TF-004 Understand Terraform's purpose — 20 Questions

Question 1

Which TWO of the following are benefits of using Terraform's infrastructure as code approach?

Accepted Answer

Provisioning can be automated and repeated consistently across environments.. Terraform's infrastructure as code approach allows you to define your entire infrastructure in declarative configuration files (HCL). These configurations can be executed repeatedly using `terraform apply`, ensuring that the same provisioning steps are performed consistently across development, staging, and production environments without manual intervention or drift. Furthermore, by defining infrastructure as code, these configuration files can be stored in version control systems (like Git), enabling collaboration, change tracking, and code review processes similar to application development.

Answer

Terraform automatically scales resources based on load.

Answer

Manual configuration of servers is eliminated entirely.

Answer

Terraform provides real-time monitoring of infrastructure health.

Question 2

Which TWO of the following are key advantages of using Terraform over manual infrastructure management? (Select TWO.)

Accepted Answer

Consistent and repeatable deployments. Terraform uses declarative configuration files (HCL) to define the desired state of infrastructure. This approach ensures that deployments are consistent and repeatable across environments, eliminating human error and configuration drift common with manual management. Furthermore, defining infrastructure as code allows these configuration files to be stored in version control systems (like Git), enabling tracking of changes, collaboration, and easy rollbacks, which is a key advantage over manual infrastructure management.

Answer

Guaranteed zero downtime during updates

Answer

Automatic discovery of existing resources

Answer

Self-healing infrastructure

Question 3

Which THREE statements accurately describe Terraform state? (Select THREE.)

Accepted Answer

State is used to map real-world resources to configuration.. Terraform state is the primary mechanism for mapping real-world infrastructure resources to the configuration defined in your .tf files. Each resource in the state file has a unique address and attributes that correspond to the actual resource in the cloud provider, enabling Terraform to detect drift and plan updates accurately. By default, Terraform stores this state locally in a `terraform.tfstate` file. For team collaboration and production environments, state can be shared and managed centrally using remote backends, which also often provide features like state locking.

Answer

State contains sensitive data by default.

Answer

State is automatically locked to prevent concurrent modifications.

Question 4

Which TWO of the following are core components of Terraform's workflow? (Select TWO.)

Accepted Answer

terraform init. Terraform's core workflow consists of three main steps: init, plan, and apply. `terraform init` initializes the working directory by downloading the required providers and modules, setting up the backend, and preparing the environment for configuration. `terraform plan` creates an execution plan showing what actions Terraform will take to reach the desired state, allowing you to preview changes before applying them.

Answer

terraform validate

Answer

terraform install

Answer

terraform destroy

Question 5

An organization has multiple teams using Terraform to manage shared infrastructure. They want to enforce policies such as requiring specific tags on all resources and preventing the use of certain instance types. Which Terraform feature should they implement to meet these requirements?

Accepted Answer

Sentinel policy enforcement. Sentinel is HashiCorp's policy-as-code framework that integrates with Terraform Cloud and Enterprise to enforce fine-grained, logic-based policies before resources are created or modified. It can mandate that all resources carry specific tags (e.g., `required_tags`) and block prohibited instance types (e.g., `t2.micro`) by evaluating Terraform plan output against Sentinel rules, making it the correct choice for these governance requirements.

Answer

Terraform workspaces

Answer

Custom Terraform providers

Answer

Remote backends with state locking

Question 6

Which THREE are part of Terraform's core workflow? (Choose three.)

Accepted Answer

Apply. Terraform's core workflow consists of three main steps: 
1.  **Write**: Authoring the infrastructure as code using HashiCorp Configuration Language (HCL) in `.tf` files.
2.  **Plan**: Generating an execution plan that shows what Terraform will do to achieve the desired state, without actually making any changes. This step allows for review and approval.
3.  **Apply**: Executing the plan to provision or modify the infrastructure resources as defined in the configuration.
Commands like `import` and `destroy` are auxiliary operations, not part of the standard iterative core workflow for creating and managing infrastructure.

