TF-004 Understand Terraform's purpose Practice Test 3 — 15 Questions

Question 1

Which TWO tasks are better suited for configuration management tools than Terraform?

Accepted Answer

Installing software packages. Installing software packages and configuring web server settings are typical tasks for configuration management tools like Ansible or Puppet, as they operate on existing servers. Terraform, by contrast, is designed for provisioning infrastructure resources such as VPCs, IAM roles, and network ACLs. Therefore, options A and E are correct.

Answer

Managing network ACLs

Answer

Provisioning a VPC

Answer

Creating IAM roles

Question 2

Refer to the exhibit. What does this output indicate?

Accepted Answer

A resource will be modified. The output shows a Terraform plan with a tilde (~) prefix next to a resource attribute, which indicates an in-place update. This means Terraform will modify the existing resource without destroying and recreating it, confirming that option A is correct.

Answer

A resource will be destroyed

Answer

No changes

Answer

A resource will be created

Question 3

Refer to the exhibit. What is the purpose of the data source?

Accepted Answer

To fetch an existing AMI ID. In Terraform, a data source allows you to fetch or compute information from external sources that is not defined within the current configuration. The correct answer is B because the data source in the exhibit (e.g., `aws_ami`) is used to query and retrieve the ID of an existing AMI that matches specified filters, such as name, owner, or tag, without creating a new AMI. This enables dynamic referencing of pre-existing resources in your infrastructure.

Answer

To create a new AMI

Answer

To define a variable

Answer

To output the AMI name

Question 4

Refer to the exhibit. What does this output show?

Accepted Answer

Resources managed by Terraform. The output shows a list of resources that Terraform is currently tracking in its state file. This indicates which resources are under Terraform's management, not just those defined in the configuration or those that are out of sync. Option D is correct because the `terraform state list` command (or similar output) displays all resources that Terraform is actively managing, regardless of their current state relative to the configuration.

Answer

Resources to be created

Answer

Resources in the configuration

Answer

Resources that are out of sync

Question 5

A junior DevOps engineer is asked to explain the primary purpose of Terraform. Which statement best describes Terraform's purpose?

Accepted Answer

Terraform is an infrastructure provisioning tool that manages cloud and on-premises resources using declarative configuration.. Terraform is an infrastructure provisioning tool that uses declarative configuration (HashiCorp Configuration Language, HCL) to define and manage both cloud and on-premises resources. Its primary purpose is to provision infrastructure—such as virtual machines, networks, and storage—across multiple providers (e.g., AWS, Azure, GCP) by maintaining a desired state and applying changes via execution plans. Unlike configuration management or scripting tools, Terraform focuses on the lifecycle of infrastructure resources, not on configuring software within those resources.

Answer

Terraform is a monitoring tool that tracks infrastructure changes.

Answer

Terraform is a scripting tool for automating manual tasks in cloud environments.

Answer

Terraform is a configuration management tool that installs and configures software on servers.

Question 6

A team wants to use Terraform to manage their AWS infrastructure. They have existing resources created manually. What is the recommended approach to bring these resources under Terraform management?

Accepted Answer

Use terraform import to bring each resource into state.. `terraform import` is the recommended approach to bring existing manually created resources under Terraform management. It maps the real-world resource ID into your Terraform state file, allowing Terraform to track and manage it without deleting or recreating it. This preserves the existing infrastructure while enabling future updates via configuration.

Answer

Delete the existing resources and recreate them using Terraform configuration.

Answer

Use terraform plan to detect existing resources and automatically adopt them.

Answer

Write Terraform configuration that matches existing resources and run terraform apply.

Question 7

An organization has a multi-cloud strategy using Terraform. They need to ensure that secrets such as API keys are not stored in plaintext in the configuration files. Which Terraform feature should they use to securely manage sensitive data?

Accepted Answer

Integration with a secrets management tool like Vault. Integrating Terraform with a dedicated secrets management tool like HashiCorp Vault allows sensitive data (e.g., API keys, passwords) to be stored securely and retrieved at runtime via data sources, rather than being hardcoded in plaintext in configuration files. This approach ensures secrets are never written to disk in plaintext, are encrypted in transit and at rest, and can be dynamically rotated without modifying Terraform code.

Answer

Terraform variable definitions with environment variables

Answer

Terraform workspaces

Answer

Terraform state file encryption

Answer

Terraform's sensitive parameter in output blocks

Question 8

Which TWO of the following are key advantages of using Terraform over manual infrastructure management? (Select TWO.)

Accepted Answer

Consistent and repeatable deployments. Option B is correct because Terraform's declarative configuration and state file let you apply the same plan repeatedly, producing consistent and repeatable deployments across environments instead of relying on error-prone manual steps. Option C is correct because Terraform configurations are plain code (HCL) that can be stored in Git and versioned, enabling peer review, change history, and rollback of infrastructure definitions. Options A, D, and E are not inherent Terraform advantages: zero downtime depends on the resource/provider and update strategy, Terraform does not automatically discover and import existing resources without explicit import commands, and self-healing is typically provided by orchestrators or auto-scaling services rather than by Terraform itself.

