TF-004 Read, generate and modify configuration Practice Test 4 — 15 Questions

Question 1

A team uses remote state stored in an S3 bucket with DynamoDB locking. A developer wants to read the current state outputs locally without making changes. Which command should they use?

Accepted Answer

terraform output. The `terraform output` command retrieves and displays the values of output variables from the current state file. When using remote state with S3 and DynamoDB locking, this command reads the state from the backend without acquiring a lock or modifying the state, making it the safe, read-only option for viewing outputs.

Answer

terraform state pull

Answer

terraform console

Answer

terraform plan

Question 2

In Terraform, which block is used to define a default value for a variable that can be overridden at runtime?

Accepted Answer

variable. In Terraform, the `variable` block is used to declare input variables, which can include a `default` argument to specify a fallback value. This default can be overridden at runtime using mechanisms like `-var` flags, `TF_VAR_` environment variables, or `.tfvars` files, making option B correct.

Answer

locals

Answer

output

Answer

terraform

Question 3

A Terraform configuration uses a for_each expression to create multiple subnets. After applying, one subnet's configuration needs to be modified. The engineer updates the resource block's map key for that subnet. What will terraform plan show?

Accepted Answer

Destruction of the existing subnet and creation of a new one.. When a for_each expression is used, Terraform identifies each resource instance by its map key. Changing the map key for a subnet causes Terraform to treat the old key as a resource to be destroyed and the new key as a resource to be created, because the key is part of the resource's identity. Even if the configuration inside the block is identical, the change in key results in a destroy-and-create action, not an in-place update.

Answer

No changes because the subnet configuration is the same.

Answer

Only deletion of the old subnet.

Answer

An in-place update to the subnet.

Question 4

When running terraform plan, the output indicates that a resource will be replaced (destroy then create) due to a change in the 'name' attribute. However, the engineer only changed a tag. What is the most likely cause?

Accepted Answer

The 'name' attribute is computed and any change to the resource forces replacement.. When a resource attribute is marked as 'computed' and 'ForceNew' in the Terraform provider schema, any change to that attribute—or, in some provider implementations, any change to the resource at all—triggers a destroy-and-create cycle. In this scenario, the engineer changed only a tag, but the provider has been configured to treat the entire resource as requiring replacement if any attribute changes, often because the 'name' attribute is computed from other inputs or because the provider's internal logic forces replacement on any update. This is a known behavior in certain Terraform providers where the 'name' attribute is set to 'Computed' and 'ForceNew' in the schema, causing any modification to the resource to result in a plan that shows replacement.

Answer

The tag change triggered a ForceNew attribute.

Answer

The resource has create_before_destroy enabled.

Answer

The underlying API does not support in-place updates.

Question 5

An operator wants to test an expression used in a Terraform configuration without running a plan or apply. Which command allows interactive evaluation of expressions?

Accepted Answer

terraform console. The `terraform console` command opens an interactive Read-Eval-Print Loop (REPL) that allows operators to evaluate Terraform expressions, including interpolations and functions, using the current state and configuration without executing a plan or apply. This is the only command designed specifically for ad-hoc expression testing in a live context.

Answer

terraform validate

Answer

terraform plan -out=test.tfplan

Answer

terraform output

Question 6

A DevOps engineer wants to modify the Terraform configuration to control resource lifecycle behavior. Which TWO meta-arguments can be used to influence the order of creation and destruction?

Accepted Answer

create_before_destroy. `create_before_destroy` is a meta-argument used within a `lifecycle` block to instruct Terraform to create a replacement resource before destroying the existing one, directly influencing the order of creation and destruction during updates. Option B is correct because `depends_on` explicitly sets dependencies between resources, ensuring that Terraform creates or destroys resources in a specific order based on those declared dependencies.

Answer

for_each

Answer

prevent_destroy

Answer

count

Question 7

A developer has a Terraform configuration that includes an output block. They run `terraform apply` and then want to quickly retrieve the output value without re-running the entire apply. Which command should they use?

Accepted Answer

terraform output. The `terraform output` command is specifically designed to retrieve the values of output variables from the state file without re-running the entire `terraform apply` operation. It reads the outputs stored in the Terraform state after a successful apply, making it the fastest and most direct way to access those values. This command supports flags like `-json` for structured output and can target a specific output by name.

Answer

terraform plan

Answer

terraform state list

Answer

terraform show

Question 8

An operator modifies a Terraform configuration to change the `ami` attribute of an `aws_instance` resource. When they run `terraform plan`, they see that the resource will be destroyed and recreated. They want to avoid the recreation and instead update the instance in-place. What is the best approach?

Accepted Answer

Accept the recreation; it is required for this attribute. Changing the `ami` attribute of an `aws_instance` resource is a force-new attribute in the AWS provider. Terraform cannot update the AMI of a running EC2 instance in-place; it must destroy the existing instance and create a new one with the new AMI. This is a fundamental constraint of the AWS API, not a Terraform limitation.

