TF-004 Use the core Terraform workflow Practice Question
A company uses Terraform to manage infrastructure in multiple AWS accounts. An engineer runs terraform plan and sees that a security group rule will be updated, but the change is not intended. The engineer wants to understand why Terraform is proposing the change without affecting other resources. Which approach should the engineer take to troubleshoot?
⚠ Common exam trap
HashiCorp often tests the misconception that `terraform show` alone (without a plan file) reveals the reason for a proposed change, when in fact it only displays the current state or a previously saved plan, not the diff logic for a new plan.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run terraform plan -out=plan.tfplan and then terraform show plan.tfplan.
`terraform plan -out=plan.tfplan` saves the plan to a binary file, and `terraform show plan.tfplan` then displays the full plan details, including the exact attribute-level diff and the reason for the change (e.g., a drift between the configuration and the state). This allows the engineer to inspect the proposed change without applying it, isolating the root cause without affecting other resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run terraform state list to review the current state.
Why it's wrong here
Running `terraform state list` only enumerates the resource addresses currently tracked within the Terraform state file. It provides a simple list of managed resources and their unique identifiers, but it does not perform any comparison against the current configuration or the remote infrastructure. Therefore, this command cannot reveal any proposed changes that would occur if a new configuration were applied.
- ✗
Run terraform show to display the current state.
Why it's wrong here
Running `terraform show` without specifying a plan file will display the current state of the infrastructure as recorded in the `terraform.tfstate` file. While `terraform show` can indeed display the contents of a plan, it explicitly requires a plan file argument (e.g., `terraform show plan.tfplan`) to do so. Consequently, this command alone does not generate or reveal any proposed changes based on the current configuration.
- ✗
Run terraform validate to check for configuration errors.
Why it's wrong here
`terraform validate` performs a static analysis of the Terraform configuration files, primarily checking for syntax errors, attribute type mismatches, and other internal consistency issues. It ensures the configuration is syntactically correct and valid according to Terraform's language rules. However, `validate` does not interact with the state file or remote providers, nor does it generate an execution plan, making it incapable of showing proposed infrastructure changes.
- ✓
Run terraform plan -out=plan.tfplan and then terraform show plan.tfplan.
Why this is correct
This two-step approach is the correct method for reviewing proposed infrastructure changes before applying them. `terraform plan -out=plan.tfplan` first generates a detailed execution plan by comparing the current configuration with the existing state and remote infrastructure, saving it to a specified file. Subsequently, `terraform show plan.tfplan` allows for a comprehensive, human-readable inspection of all proposed actions (creations, updates, deletions) contained within that saved plan file, without applying them.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.