TF-003 Understand Terraform's purpose — 10 Questions

Question 1

A company wants to manage its infrastructure as code using Terraform. The team has a mix of on-premises servers and cloud resources in AWS and Azure. Which of the following best describes Terraform's purpose in this scenario?

Accepted Answer

Terraform is an infrastructure-as-code tool for provisioning and managing any infrastructure across multiple providers.. Option D is correct because Terraform is explicitly designed as an infrastructure-as-code tool that uses declarative configuration files to provision and manage resources across multiple providers, including on-premises servers (via providers like vSphere or Hyper-V) and cloud platforms like AWS and Azure. Its provider model allows it to abstract away the underlying APIs, making it provider-agnostic and suitable for hybrid environments.

Answer

Terraform is a configuration management tool for installing software on existing servers.

Answer

Terraform is a cloud-specific orchestration tool that only works with AWS.

Answer

Terraform is a monitoring and logging tool for cloud resources.

Question 2

A developer runs `terraform plan` and sees that Terraform will create a new S3 bucket and modify a security group. Which Terraform feature allows the developer to review these changes before applying them?

Accepted Answer

The `terraform plan` command. The `terraform plan` command creates an execution plan that shows what actions Terraform will take to achieve the desired state defined in the configuration. It compares the current state with the configuration and outputs a diff-like summary of resources to be created, modified, or destroyed, allowing the developer to review changes before applying them with `terraform apply`.

Answer

The `terraform apply` command

Answer

The `terraform validate` command

Answer

The `terraform state` command

Question 3

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 4

An organization uses Terraform Cloud for remote state management. A user runs `terraform apply` locally but receives an error that the state is locked. What is the most likely cause?

Accepted Answer

Another user or process is currently running a Terraform operation that modifies the same state.. Option C is correct because Terraform Cloud uses a state locking mechanism to prevent concurrent modifications that could corrupt the state file. When a user runs `terraform apply` locally, the command first attempts to acquire a lock on the remote state. If another user or process (e.g., a Terraform Cloud run, a CI/CD pipeline, or another local apply) is already holding that lock, the new operation will fail with a 'state is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The Terraform configuration has a syntax error.

Answer

The user does not have access to the remote state backend.

Answer

The remote backend is temporarily unavailable.

Question 5

Which TWO of the following are benefits of using Terraform's infrastructure as code approach?

Accepted Answer

Provisioning can be automated and repeated consistently across environments.. Option A is correct because Terraform's infrastructure as code approach allows you to define your entire infrastructure in declarative configuration files (HCL). These configurations can be executed repeatedly using `terraform apply`, ensuring that the same provisioning steps are performed consistently across development, staging, and production environments without manual intervention or drift.

Answer

Terraform automatically scales resources based on load.

Answer

Manual configuration of servers is eliminated entirely.

Answer

Terraform provides real-time monitoring of infrastructure health.

Question 6

Which THREE of the following are valid Terraform providers?

Accepted Answer

hashicorp/azurerm. Option A is correct because `hashicorp/azurerm` is the official Terraform provider for Microsoft Azure, published by HashiCorp in the Terraform Registry. It allows you to manage Azure resources such as virtual machines, storage accounts, and networking components using Terraform's declarative configuration language.

Answer

kreuzwerker/docker

Answer

hashicorp/cloudwatch

Question 7

Your organization manages a multi-cloud infrastructure using Terraform. The infrastructure includes an AWS VPC with subnets and EC2 instances, and an Azure resource group with virtual networks and VMs. The Terraform configuration is stored in a Git repository, and state is stored in an S3 bucket with DynamoDB locking. Recently, a developer updated the configuration to add a new security group rule in AWS, but after running `terraform apply`, the rule was not created. The developer verified that the configuration file contains the rule. Additionally, the developer noticed that the state file shows the security group exists but without the new rule. The developer ran `terraform plan` again, and it shows that the rule will be created. However, when applying, it fails with a 'timeout' error. The operations team suspects network connectivity issues to the S3 backend. What is the best course of action to resolve this issue?

Accepted Answer

Migrate the state backend to Terraform Cloud, and use remote operations for applies.. Option B is correct because the timeout error when applying, despite a successful plan, indicates that the issue is not with the configuration or state locking but with the network connectivity to the S3 backend during the apply operation. Migrating to Terraform Cloud with remote operations moves the execution environment to Terraform Cloud's infrastructure, which has reliable connectivity to the S3 backend, bypassing the local network issues. This resolves the timeout without altering the configuration or compromising state integrity.

Answer

Run `terraform init` again to reinitialize the backend.

Answer

Increase the timeout value in the Terraform provider configuration.

Answer

Disable state locking by removing the DynamoDB table reference.

Question 8

Which TWO statements accurately describe the purpose of Terraform? (Choose two.)

Accepted Answer

Terraform allows users to define infrastructure resources in a declarative configuration language.. Option A is correct because Terraform uses HashiCorp Configuration Language (HCL) to define infrastructure as code in a declarative manner, meaning users specify the desired end state of resources without scripting the step-by-step process. This declarative approach allows Terraform to automatically determine the necessary actions to reach that state, making infrastructure management predictable and repeatable.

Answer

Terraform is designed to work exclusively with AWS.

Answer

Terraform is a configuration management tool used for installing software on existing servers.

Answer

Terraform is a continuous integration and deployment tool.

Question 9

A team is reviewing the Terraform configuration shown in the exhibit. Which statement best describes the relationship between the two resources?

Accepted Answer

The two resources have no dependencies and can be created in any order.. Option C is correct because Terraform resources are independent by default unless an explicit or implicit dependency is declared. In the exhibit, the S3 bucket and EC2 instance are defined without any `depends_on` argument or attribute reference (e.g., `aws_s3_bucket.example.arn` used in the EC2 instance configuration). Therefore, Terraform can create them in parallel or any order, as there is no directed acyclic graph (DAG) edge enforcing a creation sequence.

Answer

The S3 bucket cannot be created until the EC2 instance is running.

Answer

The S3 bucket depends on the EC2 instance because it is defined after it.

Answer

The EC2 instance depends on the S3 bucket because the instance uses the bucket name.

Question 10

A company is adopting Terraform to manage its multi-cloud infrastructure on AWS and Azure. The infrastructure team has written several Terraform configurations stored in a Git repository. Each configuration is applied by different team members using their local machines. Recently, the team has been experiencing state file conflicts and inconsistencies, leading to infrastructure drift. The team currently stores the state file locally. They want to ensure that only one person can apply changes at a time and that the state file is always up-to-date. They also want to be able to collaborate effectively without overwriting each other's changes. Which approach should they implement?

Accepted Answer

Use Terraform Cloud to manage state and provide remote operations with locking.. Option A is correct because Terraform Cloud provides a managed remote state backend with built-in state locking and remote operations. This ensures that only one person can apply changes at a time (via the locking mechanism), the state file is always up-to-date (stored centrally), and team members can collaborate without overwriting each other's changes. It directly addresses the team's need for exclusive apply access and consistent state.

Answer

Have only one team member run terraform apply from a dedicated machine.

Answer

Store the state file in a shared Git repository and use git pull/push to sync changes.

Answer

Use a remote backend such as Amazon S3 with DynamoDB for state locking.