TF-004 Use Terraform outside the core workflow Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use the Terraform Cloud API to trigger a run.

  Why this is correct

  This is the correct method for programmatic interaction with Terraform Cloud. The Terraform Cloud API provides specific endpoints to create, manage, and trigger runs for designated workspaces, enabling seamless integration with external systems like CI/CD pipelines, custom scripts, or other automation tools. This approach allows for precise control over the run lifecycle, including dynamic variable overrides and explicit plan/apply actions, without requiring direct VCS commits.

• ✗

  Set up a webhook from the VCS provider to trigger runs.

  Why it's wrong here

  While Terraform Cloud supports webhooks from VCS providers (e.g., GitHub, GitLab) to automatically trigger runs upon code commits or pull requests, this mechanism is specifically designed for VCS-driven workflows. It does not facilitate programmatic triggering of runs from an arbitrary CI pipeline or an external system that isn't directly pushing code to the configured VCS repository. The question implies a need for programmatic control *from* a CI pipeline, not *by* a VCS commit.

• ✗

  Configure a remote backend to automatically run apply.

  Why it's wrong here

  A remote backend, such as the `remote` backend for Terraform Cloud, is primarily responsible for securely storing Terraform state files and facilitating state locking to prevent concurrent modifications. While it enables collaboration and remote operations by centralizing state, configuring a remote backend itself does not automatically trigger Terraform runs or apply operations within Terraform Cloud. It merely defines where the state is managed, requiring explicit `terraform plan` or `terraform apply` commands (or API calls in TFC) to initiate actions.

• ✗

  Execute 'terraform apply -auto-approve' in the CI pipeline.

  Why it's wrong here

  Executing `terraform apply -auto-approve` directly within a CI pipeline would perform the Terraform operations on the CI runner itself, using its local environment and credentials. This approach completely bypasses Terraform Cloud's managed run environment, its centralized state management, policy enforcement (Sentinel), and detailed run history. It does not integrate with Terraform Cloud's workflow for executing runs, making it unsuitable for leveraging Terraform Cloud's features for governed infrastructure management.