TF-004 Implement and maintain state — 25 Questions

Question 1

A team uses Terraform Cloud workspaces to manage multiple environments. They notice that the state file for the production workspace is stored in a different backend than the development workspace. Which Terraform feature allows different workspaces to use different backends?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using partial configuration with a backend block that has dynamic workspace references. Terraform supports partial backend configuration, where the backend block can omit certain arguments (like the bucket or path) and those values can be supplied dynamically at initialization time. By using a backend block with dynamic workspace references (e.g., `bucket = "my-state-${terraform.workspace}"` or `key = "${var.env}/terraform.tfstate"`), each workspace can resolve to a different storage location (e.g., a different S3 bucket or a different path within the same S3 bucket) for its state file. This allows the production and development workspaces to store their state in entirely different backend configurations (different instances of the same backend type) without hardcoding the configuration.

Answer

Using the -backend-config flag

Answer

Using the backend block with a workspace key

Answer

Using a remote backend type

Question 2

Which TWO of the following are valid reasons to use Terraform state?

Accepted Answer

Improving performance for large infrastructures by caching resource attributes.. Terraform state serves two primary functions:
1.  **Mapping real-world resources to configuration (Option E):** It maintains a mapping between the resources defined in your Terraform configuration files and the actual infrastructure objects created in the cloud or on-premises. This allows Terraform to know which specific cloud resource (e.g., an EC2 instance with a unique ID) corresponds to a particular `aws_instance` block in your code, enabling it to manage, update, or destroy the correct resources.
2.  **Improving performance by caching resource attributes (Option D):** The state file stores the current attributes of all managed resources. When Terraform runs `plan` or `apply`, it first consults this cached state. This reduces the number of direct API calls to the cloud provider, especially for large infrastructures, thereby improving performance, reducing latency, and helping to stay within API rate limits.

Answer

Automatically applying changes when configuration files are saved.

Answer

Storing sensitive data like passwords and API keys.

Answer

Providing a backup of the infrastructure to restore in case of disaster.

Question 3

Match each Terraform state command to its action.

Accepted Answer

terraform state list: List resources in state. The correct matches are: terraform state list → List resources in state, terraform state show → Display details of a specific resource, terraform state mv → Move an item, terraform state rm → Remove an item. Common confusions include swapping list with rm or thinking mv is primarily for renaming.

Answer

terraform state list: Remove items from state

Answer

terraform state mv: Rename a resource

Question 4

A team uses a Consul backend for Terraform state. They want to encrypt state at rest. What should they do?

Accepted Answer

Use Vault Transit Engine to encrypt the state before storing. The `encrypt` argument in the Terraform Consul backend configuration is used to specify an encryption key for Consul's *gossip protocol*, which encrypts *inter-agent communication*. It does *not* encrypt the state data stored at rest within Consul's KV store. Consul's KV store does not provide native, transparent encryption of values at rest. To achieve state encryption at rest while using Consul as the backend, an external mechanism like HashiCorp Vault's Transit Engine (Option E) would typically be used to encrypt the state data *before* Terraform writes it to Consul. Therefore, option D does not achieve the stated goal of encrypting state at rest.

Answer

Store state in an encrypted S3 bucket instead

Answer

Use Terraform's built-in state encryption feature

Answer

It is not possible to encrypt state with the Consul backend

Answer

Enable encryption in the backend configuration using the `encrypt` argument

Question 5

A user runs `terraform plan` and notices that the plan includes 'Outgoing changes' for a number of resources that were not modified in the configuration. What is the most likely cause?

Accepted Answer

The resources were manually changed in the cloud provider.. When `terraform plan` shows 'Outgoing changes' for resources that were not modified in the configuration, it indicates that the actual state of the resources in the cloud provider has diverged from the desired state defined in the Terraform configuration. This phenomenon is known as 'drift'. The most common and direct cause of drift, especially when the configuration itself hasn't changed, is that the resources were manually modified outside of Terraform's management (Option B). While an 'outdated state file' (Option D) is a symptom of this drift, and `terraform plan` implicitly refreshes the state to detect these changes, the *root cause* of the state file being outdated and the drift occurring is the manual modification of resources in the cloud. Option D describes a symptom and a necessary action (refreshing the state to reflect reality), not the underlying cause of the drift itself. Option A (provider version change) can cause plan changes but is less directly related to 'drift' from manual changes. Option C (backend configuration change) is unrelated to resource drift.