Answer

Import

Answer

Destroy

Question 7

A company wants to manage its infrastructure as code using Terraform. The team has a mix of on-premises servers and cloud resources in AWS and Azure. Which of the following best describes Terraform's purpose in this scenario?

Accepted Answer

Terraform is an infrastructure-as-code tool for provisioning and managing any infrastructure across multiple providers.. Terraform is explicitly designed as an infrastructure-as-code tool that uses declarative configuration files to provision and manage resources across multiple providers, including on-premises servers (via providers like vSphere or Hyper-V) and cloud platforms like AWS and Azure. Its provider model allows it to abstract away the underlying APIs, making it provider-agnostic and suitable for hybrid environments.

Answer

Terraform is a configuration management tool for installing software on existing servers.

Answer

Terraform is a cloud-specific orchestration tool that only works with AWS.

Answer

Terraform is a monitoring and logging tool for cloud resources.

Question 8

A developer runs `terraform plan` and sees that Terraform will create a new S3 bucket and modify a security group. Which Terraform feature allows the developer to review these changes before applying them?

Accepted Answer

The `terraform plan` command. The `terraform plan` command creates an execution plan that shows what actions Terraform will take to achieve the desired state defined in the configuration. It compares the current state with the configuration and outputs a diff-like summary of resources to be created, modified, or destroyed, allowing the developer to review changes before applying them with `terraform apply`.

Answer

The `terraform apply` command

Answer

The `terraform validate` command

Answer

The `terraform state` command

Question 9

A team is using Terraform to manage multiple environments (dev, staging, prod) with the same configuration but different variable values. They want to avoid duplicating configuration files. Which Terraform feature is best suited for this?

Accepted Answer

Terraform workspaces. Terraform workspaces allow you to manage multiple environments (e.g., dev, staging, prod) using the same root configuration and variable definitions, but with separate state files. This avoids duplicating configuration files while enabling environment-specific variable values via `terraform.workspace` interpolation or separate `.tfvars` files per workspace. Option D is correct because workspaces are the native Terraform feature designed for this exact use case.

Answer

Terraform modules with separate directories for each environment

Answer

Terraform data sources to fetch environment-specific variables

Answer

Using multiple Terraform configuration files in a single directory

Question 10

An organization uses Terraform Cloud for remote state management. A user runs `terraform apply` locally but receives an error that the state is locked. What is the most likely cause?

Accepted Answer

Another user or process is currently running a Terraform operation that modifies the same state.. Terraform Cloud uses a state locking mechanism to prevent concurrent modifications that could corrupt the state file. When a user runs `terraform apply` locally, the command first attempts to acquire a lock on the remote state. If another user or process (e.g., a Terraform Cloud run, a CI/CD pipeline, or another local apply) is already holding that lock, the new operation will fail with a 'state is locked' error. This is a fundamental safety feature to ensure state consistency.

Answer

The Terraform configuration has a syntax error.

Answer

The user does not have access to the remote state backend.

Answer

The remote backend is temporarily unavailable.

Question 11

Which THREE of the following are valid Terraform providers?

Accepted Answer

hashicorp/azurerm. All four options A, B, C, D are valid Terraform providers. Options A (hashicorp/azurerm), C (hashicorp/kubernetes), and D (hashicorp/aws) are official HashiCorp providers. Option B (kreuzwerker/docker) is a well-known community provider for Docker. The question asks for 'valid' providers, which includes both official and community providers. Option E (hashicorp/cloudwatch) is not a valid standalone provider because CloudWatch is a service within AWS and is managed by the hashicorp/aws provider.

