TF-004 Implement and maintain state Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. What does the output indicate?

Accepted Answer

The state file tracks three resources. The `terraform state list` command lists all resources currently tracked in the state file. Here it shows three resources: a VPC, a subnet, and an EC2 instance.

Answer

The Terraform configuration defines three resources

Answer

Three providers are configured

Answer

Three workspaces are in use

Answer

The plan will create three resources

Question 2

Refer to the exhibit. A developer runs `terraform apply` but receives an error that the state file is locked. Which of the following is a likely cause?

Accepted Answer

Another user has an active plan or apply running. Terraform uses a state locking mechanism to prevent concurrent operations that could corrupt the state file. When another user (or CI/CD pipeline) is running terraform plan or terraform apply against the same backend, the lock is held and any subsequent apply fails with a 'state file is locked' error. The correct resolution is to wait for the other operation to finish or, if it is stale, force-unlock it.

Answer

The DynamoDB table for locking is not configured

Answer

The S3 bucket does not exist

Answer

The IAM user lacks s3:ListBucket permission

Answer

The encryption key is incorrect

Question 3

Refer to the exhibit. An engineer sees this error. Which command should they run to force-unlock?

Accepted Answer

terraform force-unlock 123456. `terraform force-unlock <LOCK_ID>` is the exact command Terraform provides to manually release a state lock when the automatic unlocking mechanism fails (e.g., after a crash or network interruption). The lock ID is a unique identifier assigned by the backend (such as DynamoDB or Consul) when the lock was acquired, and this command bypasses the normal safety checks to force the unlock.

Answer

terraform force-unlock my-company-terraform-state/prod/terraform.tfstate

Answer

terraform unlock -id=123456

Answer

terraform state unlock 123456

Answer

terraform init -force-unlock=123456

Question 4

A user runs `terraform apply` and receives an error: 'Error acquiring the state lock'. What is the most likely cause?

Accepted Answer

Another user is running a Terraform command that modifies state.. The 'Error acquiring the state lock' occurs when Terraform cannot obtain the lock on the remote state backend because another process already holds it. This is most commonly caused by another user or CI job running a Terraform command that modifies state (apply, destroy, import, etc.) at the same time.

Answer

The state file is missing.

Answer

The backend configuration is invalid.

Answer

The Terraform provider is incompatible.

Question 5

A team uses an S3 backend with DynamoDB locking. They accidentally delete the DynamoDB table used for state locking. What is the immediate consequence?

Accepted Answer

Terraform commands that require state locking will fail with a locking error.. Terraform's S3 backend with DynamoDB locking requires the lock table to exist for any operation that acquires a state lock (plan with refresh, apply, destroy). If the table is deleted, Terraform returns an error such as 'Error acquiring the state lock' or a ResourceNotFoundException, and the operation aborts rather than proceeding without locking.

Answer

State operations will continue without locking, risking corruption.

Answer

Terraform will automatically create a new DynamoDB table.

Answer

The state file will be migrated to local storage.

Question 6

A user wants to use a remote state backend for the first time. After adding the backend configuration, which command must they run to migrate the state from local to remote?

Accepted Answer

`terraform init`. When you add a remote backend configuration to your Terraform code, `terraform init` is the required command to initialize the backend and migrate the existing local state file to the remote backend. During initialization, Terraform detects the backend change, prompts for confirmation, and automatically copies the state from the local `terraform.tfstate` to the configured remote store (e.g., S3, Azure Storage, or Terraform Cloud). Without running `init`, the remote backend is not configured and local state remains unchanged.

Answer

`terraform plan`

Answer

`terraform apply`

Answer

`terraform state push`

Question 7

During a deployment, a user runs `terraform apply` but the command fails because the state lock cannot be acquired. They suspect the lock was released after the previous `apply` but is still held. What command can they use to force unlock the state?

Accepted Answer

`terraform force-unlock <lock_id>`. When Terraform cannot acquire a state lock because it was not properly released (e.g., after a crash or interrupted apply), the `force-unlock` command is the only built-in way to manually break the lock. You must provide the lock ID (obtained from the error message or backend) to override the lock, which is stored in the backend (e.g., DynamoDB, Consul) and prevents concurrent modifications. This command is designed for recovery scenarios where the lock holder is known to be dead.

Answer

`terraform init -force-copy`

Answer

`terraform state unlock`

Answer

`terraform break-lock`

Question 8

A Terraform state file is stored in an S3 bucket with versioning enabled. During a deployment, the state file becomes corrupted due to a network error. What is the best way to recover?

Accepted Answer

Restore the previous version of the state file from S3 versioning.. S3 versioning preserves previous versions of objects, including Terraform state files. When the current state file becomes corrupted, you can restore a prior, uncorrupted version directly from the S3 bucket without data loss or manual re-creation of resources. This is the safest and most efficient recovery method.

Answer

Use `terraform state pull` to overwrite the corrupted state.

Answer

Run `terraform import` to import all resources.