Answer

The provider version has changed.

Answer

The backend configuration changed.

Answer

The state file is outdated and needs to be refreshed.

Question 6

Which three of the following are valid command-line operations that modify the Terraform state? (Choose three.)

Accepted Answer

`terraform apply -auto-approve`. `terraform apply -auto-approve` modifies the Terraform state by creating, updating, or destroying resources as defined in the configuration, and then writing the resulting state to the state file. The `-auto-approve` flag skips the interactive approval prompt but does not change the fundamental behavior of applying changes and updating state.

Answer

`terraform plan`

Answer

`terraform state list`

Question 7

Refer to the exhibit. A user runs `terraform state list` and receives the output shown. The configuration defines an `aws_instance.web` resource with count = 3 and an `aws_s3_bucket.data` resource. After some changes, the user runs `terraform plan` and sees that the plan wants to create a new `aws_instance.web[2]` and destroy the existing `aws_instance.web[2]`. What is the most likely cause?

Accepted Answer

The AMI was updated, causing replacement only for index 2.. The explanation for option B is incorrect. If 'count' was reduced from 3 to 2 and then increased back to 3, Terraform would first destroy 'aws_instance.web[2]' (when count becomes 2) and then create a *new* 'aws_instance.web[2]' (when count becomes 3). This is not a replacement of an *existing* resource, but rather a destruction followed by a creation. The plan output 'create a new aws_instance.web[2] and destroy the existing aws_instance.web[2]' indicates a replacement operation for a single resource. Options C and D, if interpreted as a targeted attribute change (e.g., the AMI or instance type was updated specifically for the configuration of aws_instance.web[2] through conditional logic or a variable lookup), would directly cause a replacement of only that instance. Option A (state corruption) is a possibility but less specific than a targeted configuration change. Given the options, a targeted attribute change (like an AMI update for index 2) is the most direct and common cause for a single instance replacement.

Answer

The state file was corrupted.

Answer

The count was changed from 3 to 2 and back to 3.

Answer

The instance type was changed, causing replacement.

Question 8

After making manual changes to an AWS resource via the console, a Terraform user wants to update the state file to reflect those changes without modifying infrastructure. Which command should they run?

Accepted Answer

`terraform refresh`. The `terraform refresh` command was deprecated in Terraform 0.15.2 and completely removed in Terraform 0.15.3. It is no longer a valid command. In modern Terraform, the functionality to detect drift is implicitly integrated into `terraform plan` and `terraform apply`. If a user wants to update the Terraform state file to reflect the current real-world infrastructure state *without making any changes to the infrastructure itself* (i.e., accepting manual changes into the state), the correct command would be `terraform apply -refresh-only`. This command reads the current state of the resources and updates the state file accordingly. Since `terraform apply -refresh-only` is not provided as an option, and `terraform refresh` is an invalid command, the question is flawed.

Answer

`terraform apply`

Answer

`terraform import`

Answer

`terraform plan`

Question 9

Which TWO of the following are valid methods to acquire a state lock in Terraform Cloud?

Accepted Answer

Automatic lock when a run is queued. Terraform Cloud automatically acquires a state lock when a run is queued, preventing concurrent modifications to the same state file. This lock is managed by the Terraform Cloud backend and is released once the run completes or fails, ensuring state consistency across team operations.

Answer

Using a DynamoDB table configured in the backend block

Answer

Setting `lock=true` in the configuration file

Answer

Manual force-unlock via API or UI

Answer

Using a Consul session

Question 10

Your organization uses Terraform Cloud with a remote execution mode. There are two workspaces: `app-prod` and `app-staging`. The state for `app-prod` is stored in the `prod` workspace, and `app-staging` in the `staging` workspace. Recently, a new developer joined the team and tried to run `terraform plan` locally for the `app-staging` workspace. They received an error: "S3Backend bucket 'my-company-tf-state' does not exist." The developer is not using Terraform Cloud locally. The team uses a remote backend configuration with Terraform Cloud. What is the most likely cause?

