193 questions total · 3pages · All types, answers revealed
Page 3 of 3
You want to pass a complex object type to a module, but you need to ensure specific attributes are present. How do you define this in the variable block?
The object type constraint enforces both the presence and the type of specific attributes.
Why this answer
The 'object' type constraint allows you to define a schema with specific attributes and their corresponding types.
Which THREE components are part of the 'Workspace' object in HCP Terraform?
The workspace holds the current state.
Why this answer
A workspace includes state, variables, and history/runs.
Which command helps verify if the providers are properly initialized?
This command lists the initialized providers.
Why this answer
'terraform providers' lists all providers required by the configuration, confirming they are initialized.
Which of these are required components when defining a provider in 'required_providers'? (Select TWO)
Version is the standard requirement.
Why this answer
The source address and the version are the two standard components for defining a provider requirement.
When refactoring code, you rename a resource in your configuration. What happens if you run 'terraform plan' without updating the state?
This is the default, disruptive behavior.
Why this answer
Terraform will assume the old resource has been deleted and the new one needs to be created, leading to unnecessary destruction of real resources.
You have a workspace configured for 'CLI-driven' workflow. What does this mean for how you apply changes?
The CLI is the driver for the remote run.
Why this answer
CLI-driven workflows require the user to trigger the plan/apply locally, while the state is managed remotely.
You need to ensure that all workspaces use a specific set of tags. How can this be enforced?
Sentinel can evaluate workspace attributes via the 'tfrun' import.
Why this answer
Sentinel can inspect the workspace configuration metadata, including tags, to ensure compliance.
You have a list of strings that you want to convert into a set to use with for_each. Which function is preferred?
toset converts a list to a set, ideal for stable iteration.
Why this answer
The toset() function is the correct way to convert a list of strings into a set, which is required for for_each to avoid index-based instability.
When migrating from local state to HCP Terraform, which command is used to initialize the migration?
Running init with a new cloud backend configuration prompts migration.
Why this answer
'terraform init' detects the backend configuration and initiates the migration process.
Which TWO of the following are standard stages of an HCP Terraform run pipeline?
Policy checking follows the plan.
Why this answer
The pipeline consists of Plan, Policy Check, and Apply stages.
If a user wants to ensure that a resource's lifecycle is managed by Terraform but wants to bypass the 'prevent_destroy' protection, what is the best approach?
This is the standard procedure to remove the protection.
Why this answer
You must remove the prevent_destroy rule from the code and then apply the configuration to update the state.
Which block is used to configure provider-level settings like region or profile?
This is the block for provider-specific settings.
Why this answer
The 'provider' block is used to configure the provider itself.
You have accidentally committed a secret to your VCS repository. After rotating the secret, what is the best practice to ensure it is not used in your workspace?
Sensitive variables ensure secrets are not stored in VCS.
Why this answer
You must remove the secret from the VCS and update the workspace variable to use a secure, non-version-controlled source.
Which command is used to move a resource from one state file to another, commonly used when refactoring modules?
This is the correct command for moving resources.
Why this answer
terraform state mv is the standard tool for moving resources between states or renaming them in the state file.
You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?
Setting 'count = var.enabled ? 1 : 0' is the standard pattern for conditional resource creation.
Why this answer
The 'count' meta-argument is commonly used to toggle resource creation based on a boolean value.
If you need to share output values between workspaces, what is the best practice in HCP Terraform?
This is the native way to access remote state outputs.
Why this answer
Using a workspace data source allows one workspace to read outputs from another safely.
A provider binary is not found in the local Terraform registry cache. What command should you run to force Terraform to download the provider again?
The -upgrade flag forces the re-download of providers based on constraints.
Why this answer
terraform init -upgrade forces Terraform to re-evaluate and download the latest allowed versions of providers.
Which THREE of the following are valid ways to pass data to a module dynamically?
Standard approach.
Why this answer
Passing variables, using for_each in the module block (if supported), or local variable composition are standard.
Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?
Workspaces allow distinct state and variables for different environments.
Why this answer
Workspaces in HCP Terraform provide a way to maintain separate state files and variable sets for the same configuration.
If a developer wants to use a provider that is not in the public registry, can they still use it?
These are standard ways to handle private providers.
Why this answer
Yes, by using a custom provider installation method like the filesystem mirror.
What is the effect of running 'terraform init -upgrade' on the '.terraform.lock.hcl' file?
This is the correct function of the upgrade flag.
Why this answer
The -upgrade flag causes Terraform to ignore existing lock file constraints and update to the latest compatible versions, updating the lock file accordingly.
You are using a module that depends on a specific provider version. Where should this constraint be defined?
This guarantees that the module's requirements are met during execution.
Why this answer
The 'required_providers' block within the 'terraform' block of the module is the correct location to pin versions.
