TF-004 Interact with Terraform modules Practice Test 1 — 15 Questions

Question 1

A team is using a module from the public Terraform Registry. They want to ensure that the module is pinned to a specific version to avoid unexpected changes. Which approach should they use?

Accepted Answer

Set 'version' in the module's source attribute, e.g., source = "terraform-aws-modules/vpc/aws" with version = "3.2.0".. It correctly demonstrates the Terraform syntax for pinning a module from the public registry: the `version` argument is a separate attribute within the module block, not embedded in the source string. Option B is ambiguous; while adding a `version` argument inside the module block is the right idea, the phrasing could be misinterpreted as placing the version inside the source attribute. The official Terraform documentation requires the version to be a standalone argument as shown in Option C. Option A is incorrect because `required_providers` locks provider versions, not module versions. Option D is a valid approach but is not the standard practice for registry modules.

Answer

Use 'required_providers' block in the root module to lock the module version.

Answer

Add a 'version' argument inside the module block.

Answer

Store the module locally in a vendor directory and reference it by path.

Question 2

Which TWO statements about Terraform module sources are correct? (Select TWO.)

Accepted Answer

A module source can be a local file system path.. Terraform supports various module sources. Option A is correct because a module source can indeed be a local file system path, allowing for development and testing of modules on your local machine using relative or absolute paths (e.g., `./modules/my-module`). Option D is also correct as Terraform can source modules directly from Git repositories, including those accessed via SSH protocol (e.g., `git::ssh://git@github.com/user/repo.git//path/to/module`). Other supported sources include HTTP/HTTPS URLs, S3 buckets, GCS buckets, and the Terraform Registry (public or private).

Answer

Modules can only be sourced from the public Terraform Registry.

Answer

Running 'terraform plan' automatically downloads any missing modules.

Answer

The module source is defined in a separate 'source' block within the module.

Question 3

Which THREE practices are recommended when using Terraform modules? (Select THREE.)

Accepted Answer

Design modules to have a single clear purpose.. Terraform modules should follow the single-responsibility principle: each module should encapsulate a clear, focused purpose (e.g., provisioning a VPC, an EC2 instance, or a database). This makes modules reusable, testable, and easier to compose. A module that tries to do too many things becomes brittle and hard to maintain. When referencing modules, especially from a registry, using version constraints (e.g., `version = "~> 1.0"`) is crucial for ensuring consistent deployments and preventing unexpected breaking changes from upstream module updates. Finally, modules should explicitly define outputs for any important resource attributes or computed values that consumers of the module might need to reference or use in other parts of their configuration.

Answer

Hardcode provider-specific details like region inside the module to simplify usage.

Answer

Create a new module for each individual resource type.

Question 4

The above configuration references a module from the Terraform Registry. After running 'terraform init', the user runs 'terraform plan' and gets an error: 'Error: Unsupported argument' for 'version'. What is the most likely cause?

Accepted Answer

The 'version' argument is not supported for this module because the source is not a registry module.. The error 'Unsupported argument' for 'version' is a definitive indicator that Terraform does not recognize the module source as a registry module. The 'version' argument is exclusively supported for modules sourced from the Terraform Registry. Therefore, despite the STEM's initial statement, the error implies that the module source is not being treated as a registry module. Option A correctly identifies this core reason. Option C is a specific instance of a non-registry module, but the error itself points to the broader category. Options B and D describe valid syntax or constraints for supported scenarios, which is not the case here.

Answer

The 'version' argument must be specified as a constraint like '>= 3.19.0' instead of an exact version.

Answer

The module source is from a Git repository, which does not support the 'version' argument.

Answer

The 'version' argument should be placed inside a 'required_providers' block.

Question 5

Which TWO statements about Terraform module structure and best practices are correct? (Choose two.)

Accepted Answer

A module should define variables for any values that need to be customized by the calling configuration.. Terraform modules are designed to be reusable and configurable.

**Statement A**: By defining input variables for any customizable values (e.g., resource names, sizes, regions), the module abstracts away hardcoded details and allows the calling configuration to pass in specific values via variable assignments. This follows the principle of encapsulation, where the module's internal logic remains unchanged while its behavior adapts to the caller's needs.

**Statement D**: Modules can be sourced from various locations, including local paths relative to the calling configuration. This is a common pattern for organizing smaller, internal modules within the same repository or project directory, allowing for modularity without requiring separate version control repositories for every small module.