Accepted Answer

The developer is running Terraform locally without having the correct backend configuration; they should run `terraform init -reconfigure` to reinitialize backend settings for local execution. The error message indicates the developer's local Terraform configuration is using an S3 backend (checking for bucket 'my-company-tf-state'), but the team's actual backend configuration uses Terraform Cloud (remote backend). The developer likely has a stale or incorrect local initialization. Running 'terraform init -reconfigure' forces Terraform to reinitialize with the backend blocks in the configuration, which will switch from the misconfigured S3 backend to the correct remote backend (Terraform Cloud), resolving the error.

Answer

The developer forgot to run `terraform workspace select staging`

Answer

The Terraform Cloud workspace `app-staging` is not set to use remote state

Answer

The developer lacks AWS credentials to access the S3 bucket

Question 11

A team uses Terraform with the `azurerm` backend. A junior engineer accidentally deletes the state file from the storage container. The team has a backup from 2 hours ago in a different container. What is the correct procedure to recover from this state loss?

Accepted Answer

Restore the backup state file to the original location, then run `terraform plan` to check for any drift. Restoring the backup state file to the original location is the primary step to recover from a deleted state. Running `terraform plan` afterward is crucial to identify any configuration drift that may have occurred since the backup was taken, allowing for a controlled reconciliation if necessary. This is the safest and most recommended recovery procedure. Option B would lead to Terraform attempting to create all resources, causing errors or destructive actions. Option C is tedious, error-prone, and unnecessary when a backup exists. Option D is highly destructive as `terraform apply` with an empty state would attempt to recreate existing resources.

Answer

Re-run `terraform init` and then `terraform refresh` without restoring

Answer

Delete all resources manually and re-import them using `terraform import`

Answer

Create a new empty state and use `terraform apply` to recreate everything

Question 12

Refer to the exhibit. A developer modifies the configuration by changing the resource name from 'aws_instance.web' to 'aws_instance.web2'. After running terraform plan, the output indicates that a new resource 'aws_instance.web2' will be created, but no resource will be destroyed. What should the developer do to update the state to match the configuration?

Accepted Answer

Run terraform state mv to rename the resource in state.. The explanation correctly describes the purpose of 'terraform state mv' for updating resource addresses in the state file to match configuration changes, which is the intended solution for renaming a resource without destroying and recreating it. The explanations for options B, C, and D are also accurate in describing why those commands are not suitable for this specific scenario (renaming an existing managed resource).

Answer

Run terraform refresh to synchronize the state.

Answer

Run terraform state rm to remove the old resource and then run terraform import.

Answer

Run terraform apply, which will automatically update the state.

Question 13

Refer to the exhibit. A developer runs terraform plan and receives this error. What should the developer do to resolve the error?

Accepted Answer

Run terraform init -migrate-state to migrate the state to the new region.. The error indicates that the Terraform state is stored in a backend configuration that references a region that no longer exists or is inaccessible. Running `terraform init -migrate-state` allows Terraform to copy the existing state to a new backend configuration (including a new region) while preserving the state data, resolving the mismatch.

Answer

Run terraform plan again; the error will self-resolve after a few minutes.

Answer

Update the backend configuration in the Terraform code to match the previous region.

Answer

Run terraform state rm to remove the state file and start fresh.

Question 14

Refer to the exhibit. An engineer modifies the instance's tags via the AWS console, then runs 'terraform apply'. The apply output shows 1 change, but the state file still shows the original tags. What is the most likely reason?

Accepted Answer

The configuration file still has the original tags, so Terraform reverted the manual change. State reflects the configuration.. When an engineer manually modifies resource tags via the AWS console, it creates 'drift' between the actual resource state in AWS and Terraform's configuration. If the Terraform configuration file still defines the instance with the original tags, running 'terraform apply' will cause Terraform to detect this drift during the plan phase. Terraform's default behavior is to bring the remote infrastructure back into alignment with the configuration. Therefore, the '1 change' in the apply output indicates that Terraform successfully reverted the manually changed tags on the AWS instance back to the original tags defined in the configuration. After a successful apply, Terraform updates its state file to reflect the current actual state of the resource, which now matches the configuration (i.e., the original tags). Thus, the state file correctly shows the original tags because Terraform enforced the configuration, reverting the manual change.

