TF-004 Implement and maintain state Practice Test 3 — 15 Questions

Question 1

Drag and drop the steps to use Terraform modules from the registry in the correct order.

Accepted Answer

Write the module block in main.tf, then run terraform init, then set input variables in terraform.tfvars, then run terraform plan and terraform apply.. Registry modules are sourced; init downloads, variables configure, plan/apply deploy.

Answer

Run terraform init, then write the module block, then set input variables, then run terraform plan and apply.

Answer

Write the module block, then set input variables, then run terraform init, then run terraform plan and apply.

Answer

Write the module block, then run terraform plan and apply, then run terraform init, then set input variables.

Question 2

A company uses Terraform with an S3 backend. A user accidentally deletes the state file. What is the best practice to recover the state?

Accepted Answer

Restore the state file from S3 bucket versioning. Using S3 versioning is the best practice because it allows you to restore the previous version of the state file. Other options, such as relying on local caches or re-importing resources, are not reliable or efficient.

Answer

Use terraform state pull from the local cache

Answer

Use terraform import on all resources

Answer

Recreate the state from a terraform plan

Answer

Restore from the local terraform.tfstate.backup

Question 3

A developer runs `terraform apply` and receives the error: 'Error acquiring the state lock'. Another engineer is currently running `terraform plan`. What should the developer do?

Accepted Answer

Wait for the lock to be released automatically. Terraform uses a state locking mechanism to prevent concurrent modifications that could corrupt the state file. When another engineer is running `terraform plan`, the lock is held for the duration of the plan to ensure consistency. The lock will be automatically released once the plan completes or times out, so waiting is the appropriate action.

Answer

Run terraform init to reinitialize the backend

Answer

Run terraform force-unlock with the lock ID

Answer

Run terraform plan with -lock=false to bypass the lock

Answer

Delete the lock file from the S3 bucket

Question 4

In a CI/CD pipeline, Terraform state is stored in Terraform Cloud. A pipeline run fails with the error: 'State version conflict'. What is the most likely cause?

Accepted Answer

Two runs started at the same time. A 'State version conflict' in Terraform Cloud typically occurs when two runs attempt to modify the same state concurrently. Even though Terraform Cloud serializes runs via a queue, a conflict arises if a run completes before another run that started based on an older state version. Terraform Cloud detects that the state has changed externally, resulting in a version conflict. Missing or incorrect backend configuration (option B) would cause errors like 'backend initialization required' or 'workspace not found', not specifically a state version conflict. Authentication failures (A) yield access denied errors. State size limits (C) produce size-related errors. Version mismatches (D) cause compatibility warnings.

Answer

Authentication failure with Terraform Cloud

Answer

Missing or incorrect backend configuration

Answer

State file exceeds maximum size limit

Answer

Terraform version mismatch between local and remote

Question 5

An organization uses a shared remote backend. They want to prevent concurrent apply operations that could corrupt the state. What built-in mechanism does Terraform provide?

Accepted Answer

State locking. Terraform's state locking mechanism prevents concurrent operations that could corrupt the state file by acquiring a lock on the backend before running `plan` or `apply`. When using a shared remote backend, the lock is held for the duration of the operation and released upon completion, ensuring only one process modifies the state at a time. Option D refers to state file versioning, which provides the ability to recover previous versions but does not prevent concurrent writes.

Answer

File permissions on the remote state file

Answer

Workspace isolation

Answer

State file versioning

Answer

Backend versioning

Question 6

After running `terraform state mv` to rename a resource, the resource's state binding is lost and the resource cannot be managed. Which command should be run to restore the state binding?

Accepted Answer

terraform import. After a failed `terraform state mv`, the resource mapping in the state may become corrupted or lost. To restore the binding, use `terraform import` to re-import the existing resource into the state. Option E, `terraform import`, is correct. Option D, `terraform refresh`, updates the state to match real infrastructure but does not restore a missing resource binding.

Answer

terraform state push

Answer

terraform state show

Answer

terraform state rm

Answer

terraform refresh

Question 7

What is the purpose of the `terraform state list` command?

Accepted Answer

List all resources in the current state file. `terraform state list` lists all resources currently tracked in the Terraform state file, providing their resource addresses. Option B correctly describes this. Option A is incorrect because `terraform state list` does not show planned resources; that is the role of `terraform plan`. Option C lists resources from configuration (not from state), D lists workspaces, and E lists providers.

