TF-004 Use Terraform outside the core workflow Practice Question
A company wants to integrate Terraform with their CI/CD pipeline to automatically deploy infrastructure. Which Terraform feature should they use to ensure state files are stored securely and accessible by the pipeline?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Terraform Cloud remote state
Using a remote state backend (like Terraform Cloud) ensures state is stored securely and can be accessed by pipeline runs. Local state with .gitignore is not secure or accessible. Terraform import is for adding existing resources, not state storage. terraform state push is used to manually upload state.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Terraform import
Why it's wrong here
The `terraform import` command is specifically designed to bring existing, manually created infrastructure resources under Terraform management by generating corresponding state entries. It is an operational command for initial state population or reconciliation, not a mechanism for storing, sharing, or securing the Terraform state file itself, which is a fundamental requirement for consistent CI/CD pipeline execution across multiple runs or agents.
- ✗
Local state with .gitignore
Why it's wrong here
Storing Terraform state locally (e.g., `terraform.tfstate`) and adding it to `.gitignore` prevents it from being committed to version control, which is good practice for sensitive data. However, this approach renders the state inaccessible to ephemeral CI/CD pipeline runners, which require a shared, persistent, and reliably accessible state file to manage infrastructure consistently. Local state also lacks crucial features like state locking and encryption necessary for secure, collaborative automation.
- ✓
Terraform Cloud remote state
Why this is correct
Terraform Cloud provides a highly secure, reliable, and accessible remote backend for storing Terraform state files. It automatically handles state locking to prevent concurrent modifications, encrypts state at rest and in transit, and offers versioning for auditability. Its API-driven nature and direct integration with Terraform runs make it an ideal solution for CI/CD pipelines, ensuring consistent and collaborative infrastructure management across automated deployments.
- ✗
terraform state push
Why it's wrong here
The `terraform state push` command is a utility for manually uploading a local Terraform state file to a pre-configured remote backend. It is an imperative action to update the state, not a persistent storage solution or a backend configuration itself. A CI/CD pipeline requires a configured remote backend that automatically manages state updates during `terraform apply` operations, rather than relying on manual pushes of a local file, which is prone to errors and race conditions.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.