Answer

hashicorp/cloudwatch

Question 12

Your organization manages a multi-cloud infrastructure using Terraform. The infrastructure includes an AWS VPC with subnets and EC2 instances, and an Azure resource group with virtual networks and VMs. The Terraform configuration is stored in a Git repository, and state is stored in an S3 bucket with DynamoDB locking. Recently, a developer updated the configuration to add a new security group rule in AWS, but after running `terraform apply`, the rule was not created. The developer verified that the configuration file contains the rule. Additionally, the developer noticed that the state file shows the security group exists but without the new rule. The developer ran `terraform plan` again, and it shows that the rule will be created. However, when applying, it fails with a 'timeout' error. The operations team suspects network connectivity issues to the S3 backend. What is the best course of action to resolve this issue?

Accepted Answer

Migrate the state backend to Terraform Cloud, and use remote operations for applies.. The timeout error when applying, despite a successful plan, indicates that the issue is not with the configuration or state locking but with the network connectivity to the S3 backend during the apply operation. Migrating to Terraform Cloud with remote operations moves the execution environment to Terraform Cloud's infrastructure, which has reliable connectivity to the S3 backend, bypassing the local network issues. This resolves the timeout without altering the configuration or compromising state integrity.

Answer

Run `terraform init` again to reinitialize the backend.

Answer

Increase the timeout value in the Terraform provider configuration.

Answer

Disable state locking by removing the DynamoDB table reference.

Question 13

Which TWO statements accurately describe the purpose of Terraform? (Choose two.)

Accepted Answer

Terraform allows users to define infrastructure resources in a declarative configuration language.. Terraform uses HashiCorp Configuration Language (HCL) to define infrastructure as code in a declarative manner, meaning users specify the desired end state of resources without scripting the step-by-step process. This declarative approach allows Terraform to automatically determine the necessary actions to reach that state, making infrastructure management predictable and repeatable.

Answer

Terraform is designed to work exclusively with AWS.

Answer

Terraform is a configuration management tool used for installing software on existing servers.

Answer

Terraform is a continuous integration and deployment tool.

Question 14

A team is reviewing the Terraform configuration shown in the exhibit. Which statement best describes the relationship between the two resources?

Accepted Answer

The two resources have no dependencies and can be created in any order.. Terraform resources are independent by default unless an explicit or implicit dependency is declared. In the exhibit, the S3 bucket and EC2 instance are defined without any `depends_on` argument or attribute reference (e.g., `aws_s3_bucket.example.arn` used in the EC2 instance configuration). Therefore, Terraform can create them in parallel or any order, as there is no directed acyclic graph (DAG) edge enforcing a creation sequence.

Answer

The S3 bucket cannot be created until the EC2 instance is running.

Answer

The S3 bucket depends on the EC2 instance because it is defined after it.

Answer

The EC2 instance depends on the S3 bucket because the instance uses the bucket name.

Question 15

A company is adopting Terraform to manage its multi-cloud infrastructure on AWS and Azure. The infrastructure team has written several Terraform configurations stored in a Git repository. Each configuration is applied by different team members using their local machines. Recently, the team has been experiencing state file conflicts and inconsistencies, leading to infrastructure drift. The team currently stores the state file locally. They want to ensure that only one person can apply changes at a time and that the state file is always up-to-date. They also want to be able to collaborate effectively without overwriting each other's changes. Which approach should they implement?

Accepted Answer

Use Terraform Cloud to manage state and provide remote operations with locking.. Terraform Cloud provides a managed remote state backend with built-in state locking and remote operations. This ensures that only one person can apply changes at a time (via the locking mechanism), the state file is always up-to-date (stored centrally), and team members can collaborate without overwriting each other's changes. It directly addresses the team's need for exclusive apply access and consistent state.

Answer

Have only one team member run terraform apply from a dedicated machine.

Answer

Store the state file in a shared Git repository and use git pull/push to sync changes.

Answer

Use a remote backend such as Amazon S3 with DynamoDB for state locking.

Question 16

A junior DevOps engineer is learning about Infrastructure as Code (IaC) and asks why Terraform is preferred over manual configuration in cloud consoles. Which of the following is the primary benefit of using Terraform for infrastructure management?