You want to use a module that is hosted in a private GitHub repository. Which authentication method should Terraform use to access it?
Terraform leverages the underlying git command, so existing authenticated git configurations work.
Why this answer
Terraform uses the credentials configured in the local environment (e.g., ~/.git-credentials or SSH keys) to authenticate with private repositories.
Which TWO of the following are true about the '.terraform' directory?
Downloaded modules are stored here.
Why this answer
The '.terraform' directory is used locally by Terraform to store module files and provider plugins.
When should you use the 'for_each' meta-argument within a module?
'for_each' is specifically designed for creating multiple module instances.
Why this answer
'for_each' is used to create multiple instances of a module based on a map or set of strings.
If a user omits the 'version' in 'required_providers', what version does Terraform use?
Without a constraint, the latest is pulled.
Why this answer
Terraform will attempt to use the latest version available in the registry if no constraint is provided.
What are common reasons to use multiple provider instances? (Select TWO)
This is a standard use case.
Why this answer
Multiple instances are primarily used for multi-region or multi-account deployments.
What command do you run to view the documentation for a module that has been published to a registry?
Registry documentation is provided via the web interface.
Why this answer
The registry automatically renders documentation in the UI; no CLI command is required to 'view' the documentation directly.
Which TWO meta-arguments can be used within a module block?
'count' is a valid meta-argument for modules.
Why this answer
'count' and 'for_each' are the two meta-arguments available for module blocks.
What happens if you set 'ignore_changes = all' in a resource lifecycle block?
This is the intended behavior for the 'all' keyword.
Why this answer
'all' is a special keyword in ignore_changes that instructs Terraform to ignore all attribute changes for that resource.
Which of the following are true regarding the .terraform.lock.hcl file? (Select TWO)
Yes, it is generated when providers are initialized.
Why this answer
It stores checksums for providers to ensure consistency and security across different environments.
You have two resources, A and B. You want B to be replaced whenever A is updated. How do you configure B?
This is the correct usage of the trigger.
Why this answer
Using replace_triggered_by in B's lifecycle block, referencing resource A, forces the replacement of B when A changes.
Why would you use a 'locals' block within a module instead of passing everything through variables?
Locals clean up repetitive code and keep the module interface simple.
Why this answer
'locals' are ideal for transforming inputs, combining data, or creating complex naming conventions that the user shouldn't have to define.
You are using a dynamic block to define multiple 'tag' blocks inside an AWS resource. The dynamic block is failing because it expects a set of objects but receives a flat list. Which function best prepares your data?
toset converts a list to a set, which is the preferred input for for_each to maintain stable resource indices.
Why this answer
The toset() function converts a list of strings or objects into a set, which is required by for_each to avoid index-based dependencies.
You are creating a custom provider. What is the standard language used to write Terraform providers?
Terraform providers are built using Go.
Why this answer
Terraform providers are written in Go (Golang) using the Terraform Plugin SDK.
What is the impact of using 'sensitive = true' in a module output?
This is the main purpose of the 'sensitive' flag.
Why this answer
It marks the output as sensitive, preventing it from being printed to the console during 'terraform apply' or 'plan'.
Which TWO of the following are true regarding OPA/Sentinel policies?
Advisory mode allows the run to proceed with a warning.
Why this answer
They can be applied at the organization or workspace level and can be set to advisory or mandatory.
When a module is updated, how do you ensure that all environments using this module get the update?
The '-upgrade' flag is required to override the existing locked version.
Why this answer
You must update the version constraint (if pinned) and run 'terraform init -upgrade' to fetch the new version.
What are requirements for a custom provider to be recognized by Terraform? (Select THREE)
Providers must be executable binaries.
Why this answer
Custom providers need a specific binary name, a specific directory structure, and possibly a configuration in .terraformrc or CLI config.
Which organization-level setting in HCP Terraform governs who can create new workspaces?
Workspace creation is controlled by team roles within the organization.
Why this answer
Permissions for creating workspaces are managed via Organization Team permissions.
Why might someone use 'prevent_destroy = true' on a database resource while allowing it on smaller web server instances?
This is the primary use case for safety.
Why this answer
This is a common best practice to prevent accidental loss of stateful, critical data while allowing ephemeral instances to be managed normally.
When implementing OPA policies, what is the 'soft-mandatory' enforcement level?
Soft-mandatory provides a warning that can be bypassed.
Why this answer
Soft-mandatory policies can be overridden by users with sufficient permissions after a warning is issued.
You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?
The for expression is the standard HCL construct for transforming lists into maps for resource iteration.
Why this answer
The for expression is the primary tool for transforming collections, allowing you to iterate over a list and produce a map.
Page 3 of 3
Practice AWS provider by domain
Target a specific domain to shore up weak areas.