Answer

Delete the state file and run `terraform apply` to recreate all resources.

Question 9

Which command can be used to see the current state of a specific resource in the Terraform state?

Accepted Answer

`terraform state show `. The `terraform state show ` command is specifically designed to display the attributes and current state of a single resource as recorded in the Terraform state file. This allows you to inspect the exact values Terraform is tracking for that resource, which is essential for debugging drift or understanding the current infrastructure representation.

Answer

`terraform output`

Answer

`terraform state list`

Answer

`terraform show`

Question 10

A team uses a remote state backend with partial configuration. They have a `backend` block with only the `bucket` attribute, and the rest of the backend configuration is provided via CLI during `terraform init`. Which of the following best describes the purpose of partial configuration?

Accepted Answer

It allows sensitive backend configuration to be provided dynamically, avoiding hardcoding.. Partial configuration in Terraform remote state backends allows you to split backend settings between the `backend` block in your configuration and dynamic inputs provided at `terraform init` time. This is especially useful for sensitive values like access keys or secret tokens, which can be supplied via CLI flags, environment variables, or interactive prompts, thereby avoiding hardcoding them in version-controlled files. Option D correctly identifies this primary purpose of enhancing security and flexibility.

Answer

It reduces the number of files needed for configuration.

Answer

It is required when using Terraform Cloud.

Answer

It enables state locking.

Question 11

Which two statements about Terraform state files are true? (Choose two.)

Accepted Answer

State files are used to map configuration to real-world resources.. Option C is correct because the Terraform state file is the authoritative record that maps each resource declared in the configuration to its corresponding real-world object (for example, an AWS instance ID), enabling Terraform to plan accurate create, update, and destroy operations. Option E is correct because state stores resource attributes in plain text, including values such as database passwords, connection strings, and private keys, which is why state must be protected with encryption and restricted access. Option A is wrong because encryption at rest is not automatic for all backends; local state is unencrypted by default, and remote backends like S3 require explicit SSE configuration or KMS. Option B is wrong because committing state to version control exposes secrets and causes conflicts; remote backends with locking are the recommended approach. Option D is wrong because concurrent operations on the same state can corrupt it, which is why backends such as S3 with DynamoDB or Terraform Cloud provide state locking.

Answer

State files are automatically encrypted at rest by all backends.

Answer

State files should be stored in version control.

Answer

State files can be shared across multiple users simultaneously without issues.

Question 12

Which three of the following are valid command-line operations that modify the Terraform state? (Choose three.)

Accepted Answer

`terraform apply -auto-approve`. `terraform apply -auto-approve` modifies the Terraform state by creating, updating, or destroying resources as defined in the configuration, and then writing the resulting state to the state file. The `-auto-approve` flag skips the interactive approval prompt but does not change the fundamental behavior of applying changes and updating state.

Answer

`terraform plan`

Answer

`terraform state list`

Question 13

A team uses an S3 backend for state storage with DynamoDB locking. They want to migrate to a new S3 bucket. Which two steps are necessary to perform a successful state migration? (Choose two.)

Accepted Answer

Run `terraform init -reconfigure` to update the backend configuration.. `terraform init -reconfigure` forces Terraform to reinitialize the backend and apply the new backend configuration from the `backend` block without prompting for confirmation. Option E is correct because the `backend` block in the Terraform configuration must be updated to reference the new S3 bucket name; Terraform reads this block during initialization to determine where to store and retrieve state. Together, these steps ensure Terraform knows the new backend location and can properly manage state going forward.

Answer

Run `terraform plan` to verify no resource changes before migration.

Answer

Delete the old state file after migration.

Answer

Manually copy the state file from the old bucket to the new bucket.

Question 14

Refer to the exhibit. A user has this backend configuration. The user then runs `terraform init` and receives an error: 'NoSuchBucket: The specified bucket does not exist'. What is the most likely cause?

Accepted Answer

The bucket does not exist and needs to be created.. The error 'NoSuchBucket: The specified bucket does not exist' directly indicates that the S3 bucket referenced in the backend configuration does not exist in the AWS account. Terraform requires the S3 bucket to already exist before running `terraform init` because it needs to store the state file; it does not create the bucket automatically. Therefore, the most likely cause is that the bucket has not been created yet.

Answer

The AWS region is wrong.

Answer

The DynamoDB table is missing.

Answer

The credentials lack S3 permissions.

Question 15

Refer to the exhibit. A user runs `terraform plan` and receives this error. The user is using a local backend. Which of the following is the most likely cause?

Accepted Answer

The configured state file path's directory does not exist.. With a local backend, Terraform stores state in a local file, typically `terraform.tfstate`. The error indicates that the directory specified for the state file path does not exist. Terraform requires the parent directory to exist before it can write the state file; if it is missing, the plan fails with this error.

Answer

The workspace is not selected correctly.

Answer

The state file is corrupted.

Answer

The backend is misconfigured for remote state.