TF-004 Use Terraform outside the core workflow Practice Question
A company wants to integrate Terraform with their CI/CD pipeline to automatically deploy infrastructure. Which Terraform feature should they use to ensure state files are stored securely and accessible by the pipeline?
⚠ Common exam trap
TF-004 often tests the misconception that keeping state local and gitignoring it is 'secure enough,' when the real requirement is a shared, locked, access-controlled remote backend for CI/CD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Terraform Cloud remote state
Terraform Cloud remote state stores the state file in a managed, access-controlled backend that CI/CD pipelines can authenticate to via API tokens, providing secure storage, locking, and versioning. This satisfies the requirement that state be stored securely and be reliably accessible to the pipeline without committing it to source control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terraform import
Why it's wrong here
The `terraform import` command is specifically designed to bring existing, manually created infrastructure resources under Terraform management by generating corresponding state entries. It is an operational command for initial state population or reconciliation, not a mechanism for storing, sharing, or securing the Terraform state file itself, which is a fundamental requirement for consistent CI/CD pipeline execution across multiple runs or agents.
- ✗
Local state with .gitignore
Why it's wrong here
Storing Terraform state locally (e.g., `terraform.tfstate`) and adding it to `.gitignore` prevents it from being committed to version control, which is good practice for sensitive data. However, this approach renders the state inaccessible to ephemeral CI/CD pipeline runners, which require a shared, persistent, and reliably accessible state file to manage infrastructure consistently. Local state also lacks crucial features like state locking and encryption necessary for secure, collaborative automation.
- ✓
Terraform Cloud remote state
Why this is correct
Terraform Cloud provides a highly secure, reliable, and accessible remote backend for storing Terraform state files. It automatically handles state locking to prevent concurrent modifications, encrypts state at rest and in transit, and offers versioning for auditability. Its API-driven nature and direct integration with Terraform runs make it an ideal solution for CI/CD pipelines, ensuring consistent and collaborative infrastructure management across automated deployments.
- ✗
terraform state push
Why it's wrong here
The `terraform state push` command is a utility for manually uploading a local Terraform state file to a pre-configured remote backend. It is an imperative action to update the state, not a persistent storage solution or a backend configuration itself. A CI/CD pipeline requires a configured remote backend that automatically manages state updates during `terraform apply` operations, rather than relying on manual pushes of a local file, which is prone to errors and race conditions.
Go deeper
Related to this question
About these practice questions
One of 434 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.