Answer

The state file was not updated because the apply failed partially.

Answer

The state is locked and cannot be updated.

Answer

The 'terraform state show' command does not display tags.

Question 15

A team is using a remote backend in Terraform Cloud. After a failed apply, the state file is locked. The team lead wants to unlock the state immediately. What should be done?

Accepted Answer

Run terraform force-unlock with the lock ID. The `terraform force-unlock` command with the lock ID is the correct way to manually unlock a state file in Terraform Cloud after a failed apply. This command overrides the backend's lock mechanism, which is designed to prevent concurrent modifications and state corruption. Deleting or editing the state file would bypass Terraform's safety guarantees and risk data loss or inconsistency.

Answer

Delete the state file from the backend and reinitialize

Answer

Manually edit the state file to remove the lock

Answer

Run terraform unlock

Question 16

An organization uses Terraform with AWS S3 backend and DynamoDB for state locking. During a plan, you receive an error: 'Error acquiring the state lock'. The lock information in DynamoDB shows a lock from a previous session that crashed. What is the most appropriate next step?

Accepted Answer

Run terraform force-unlock with the lock ID. When a Terraform process crashes while holding a state lock, the lock remains in DynamoDB and must be manually released. The `terraform force-unlock` command with the specific lock ID is the designed mechanism to override a stale lock, as it directly interacts with the DynamoDB locking table to remove the lock item. This is the safest and most appropriate method, as it ensures the lock is released in a controlled manner without risking state corruption.

Answer

Run terraform unlock

Answer

Wait for the lock to expire automatically

Answer

Delete the lock item from DynamoDB table directly

Question 17

A developer is working on a Terraform configuration that manages a single resource. They want to import an existing AWS EC2 instance into state. Which command should they use?

Accepted Answer

terraform import. `terraform import` is the dedicated command for bringing an existing infrastructure resource (like an AWS EC2 instance) under Terraform management by attaching it to a resource block in the state file. It requires the resource address and the provider-specific ID (e.g., `aws_instance.my_instance i-1234567890abcdef0`) to map the real-world resource into the Terraform state without modifying the resource itself.

Answer

terraform apply

Answer

terraform refresh

Answer

terraform state mv

Question 18

After running terraform apply, you see the error: 'Error: Error loading state: state snapshot was created by Terraform v0.12.0, but this is Terraform v1.2.0'. What should you do to resolve this?

Accepted Answer

Run terraform apply with no changes to upgrade the state format. Running `terraform apply` with no changes triggers Terraform to automatically upgrade the state file format to the version compatible with the current Terraform binary (v1.2.0). Terraform state files are versioned internally, and when a newer version of Terraform reads an older state format, it performs an in-place upgrade during the next state write operation, such as an apply that results in no changes. This avoids manual intervention or data loss.

Answer

Run terraform state upgrade

Answer

Delete the state file and reimport resources

Answer

Downgrade Terraform to v0.12.0

Question 19

A user wants to remove a specific resource from Terraform state without destroying the actual infrastructure. Which command should they use?

Accepted Answer

terraform state rm resource. The `terraform state rm` command is the correct choice because it removes a specified resource from the Terraform state file without making any API calls to the actual infrastructure provider. This allows the resource to be detached from Terraform management while leaving the real-world resource running, which is exactly what the user wants.

Answer

terraform taint resource

Answer

terraform state mv resource

Answer

terraform destroy -target=resource

Question 20

A company uses Terraform to manage infrastructure across multiple AWS accounts. They want to use a single S3 bucket to store state files for all accounts, but ensure that state files are isolated per account. What is the best approach?

Accepted Answer

Use separate state files with unique S3 key prefixes per account. Using separate state files with unique S3 key prefixes per account ensures that each AWS account's Terraform state is stored in the same S3 bucket but logically isolated. This approach leverages S3's hierarchical key structure to prevent cross-account state contamination, while still allowing centralized management. Terraform's backend configuration supports dynamic key prefixes (e.g., `key = "account-${var.account_id}/terraform.tfstate"`), enabling per-account isolation without requiring separate buckets or workspaces.

Answer

Use Terraform workspaces with a single state file

Answer

Store all state in the same S3 key

Answer

Use a DynamoDB table with different lock IDs per account