Answer

Guaranteed zero downtime during updates

Answer

Automatic discovery of existing resources

Answer

Self-healing infrastructure

Question 9

Which THREE statements accurately describe Terraform state? (Select THREE.)

Accepted Answer

State is used to map real-world resources to configuration.. Option A is correct because Terraform state maintains the binding between resource instances declared in configuration and the actual remote objects, storing attributes and resource addresses so Terraform knows what exists and what to update or destroy. Option B is correct because remote backends such as S3 with DynamoDB, Terraform Cloud, or Consul allow the state file to be stored centrally and shared across team members, enabling collaboration and consistent operations. Option E is correct because, absent an explicit backend configuration, Terraform writes state to a local file named terraform.tfstate in the working directory. Option C is not correct as a general statement because while state can contain sensitive values in plaintext, it does not inherently 'contain sensitive data by default' for every configuration. Option D is not correct because locking is not automatic in all cases; it depends on the backend, and the default local backend does not provide locking, while remote backends like S3 require explicit DynamoDB locking configuration.

Answer

State contains sensitive data by default.

Answer

State is automatically locked to prevent concurrent modifications.

Question 10

Which TWO of the following are core components of Terraform's workflow? (Select TWO.)

Accepted Answer

terraform init. Terraform's core workflow consists of three main steps: init, plan, and apply. `terraform init` initializes the working directory by downloading the required providers and modules, setting up the backend, and preparing the environment for configuration. `terraform plan` creates an execution plan showing what actions Terraform will take to reach the desired state, allowing you to preview changes before applying them.

Answer

terraform validate

Answer

terraform install

Answer

terraform destroy

Question 11

Refer to the exhibit. A developer runs terraform plan and sees the above output. What will happen when terraform apply is executed?

Accepted Answer

The existing EC2 instance's instance_type is changed to t2.small in-place.. Terraform's plan output shows an in-place update (indicated by the tilde `~` symbol) for the `instance_type` attribute of the existing EC2 instance. When `terraform apply` is executed, Terraform will modify the instance's type to `t2.small` without destroying and recreating the resource, as the change is supported by the AWS provider for EC2 instances.

Answer

The existing EC2 instance is replaced due to a change in instance_type.

Answer

A new EC2 instance is created with instance_type t2.small, and the old one is destroyed.

Answer

No changes will be made because the plan shows an update.

Question 12

Refer to the exhibit. A user attempts to run terraform apply with this configuration. What error will occur?

Accepted Answer

Duplicate resource name "mybucket". Terraform requires every resource block to have a unique address within the same module. If two `aws_s3_bucket` resources both use the same logical name `mybucket`, Terraform will reject the configuration with a `Duplicate resource name` error during the `plan` or `apply` phase. This is a fundamental rule of Terraform's configuration language, enforced at parse time before any provider interaction occurs.

Answer

Conflicting access control settings

Answer

Missing required provider configuration

Answer

Invalid bucket name pattern

Question 13

Refer to the exhibit. A team is troubleshooting a Terraform deployment. What information can be inferred from this state file?

Accepted Answer

There is one EC2 instance of type t2.micro with a dependency on a security group.. The state file explicitly shows a resource of type `aws_instance` with `instance_type = "t2.micro"` and a `depends_on` meta-argument referencing `aws_security_group.example`. This indicates that Terraform recorded the EC2 instance as created with a t2.micro type and that it has a formal dependency on a security group resource, ensuring the security group is created before the instance during apply.

Answer

The Terraform version is outdated and must be upgraded.

Answer

The instance ID is invalid and needs to be recreated.

Answer

The security group dependency was not applied.

Question 14

A company wants to adopt infrastructure as code (IaC) to manage their expanding cloud environment. Which problem does Terraform directly address?

Accepted Answer

Eliminating manual configuration drift across environments. Terraform directly addresses the problem of manual configuration drift by enabling infrastructure as code (IaC), where the entire infrastructure state is defined in declarative configuration files. It uses a desired-state model: Terraform compares the current state of resources against the configuration and automatically reconciles any differences, ensuring environments remain consistent and drift is eliminated without manual intervention.

Answer

Ensuring applications are highly available across regions

Answer

Automating software installation and patching on servers

Answer

Providing real-time monitoring and alerting for infrastructure

Question 15

A DevOps engineer runs terraform plan and sees that a resource will be destroyed and recreated, but they expected an in-place update. The resource is an AWS EC2 instance with a specific AMI. Which attribute change is most likely causing the destruction?

Accepted Answer

The AMI ID was changed.. Changing the AMI ID of an AWS EC2 instance is a force-new attribute in Terraform. Because the AMI defines the root block device and operating system, Terraform cannot perform an in-place update; it must destroy the existing instance and create a new one with the new AMI. This behavior is hardcoded in the Terraform AWS provider for the `aws_instance` resource.

Answer

The security group list was modified.

Answer

The tags were updated.

Answer

The instance type was reduced from large to micro.