TF-004 Read, generate and modify configuration Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to handle sensitive data in Terraform outputs in the correct order.

Accepted Answer

First, define the output as sensitive. Next, run terraform apply. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.. Sensitive outputs are redacted in CLI; -json reveals raw value for secure handling.

Answer

First, run terraform apply. Next, define the output as sensitive. Then, use terraform output -json to retrieve the raw value. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, use terraform output -json to retrieve the raw value. Then, run terraform apply. Finally, securely handle the raw value.

Answer

First, define the output as sensitive. Next, run terraform apply. Then, securely handle the raw value. Finally, use terraform output -json to retrieve the raw value.

Question 2

Match each Terraform variable type to its example value.

Accepted Answer

string: "hello". Terraform variable types: string uses quotes, number is numeric, bool is true/false, list is an array. Common mistakes include confusing numbers with strings and lists with bools.

Answer

string: 42

Answer

bool: ["a", "b"]

Question 3

Which Terraform command is used to check the syntax and internal consistency of configuration files?

Accepted Answer

terraform validate. The `terraform validate` command checks the syntax and internal consistency of Terraform configuration files, ensuring that the code is syntactically valid and that references between resources, data sources, and variables are correct. It does not access remote state or providers, making it a fast, offline validation step. This is the correct command for verifying configuration correctness before applying changes.

Answer

terraform fmt

Answer

terraform plan

Answer

terraform graph

Question 4

A Terraform plan shows that an AWS EC2 instance will be destroyed and recreated. The team wants to ensure zero downtime during the update. Which lifecycle attribute should be added?

Accepted Answer

create_before_destroy. `create_before_destroy` is a lifecycle attribute that instructs Terraform to create the replacement resource first, then destroy the old one. This ensures that the new EC2 instance is fully operational before the original is terminated, achieving zero downtime during the update.

Answer

depends_on

Answer

ignore_changes

Answer

prevent_destroy

Question 5

A developer has a module that outputs a list of subnet IDs. They want to use this list to create an EC2 instance in each subnet using for_each. Which for_each expression is correct?

Accepted Answer

toset(module.my_module.ids). `for_each` in Terraform requires a map or a set of strings to iterate over, and `toset()` converts the list of subnet IDs into a set, which is a valid input for `for_each`. A plain list (as in option A) is not directly supported by `for_each`, which expects a map or set to ensure unique keys and deterministic behavior.

Answer

module.my_module.ids

Answer

{ for id in module.my_module.ids : id => id }

Answer

module.my_module.ids[*]

Question 6

Which command displays the output values defined in the configuration after apply?

Accepted Answer

terraform output. The `terraform output` command is specifically designed to display the output values defined in the configuration after an apply. These outputs are declared in the `output` blocks of the root module and are stored in the state file; running `terraform output` retrieves and prints them in a human-readable format, optionally with `-json` for machine parsing.

Answer

terraform state

Answer

terraform plan

Answer

terraform show

Question 7

A team has two resources: an AWS security group and an EC2 instance that uses it. Terraform does not automatically detect the dependency. Which argument should be added to the instance resource?

Accepted Answer

depends_on = [aws_security_group.sg]. Terraform requires explicit dependency declarations when it cannot infer them from resource references. The `depends_on` argument must be a list of resource references, and `[aws_security_group.sg]` correctly references the security group resource as a single-element list. This ensures Terraform creates the security group before the EC2 instance that depends on it.

Answer

depends_on = [aws_security_group.sg.*]

Answer

depends_on = aws_security_group.sg

Answer

depends_on = [aws_security_group.sg.id]

Question 8

A team wants to reuse a VPC module across multiple environments. They need to pass outputs from one module as inputs to another. Which configuration is correct?

Accepted Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.subnet_id }. In Terraform, module outputs are accessed using the syntax `module..`, not `module..outputs.` or `vpc.output.`. The `outputs` attribute is not a valid path; Terraform automatically exposes all declared outputs of a module as attributes of the module object. Therefore, `module.vpc.subnet_id` correctly references the `subnet_id` output from the `vpc` module.

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = module.vpc.outputs.subnet_id }

Answer

module "vpc" { source = "./vpc" } module "app" { source = "./app" subnet_id = vpc.output.subnet_id }

Answer

module "app" { source = "./app" subnet_id = module.vpc.subnet_id }

Question 9

Which command initializes a Terraform working directory by downloading providers and modules?

