the Terraform state file and outputs it in JSON format, which can be directly used to reconstruct a configuration block. This command is specifically designed for inspecting a single resource's attributes when the original configuration is unavailable.

Answer

terraform output aws_instance

Answer

terraform state pull | grep aws_instance

Answer

terraform plan

Question 15

An engineer modifies a Terraform configuration by increasing the instance_count for an AWS EC2 resource from 2 to 5. After running terraform plan, which change will be displayed?

Accepted Answer

Three new resources will be created, two unchanged.. Terraform's `instance_count` meta-argument uses a count-based resource management strategy. When the count increases from 2 to 5, Terraform treats the existing resources (index 0 and 1) as unchanged and plans to create three new resources (indices 2, 3, and 4). No in-place updates or destructions occur because the existing resources' configurations remain identical.

Answer

One new resource will be created and two modified.

Answer

Two existing resources will be destroyed and five new created.

Answer

All five resources will be updated in-place.