Answer

A module should assume the calling configuration will provide all necessary provider configurations.

Answer

A module must have all Terraform code in a single main.tf file.

Answer

A module should rely on direct attribute references to resources in the calling configuration.

Question 6

Your company manages infrastructure for multiple environments (dev, staging, prod) using Terraform. You have a shared networking module stored in a private Git repository. The module is used by several root configurations. The current workflow requires developers to manually update the module version in each root module's source attribute when a new version is tagged. This has led to configuration drift and occasional use of incompatible module versions. You want to implement a more reliable approach that ensures all environments use the same consistent version of the module, while still allowing controlled upgrades. Which approach best addresses this concern?

Accepted Answer

Pin each root module to a specific Git tag (e.g., ref=v1.2.3) and manually update each root module when a new tag is created.. It uses Git tags to pin each root module to a specific version (e.g., ref=v1.2.3), ensuring all environments use the same module version. While the current workflow already does this, the key improvement is to adopt a coordinated update process where all root modules are updated simultaneously when a new tag is created, preventing drift. This approach works with private Git repositories, as version constraints (like ~> 1.2) are not supported for Git module sources.

Answer

Publish the module to the public Terraform Registry and use a version constraint in each root module.

Answer

Remove the version constraint from the module source so that Terraform always fetches the latest commit from the default branch.

Answer

Use a version constraint like "~> 1.2" in the module source and adopt a workflow to update the constraint across all root modules simultaneously only when ready.

Question 7

Which three of the following describe correct practices or behaviors when interacting with Terraform modules? (Choose three.)

Accepted Answer

A module source can be a local file path, such as './modules/networking'.. Option A is correct because Terraform modules can be sourced from a local file path using the `source` argument, such as `'./modules/networking'`, allowing reference to modules within the same repository or filesystem. Option C is correct because module outputs are accessible in the root configuration via `module..`. Option F is correct because the `terraform get` command downloads and updates modules from remote registries (and also updates local modules if the source has changed). Options B, D, and E are incorrect: B is incorrect because Terraform does not automatically apply local changes made inside the `.terraform/modules` directory; these changes can be overwritten by subsequent `terraform init` or `terraform get` commands. D is incorrect because modules can be sourced from various locations including local paths, Git repositories, and HTTP URLs, not just the public Terraform Registry. E is incorrect because module input variables are not automatically populated from environment variables without explicit variable declarations; they must be explicitly defined and then can be overridden by environment variables (TF_VAR_name).

Answer

When using a module from a Git repository, Terraform automatically applies any local changes made inside the `.terraform/modules` directory.

Answer

Terraform modules can only be sourced from the public Terraform Registry.

Answer

Module input variables are automatically populated from environment variables without explicit variable declarations.

Question 8

Which TWO module source types are supported by Terraform natively?

Accepted Answer

Terraform Registry (e.g., hashicorp/consul/aws). Terraform natively supports the Terraform Registry as a module source, using the shorthand syntax like `hashicorp/consul/aws` which resolves to a registry-based module. The Terraform Registry is the default public registry, and Terraform can also use private registries via the `registry.terraform.io` hostname. This is a built-in source type that requires no additional plugins or configuration. Additionally, Terraform natively supports local file paths (e.g., `./modules/vpc`) for modules, allowing for modularization within a single repository or local development before publishing to a registry.

Answer

Docker Hub repositories

Answer

Jenkins plugin repository

Answer

npm packages

Question 9

Given the plan output, how is the module 'instances' configured in the root module?

Accepted Answer

The root module uses for_each in the module block with a map variable.. The explanation correctly describes the characteristics of a Terraform plan output when `for_each` is used on a module block with a map variable (key-value structure like 'instance1', 'instance2'). However, this description *is* the missing input from the STEM. The explanation's role is to justify the correct answer based on the *provided* STEM and options, not to provide missing context from the STEM itself. If the described plan output were provided in the STEM, the explanation would be accurate and the answer correct.

Answer

The module uses count with a list variable.

Answer

The module is declared twice with different names.

Answer

The module contains a resource with for_each inside.

Question 10

Which of the following files is NOT required in a Terraform module?

Accepted Answer

providers.tf. The explanation incorrectly states that `variables.tf` and `outputs.tf` are essential for a reusable module. A module can be reusable and functional without input variables (thus no `variables.tf`) or without output values (thus no `outputs.tf`). While `main.tf` is conventionally used for core resource definitions, its specific name is not strictly required, as resources can be defined in any `.tf` file. `providers.tf` is indeed not strictly required, as provider configurations can be inherited from the calling module or defined via `required_providers` blocks in other files (e.g., `main.tf`). Therefore, `variables.tf`, `outputs.tf`, and `providers.tf` are all technically not strictly required files in a Terraform module, making the question ambiguous if only one answer is expected.