Accepted Answer

It enables version-controlled, repeatable, and automated infrastructure provisioning.. Terraform's core value proposition is enabling infrastructure as code (IaC), which allows teams to define infrastructure in declarative configuration files, version control them with Git, and provision consistently across environments. This repeatability and automation eliminate the drift and manual errors inherent in clicking through cloud consoles, making infrastructure management auditable, collaborative, and scalable.

Answer

It can only manage infrastructure on major cloud providers like AWS, Azure, and GCP.

Answer

It automatically rolls back any failed infrastructure changes.

Answer

It uses an imperative approach where you specify exact commands to execute.

Question 17

A team is evaluating Terraform for managing their multi-cloud infrastructure. Which TWO statements accurately describe Terraform's purpose and capabilities? (Choose two.)

Accepted Answer

Terraform can provision, update, and destroy infrastructure resources across multiple providers.. Terraform is designed as an infrastructure-as-code tool that can provision, update, and destroy resources across multiple cloud providers (e.g., AWS, Azure, GCP) and other services using a declarative configuration. This multi-provider capability is a core differentiator from single-cloud tools, enabling consistent workflows for hybrid and multi-cloud environments.

Answer

Terraform requires all configuration files to be placed in a single directory named 'terraform'.

Answer

Terraform uses an imperative language to specify the exact steps to create resources.

Answer

Terraform is primarily a configuration management tool for installing software on servers.

Question 18

A team member runs terraform apply with the configuration shown in the exhibit. The apply succeeds, but the output of the local-exec provisioner shows an empty string for the public IP address. What is the most likely cause?

Accepted Answer

The aws_instance resource does not have a public IP assigned because it is launched in a default VPC without auto-assign public IP, and no Elastic IP is attached.. The `local-exec` provisioner runs on the machine executing Terraform, not on the AWS instance itself. If the instance is launched in a default VPC without `auto-assign public IP` enabled and no Elastic IP is attached, the `self.public_ip` attribute will be an empty string. The provisioner then outputs that empty string, as it simply reads the attribute value from the resource state.

Answer

There is a dependency cycle between the aws_instance and null_resource causing Terraform to skip the provisioner.

Answer

The local-exec provisioner only runs during terraform destroy, not during apply.

Answer

The provisioner cannot access the aws_instance resource's attributes because it is defined in a separate resource block.

Question 19

Which three of the following best describe the core purpose and capabilities of Terraform? (Choose three.)

Accepted Answer

It maintains a state file to map real-world resources to your configuration and to track metadata such as resource dependencies.. Terraform is an infrastructure as code (IaC) tool that uses a declarative configuration language (HCL) to define and provision data center infrastructure. It manages both low-level components (e.g., compute instances, storage) and high-level components (e.g., DNS records, SaaS resources) across multiple cloud providers and on-premises systems via providers. Terraform maintains a state file to map real-world resources to your configuration, track metadata like dependencies, and enable incremental updates.

Answer

It requires a running daemon or agent on each target machine to execute resource changes.

Answer

It is primarily a configuration management tool for installing and configuring software on existing servers.

Answer

It only supports public cloud providers (AWS, Azure, GCP) and cannot manage on-premises infrastructure.

Question 20

Which of the following accurately describe core purposes and benefits of using Terraform in a cloud infrastructure environment? Choose all that apply. (There are four correct answers.)

Accepted Answer

Facilitates collaboration through remote state backends and version-controlled configuration files.. Terraform's core purpose is to enable Infrastructure as Code (IaC) by allowing users to define cloud resources in declarative HCL (HashiCorp Configuration Language) files. It automates provisioning and lifecycle management across multiple providers (AWS, Azure, GCP, etc.) using a single workflow. State management is fundamental: Terraform maintains a state file to track real-world resources, enabling incremental planning and safe updates. Collaboration is facilitated by storing state remotely (e.g., in S3, Terraform Cloud) and using version control for configuration files, ensuring team consistency and auditability.

Answer

Generates real-time billing and cost optimization recommendations for deployed resources.

Answer

Provides a built-in drift detection mechanism that automatically reverts unauthorized manual changes to infrastructure.