Accepted Answer

terraform init. `terraform init` is the command that initializes a Terraform working directory by downloading and installing the required providers and modules specified in the configuration files. It also sets up the backend for state storage and locks, ensuring the environment is ready for subsequent operations like planning and applying.

Answer

terraform plan

Answer

terraform apply

Answer

terraform get

Question 10

A module requires an input variable named 'vpc_id'. How should the calling configuration pass the VPC ID from another module's output?

Accepted Answer

vpc_id = module.vpc.vpc_id. In Terraform, when you need to reference an output from a child module, the syntax is `module..`. The `.outputs.` prefix is not used; Terraform automatically exposes module outputs as direct attributes of the module resource. Therefore, `module.vpc.vpc_id` correctly retrieves the `vpc_id` output from the module named `vpc`.

Answer

vpc_id = module.vpc.outputs.vpc_id

Answer

vpc_id = var.vpc_id

Answer

vpc_id = vpc.module.vpc_id

Question 11

Which TWO statements about Terraform data sources are correct?

Accepted Answer

Data sources can be used in count and for_each.. Terraform data sources are regular resources that support the `count` and `for_each` meta-arguments, allowing you to dynamically fetch data for multiple instances or conditional logic. This enables patterns like iterating over a list of external IDs to retrieve corresponding data from a provider, such as fetching multiple AMI IDs for different regions.

Answer

Data sources are only available after applying the configuration.

Answer

Data sources are used to create new infrastructure.

Answer

Data sources cannot be used inside modules.

Question 12

Which THREE variable declarations are valid in Terraform?

Accepted Answer

variable "enabled" { type = bool default = true }. Terraform variable declarations require a `type` argument and optionally a `default` value. Here, `type = bool` is a valid primitive type, and `default = true` provides a boolean default, which matches the type constraint. This syntax follows Terraform's variable block specification, where the default value must be compatible with the declared type.

Answer

variable "names" { type = list(string) default = "name" }

Answer

variable "count" { type = number default = "1" }

Question 13

Which TWO scenarios require the use of the depends_on argument?

Accepted Answer

When a provisioner creates resources that other resources depend on.. When a provisioner (such as a local-exec or remote-exec) creates resources outside of Terraform's state, Terraform cannot automatically detect the dependency. The depends_on argument explicitly tells Terraform to wait for that provisioner-created resource before proceeding. Option C is correct because depends_on is the mechanism to declare a dependency when Terraform's resource graph analysis cannot infer an implicit dependency from attribute references.

Answer

When a resource uses the output of another resource in its arguments.

Answer

When a resource uses the output of a data source in its arguments.

Answer

When a resource uses a module output as an input.

Question 14

Refer to the exhibit. You need to add a security group to each instance. You have a local value defined as 'security_group_map = { "subnet-1" = "sg-1", "subnet-2" = "sg-2" }'. Which expression should be used to reference the security group ID in the resource block?

Accepted Answer

vpc_security_group_ids = [local.security_group_map[var.subnet_ids[count.index]]]. It properly references the local value `security_group_map` using the `local.` prefix, which is required in Terraform to access local values. It then uses the subnet ID from `var.subnet_ids[count.index]` as the key to look up the corresponding security group ID. This ensures each instance gets the correct security group based on its subnet index.

Answer

vpc_security_group_ids = [lookup(security_group_map, var.subnet_ids[count.index])]

Answer

vpc_security_group_ids = [security_group_map[var.subnet_ids[count.index]]]

Answer

vpc_security_group_ids = [lookup(local.security_group_map, var.subnet_ids[count.index])]

Question 15

Refer to the exhibit. What is the purpose of this output block?

Accepted Answer

To display the public IP address of the instance after apply.. The output block shown in the exhibit is a Terraform output value, which is defined using the `output` block in a configuration file. Its purpose is to display the public IP address of the instance in the terminal after `terraform apply` completes, providing a quick reference for the user. Option D correctly identifies this behavior, as outputs are designed to surface resource attributes to the user without storing them or creating external records.

Answer

To store the public IP in a local file.

Answer

To set the public IP as a variable for use in other configurations.

Answer

To create a DNS record with the public IP.