Answer

main.tf

Question 11

You have a list of VPC configurations and want to create multiple VPCs using a single module block with for_each. Which statement is true?

Accepted Answer

When using for_each, the module's outputs will be a map of output values for each instance.. When you use `for_each` on a module block, Terraform creates multiple instances of the module, and the module's outputs become a map of output values keyed by the `for_each` key. This allows you to access each instance's outputs via the map, enabling iteration over the created resources.

Answer

for_each on a module is not supported.

Answer

You can use for_each on a module block only if the module is published in the registry.

Answer

for_each on a module block requires the module to support count.

Question 12

Which module source type does NOT support version constraints?

Accepted Answer

Local path. Local path module sources (e.g., `./modules/foo`) and HTTP URL sources (e.g., `https://example.com/module.tar.gz`) do not support version constraints because there is no remote registry or repository to resolve a version from. Terraform uses the local filesystem path or downloads the HTTP URL directly, so the `version` argument in a `module` block is ignored for these source types. In contrast, Git repositories and the Terraform Registry both support version constraints via their respective resolution mechanisms.

Answer

Git repository

Answer

Terraform Registry

Question 13

Which TWO of the following are valid ways to reference a module from the Terraform Registry?

Accepted Answer

source = "hashicorp/consul/aws". The Terraform Registry uses a three-part namespace format: `//`, where `hashicorp/consul/aws` specifies the `consul` module from the `hashicorp` namespace for the `aws` provider. This format is the standard way to reference a module hosted in the public Terraform Registry, and Terraform automatically resolves it to the registry's HTTPS URL.

Answer

source = "hashicorp/consul"

Answer

source = "github.com/hashicorp/terraform-aws-consul"

Answer

source = "./modules/consul"

Question 14

You are developing a module. Which TWO actions are recommended best practices?

Accepted Answer

Use local values to simplify expressions.. Options B and D are correct. Using local values (B) simplifies expressions and improves readability within a module, as recommended by Terraform best practices. Defining outputs (D) for resources that need to be consumed by the root module or other modules enables proper data flow and reusability. Option A is incorrect because relying on the same provider configuration as the root module reduces module portability; explicit provider configurations are preferred. Option C is incorrect because hardcoding default values reduces flexibility for module consumers; variables should have sensible defaults but allow overrides. Option E is incorrect because absolute paths make modules less portable; relative paths or module registries are preferred.

Answer

Use the same provider configuration as the root module.

Answer

Hardcode default values for all variables.

Answer

Define outputs for all resources created.

Answer

Use absolute paths in module source.

Question 15

A company uses a Terraform module from the registry for AWS VPC (source = "terraform-aws-modules/vpc/aws", version = "3.0.0"). They updated the module version to "3.1.0" and ran terraform plan. To their surprise, the plan shows that all VPC resources will be replaced (destroyed and recreated) instead of updated in place. They did not change any input variables. The module's release notes mention only bug fixes and minor improvements. What is most likely causing the full resource replacement?

Accepted Answer

The module's new version changed the resource names or identifiers.. If the module changes the internal resource names (e.g., from 'aws_vpc.main' to 'aws_vpc.this'), Terraform interprets the old resources as removed and new ones to create, resulting in full replacement. This is a common issue when a module renames its resources between versions, even if the functionality remains the same. Option A is incorrect because a new required variable would cause Terraform to prompt for a value or throw an error, not generate a plan showing resource replacement. Option B is incorrect because while a change in the default CIDR block could trigger replacement of the VPC resource if the user was relying on the default and the attribute is immutable, such a fundamental change in a default for a core resource like VPC is highly unlikely in a minor version update (3.0.0 to 3.1.0) that only mentions 'bug fixes and minor improvements' without explicit warning of a breaking change. Renaming internal resources (Option D) is a more common cause for full resource replacement during module refactoring in minor versions. Option C is incorrect because provider version changes alone rarely force replacement unless there are incompatible schema changes, which are unlikely in a minor version update.

Answer

The module's new version introduced a new required variable.

Answer

The module's new version changed the default CIDR block.

Answer

The module's new version uses a different provider version.