TF-004 Understand IaC concepts Practice Question
A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?
⚠ Common exam trap
HashiCorp often tests the misconception that a public subnet or public IP alone guarantees internet accessibility, when in fact the security group's inbound rules are the primary gatekeeper for traffic reaching the instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.
Even if the web server is deployed in a public subnet with a public IP address, the security group acts as a virtual firewall at the instance level. By default, AWS security groups block all inbound traffic. Without an explicit rule allowing inbound HTTP (port 80) or HTTPS (port 443) traffic from 0.0.0.0/0, the web server will not respond to internet requests, making it inaccessible from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance type chosen does not support public IP addresses.
Why it's wrong here
The instance type chosen does not support public IP addresses. This statement is incorrect because the ability to assign a public IP address to an instance is primarily a function of its network interface configuration within the Virtual Private Cloud (VPC) and whether the subnet it resides in is public. All standard cloud instance types, regardless of their size or family, are capable of being associated with a public IP address (either an Elastic IP or an automatically assigned public IP) provided the network settings permit it. Therefore, the instance type itself is not a limiting factor for public IP support.
- ✗
The terraform init command failed and the apply did not actually create resources.
Why it's wrong here
The terraform init command failed and the apply did not actually create resources. This option is incorrect because `terraform init` is a crucial prerequisite step that initializes the working directory, downloads provider plugins, and sets up backend configuration. If `terraform init` were to fail, the subsequent `terraform apply` command would not be able to execute successfully or create any resources at all. The problem statement implies that resources were deployed but inaccessible, which contradicts a scenario where `init` failed and no resources were created.
- ✗
The subnet is configured as private and does not have a route to the internet.
Why it's wrong here
The subnet is configured as private and does not have a route to the internet. While a private subnet without an internet gateway route would indeed prevent any inbound internet access to the instance, this option is less specific than a security group issue when the problem specifically mentions inability to access via HTTP/HTTPS. If the subnet were truly private, *no* internet traffic, regardless of port, would reach the instance. A security group, however, acts as a virtual firewall that can selectively block specific ports (like 80 and 443) even if the instance has a public IP and resides in a public subnet with a route to the internet.
- ✓
The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.
Why this is correct
The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0. This is the most probable cause. Security groups function as stateful virtual firewalls that control inbound and outbound traffic for instances. For a web server to be accessible over HTTP (port 80) or HTTPS (port 443) from any IP address on the internet (represented by 0.0.0.0/0), explicit inbound rules must be configured within the associated security group. Without these specific rules, all connection attempts on those ports will be silently dropped, making the web server appear inaccessible even if it is running and has a public IP address.
Visual reference
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.