Answer

Add `create_before_destroy` lifecycle rule

Answer

Use `ignore_changes` in lifecycle to ignore AMI changes

Answer

Add `prevent_destroy` lifecycle rule

Question 9

A team is using a remote backend for Terraform state. After merging a pull request that modifies the configuration, the pipeline runs `terraform plan` and sees an unexpected diff for a resource that was not changed in the code. The state file is up-to-date with the infrastructure. What is the most likely cause?

Accepted Answer

The actual infrastructure was modified outside of Terraform. When infrastructure is modified outside of Terraform (e.g., via the cloud console, CLI, or another tool), the next `terraform plan` will detect a drift between the actual infrastructure state and the desired configuration in the code. Since the state file is up-to-date with the infrastructure, the unexpected diff indicates that the remote state accurately reflects the live environment, but the configuration no longer matches due to external changes. This is a classic case of configuration drift, which Terraform surfaces as a plan diff even when no code changes were made.

Answer

The provider version has been updated and includes a change to the resource schema

Answer

A previous `terraform state rm` command removed the resource from state

Answer

The state file is stale and needs to be refreshed

Question 10

A junior engineer is asked to review a Terraform configuration that defines a module from the Terraform Registry. In which files are the descriptions of the module’s inputs and outputs typically found?

Accepted Answer

variables.tf. In Terraform modules, input variables are declared in `variables.tf` with `description` arguments to document their purpose, and output values are declared in `outputs.tf` with `description` arguments. Therefore, descriptions of both inputs and outputs are found in these two files. Neither file alone describes both; the question's phrasing implies consideration of both files, making both B and C correct.

Answer

versions.tf

Answer

main.tf

Question 11

A DevOps engineer needs to generate multiple similar AWS EC2 instances from a single resource block. They want each instance to have a unique name tag based on an index. Which approach should they use?

Accepted Answer

Use `count` and reference `count.index` for the name tag. The `count` meta-argument creates multiple resources from a single resource block, and `count.index` provides a zero-based index for each instance. This index can be used directly in the name tag, such as `"instance-${count.index}"`, to generate unique names. `count` is the simplest and most appropriate mechanism when you need a fixed number of similar resources differentiated by an index.

Answer

Use a `locals` block to define multiple resources

Answer

Use `for_each` and reference `each.key` for the name tag

Answer

Use a `terraform_data` resource to loop

Question 12

An organization has a policy that all AWS S3 buckets must have versioning enabled. They want to ensure that even if someone removes the `versioning` block from the configuration, the bucket still has versioning enabled after `terraform apply`. Which lifecycle configuration should they add to the `aws_s3_bucket` resource?

Accepted Answer

`ignore_changes = [versioning]`. `ignore_changes = [versioning]` tells Terraform to disregard any changes to the `versioning` block in the configuration during `terraform apply`. This ensures that even if someone removes the `versioning` block from the HCL, the existing versioning state on the S3 bucket (enabled) remains unchanged, enforcing the organization's policy.

Answer

`replace_triggered_by = [aws_s3_bucket_versioning.this]`

Answer

`prevent_destroy`

Answer

`create_before_destroy`

Question 13

After running `terraform plan`, a developer sees the following line in the output: `Plan: 1 to add, 0 to change, 0 to destroy.` What does this indicate?

Accepted Answer

One resource will be created.. The output `Plan: 1 to add, 0 to change, 0 to destroy` directly indicates that Terraform will create one new resource, with no modifications or removals. The 'add' count in a Terraform plan corresponds to resources that exist in the configuration but not in the current state file, meaning they will be provisioned during the apply phase.

Answer

One resource will be destroyed.

Answer

No changes will be made.

Answer

One resource will be changed.

Question 14

A configuration defines a variable `instance_type` with a default value `t2.micro`. After running `terraform apply`, the operator notices that the instances are being created with type `t2.small`. They check the configuration file and see the default is `t2.micro`. What is the most likely cause?

Accepted Answer

A `terraform.tfvars` file in the working directory sets the variable to `t2.small`.. Terraform automatically loads any file named `terraform.tfvars` or `*.auto.tfvars` in the working directory, and the variable values defined in these files override the default values declared in the configuration. Even though the configuration file shows `instance_type` defaulting to `t2.micro`, the presence of a `terraform.tfvars` file setting `instance_type = "t2.small"` will cause Terraform to use `t2.small` during `apply`, explaining the observed behavior.

Answer

The variable declaration was changed after apply.

Answer

The state file stores the variable value and overrides the default.

Answer

The `instance_type` attribute was changed by a lifecycle rule.

Question 15

Which TWO of the following are best practices when writing Terraform configuration for a team? (Select TWO.)

Accepted Answer

Pin provider versions using `required_providers`.. Options B and D are correct. Pinning provider versions using `required_providers` ensures reproducibility across team members. Using a remote backend with state locking prevents state corruption and conflicts. Option A is wrong because using `latest` versions can introduce breaking changes unexpectedly. Option C is wrong because hardcoding values (especially secrets) is insecure and inflexible. Option E is wrong because a single monolithic configuration file is harder to maintain and collaborate on.

Answer

Always use the `latest` version for providers.

Answer

Hardcode all values in the configuration for simplicity.

Answer

Store the entire infrastructure in a single configuration file.