Answer

List all resources that would be created by the current plan

Answer

List all resources defined in the Terraform configuration

Answer

List all available workspaces

Answer

List all providers used in the configuration

Question 8

A user wants to inspect the current attributes of a specific resource in the Terraform state. Which command should they use?

Accepted Answer

terraform state show . The `terraform state show ` command is specifically designed to inspect the current attributes of a single resource within the Terraform state file. It reads the state directly and outputs the resource's attributes in a human-readable format, making it the correct tool for this task.

Answer

terraform state list <resource>

Answer

terraform output

Answer

terraform plan

Answer

terraform show

Question 9

Which of the following is NOT a valid backend type for storing Terraform state?

Accepted Answer

kubernetes. Kubernetes is not a valid backend type for storing Terraform state. Terraform backends determine where state is stored and how operations are executed; the officially supported backends include local, remote backends like S3, HTTP, and Terraform Cloud, but Kubernetes is not among them. While Kubernetes can be used to run Terraform in a pod, it does not serve as a state storage backend.

Answer

terraform cloud

Answer

local

Answer

s3

Answer

http

Question 10

Which TWO of the following are valid strategies to migrate Terraform state from a local backend to a remote backend?

Accepted Answer

Manually copy the local state file to the remote backend storage. The valid strategies for migrating state from local to remote backend are: manually copying the state file to the remote location (B) or using `terraform init -migrate-state` (D). Option C is incorrect because `terraform init -reconfigure` only reconfigures the backend without migrating the existing state.

Answer

Use terraform import for each resource

Answer

Change backend configuration and run terraform init -reconfigure

Answer

Use the terraform state push command

Question 11

Which TWO actions will cause Terraform to update the state file?

Accepted Answer

terraform destroy. `terraform apply` and `terraform destroy` both modify the state file. `plan`, `validate`, and `fmt` do not make changes to the state.

Answer

terraform fmt

Answer

terraform validate

Answer

terraform plan

Question 12

Which TWO statements are correct about Terraform state when using the S3 backend with DynamoDB for state locking?

Accepted Answer

The DynamoDB table must exist before running terraform init. The DynamoDB table must exist before running `terraform init`, because the table is required for state locking and Terraform does not create it automatically. Option B is correct: enabling S3 bucket versioning provides consistency checks and allows recovery from accidental state deletion or corruption. Option C is incorrect: the `key` argument in the backend configuration is mandatory to specify the path for the state file in the S3 bucket. Option D is incorrect: by default, the S3 backend does not encrypt state at rest; encryption must be explicitly enabled using the `encrypt` argument or an environment variable. Option E is incorrect: state locking prevents concurrent writes but does not block read operations; reading the state file is still allowed while it is locked.

Answer

State can be stored without specifying a key in the backend configuration

Answer

State is encrypted at rest by default using SSE

Answer

State locking prevents any read operations on the state file

Question 13

Refer to the exhibit. What does the output indicate?

Accepted Answer

The state file tracks three resources. The `terraform state list` command lists all resources currently tracked in the state file. Here it shows three resources: a VPC, a subnet, and an EC2 instance.

Answer

The Terraform configuration defines three resources

Answer

Three providers are configured

Answer

Three workspaces are in use

Answer

The plan will create three resources

Question 14

Refer to the exhibit. A developer runs `terraform apply` but receives an error that the state file is locked. Which of the following is a likely cause?

Accepted Answer

Another user has an active plan or apply running. A state lock error indicates that the state file is currently locked by another process. This commonly occurs when another user or an automated process is running a terraform plan or apply that holds the lock. Options such as a missing DynamoDB table, nonexistent S3 bucket, lack of s3:ListBucket permission, or incorrect encryption key would result in different error messages related to backend configuration or permissions, not a lock error.

Answer

The DynamoDB table for locking is not configured

Answer

The S3 bucket does not exist

Answer

The IAM user lacks s3:ListBucket permission

Answer

The encryption key is incorrect

Question 15

Refer to the exhibit. An engineer sees this error. Which command should they run to force-unlock?

Accepted Answer

terraform force-unlock 123456. `terraform force-unlock <LOCK_ID>` is the exact command Terraform provides to manually release a state lock when the automatic unlocking mechanism fails (e.g., after a crash or network interruption). The lock ID is a unique identifier assigned by the backend (such as DynamoDB or Consul) when the lock was acquired, and this command bypasses the normal safety checks to force the unlock.

Answer

terraform force-unlock my-company-terraform-state/prod/terraform.tfstate

Answer

terraform unlock -id=123456

Answer

terraform state unlock 123456

Answer

terraform init -force-unlock=123456