TF-004 Understand Terraform basics Practice Question
A developer runs terraform apply to create an AWS EC2 instance using an AMI sourced from the aws_ami data source with most_recent = true. Immediately after apply completes, the developer runs terraform plan again. The plan shows that Terraform intends to replace the EC2 instance. What is the most likely cause?
⚠ Common exam trap
The TF-003 exam often tests the misconception that data source results are cached in state and remain static between runs, whereas in reality they are fetched fresh each plan, leading to potential drift when external resources change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A new AMI was released after the apply, causing the data source to return a different AMI ID.
The `aws_ami` data source with `most_recent = true` dynamically queries AWS for the latest AMI matching the specified filters at plan time. If a new AMI is published between the first `apply` and the subsequent `plan`, the data source returns a different AMI ID, causing Terraform to detect a change in the AMI attribute of the EC2 instance. Since the AMI ID is a force-new attribute for `aws_instance`, Terraform plans to replace the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A new AMI was released after the apply, causing the data source to return a different AMI ID.
Why this is correct
When an `aws_ami` data source is configured with `most_recent = true`, Terraform dynamically queries AWS for the latest matching AMI during each `terraform plan` execution. If a new AMI is released by AWS between an `apply` and a subsequent `plan`, the data source will resolve to a different AMI ID. This change in the computed AMI ID, which is typically used by an `aws_instance` resource, will be detected by Terraform as a drift, necessitating the replacement of the existing EC2 instance to use the newly identified AMI.
- ✗
The developer did not run terraform init before the second plan.
Why it's wrong here
Running `terraform init` primarily initializes the working directory by downloading necessary provider plugins and modules, and setting up backend configuration. While crucial for initial setup or when provider versions or modules change, failing to run `init` before a subsequent `plan` on an already initialized configuration would typically result in an error indicating missing providers or an uninitialized backend. It does not alter the values retrieved by data sources or cause configuration drift leading to resource replacement.
- ✗
The instance type was changed in the configuration between apply and plan.
Why it's wrong here
If the `instance_type` attribute within the `aws_instance` resource block was explicitly modified in the Terraform configuration file between `apply` and `plan`, Terraform would indeed detect this as a change requiring an update or replacement of the EC2 instance. However, the problem statement implies no explicit configuration changes were made by the developer. The scenario describes an unexpected replacement *without* a direct modification to the `.tf` files, making this option inconsistent with the premise.
- ✗
The Terraform state file was corrupted during the apply.
Why it's wrong here
The Terraform state file (`terraform.tfstate`) records the real-world infrastructure managed by Terraform, mapping configuration to actual resources. If the state file were corrupted, `terraform plan` would likely fail with parsing errors, inconsistencies, or an inability to match resources, rather than successfully generating a plan that proposes a clean replacement of an existing resource due to a perceived change. State corruption typically manifests as critical errors preventing any successful plan or apply operation.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.