Use Terraform outside the core workflow →hardMultiple ChoiceObjective-mapped

TF-004 Use Terraform outside the core workflow Practice Question

A company uses Terraform with a remote backend (AWS S3). They want to ensure that the state file is encrypted at rest. Which configuration approach guarantees this?

⚠ Common exam trap

Candidates often confuse provider-level encryption settings (which don't exist) with backend-level encryption, or assume a CLI flag like `-encrypt-state` exists, when in fact encryption must be explicitly declared in the backend configuration block.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the S3 backend with server-side encryption enabled (e.g., 'encrypt = true' and 'kms_key_id').

The S3 backend configuration block supports the `encrypt` and `kms_key_id` arguments, which enable server-side encryption (SSE-S3 or SSE-KMS) for the state file stored in the S3 bucket. This ensures that the state file is encrypted at rest, meeting the requirement without any additional steps or external commands.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Configure the S3 backend with server-side encryption enabled (e.g., 'encrypt = true' and 'kms_key_id').
Why this is correct
S3 backend encryption encrypts state at rest.
✗
Enable encryption in the AWS provider block.
Why it's wrong here
Provider encryption is for data plane, not state storage.
✗
Use 'terraform state encrypt' command.
Why it's wrong here
No such command exists.
✗
Use 'terraform init -encrypt-state' flag.
Why it's wrong here
No such flag exists.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

Scored practice sessions

Scored 10-question sessions with instant feedback and explanations.

TF-004 Practice Test 2 — 25 Questions→TF-004 Practice Questions 2 — 50 Questions→Free TF-004 Practice Test 2 — 30 Questions→

Study by exam domain

Domains are weighted differently on the real exam — spend your time where you score lowest.

Use Terraform outside the core workflow Understand Terraform basics Understand IaC concepts Implement and maintain state

Filter by question format

Pick a question style and work only that format until it feels routine.

Browse scenarios

Go deeper on a topic

Narrow in on a single topic rather than practising the whole bank at once.

Use Terraform outside the core workflow practice questions Understand Terraform's purpose practice questions Understand IaC concepts practice questions

Where to go next

All TF-004 questions TF-004 practice test Study guide

This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.

TF-004 Use Terraform outside the core workflow Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question