TF-004 Practice Questions

Question 1

Refer to the exhibit. What does this output indicate?

Accepted Answer

A resource will be modified. The output shows a Terraform plan with a tilde (~) prefix next to a resource attribute, which indicates an in-place update. This means Terraform will modify the existing resource without destroying and recreating it, confirming that option A is correct.

Answer

A resource will be destroyed

Answer

No changes

Answer

A resource will be created

Question 2

A team using a remote S3 backend with DynamoDB locking is experiencing frequent 'Error acquiring the state lock' messages in their CI/CD pipeline. The pipeline runs multiple concurrent jobs for different workspaces. What is the most likely cause and solution?

Accepted Answer

The same workspace is being used for concurrent runs; use separate workspaces per environment.. The error 'Error acquiring the state lock' occurs when Terraform cannot obtain a lock on the state file for a specific workspace. In this scenario, the pipeline runs multiple concurrent jobs for different workspaces, but if the same workspace is inadvertently used across concurrent runs, Terraform's DynamoDB-based locking mechanism will prevent simultaneous access to that workspace's state. The solution is to ensure each environment (e.g., dev, staging, prod) uses a separate workspace, avoiding lock contention. Option B correctly identifies this as the most likely cause and solution.

Answer

The DynamoDB table lacks sufficient read/write capacity; increase it.

Answer

The pipeline is running too many jobs; increase the lock wait time.

Answer

The S3 bucket is not versioned; enable versioning.

Question 3

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Accepted Answer

Idempotency. Idempotency ensures that applying the same Terraform configuration multiple times results in the same desired state, with no unintended changes on subsequent runs. Terraform achieves this by comparing the current state (stored in a state file) with the desired configuration and only making changes necessary to reconcile differences. This is the core principle behind Terraform's 'plan and apply' workflow, which guarantees repeatable infrastructure provisioning.

Answer

Dynamic provider credentials

Answer

Modularity

Answer

Version control

Question 4

A team uses an S3 backend with DynamoDB for state locking. They notice that sometimes terraform plan fails because the state is locked. What is the best practice to handle this in an automated pipeline?

Accepted Answer

Serialize pipeline runs to avoid concurrent execution. Serializing pipeline runs is the best practice to prevent concurrent Terraform operations from competing for the same state lock. When multiple pipeline jobs attempt to run `terraform plan` or `terraform apply` simultaneously, DynamoDB-based state locking ensures only one operation holds the lock at a time, causing the others to fail. By enforcing sequential execution (e.g., via CI/CD stage dependencies or a mutex), you avoid lock contention entirely without risking data corruption or bypassing safety mechanisms.

Answer

Use force-unlock before each plan

Answer

Increase the lock timeout

Answer

Use -lock=false in the pipeline

Question 5

A junior DevOps engineer is learning about Infrastructure as Code (IaC) and asks why Terraform is preferred over manual configuration in cloud consoles. Which of the following is the primary benefit of using Terraform for infrastructure management?

Accepted Answer

It enables version-controlled, repeatable, and automated infrastructure provisioning.. Terraform's core value proposition is enabling infrastructure as code (IaC), which allows teams to define infrastructure in declarative configuration files, version control them with Git, and provision consistently across environments. This repeatability and automation eliminate the drift and manual errors inherent in clicking through cloud consoles, making infrastructure management auditable, collaborative, and scalable.

Answer

It can only manage infrastructure on major cloud providers like AWS, Azure, and GCP.

Answer

It automatically rolls back any failed infrastructure changes.

Answer

It uses an imperative approach where you specify exact commands to execute.

Question 6

Refer to the exhibit. What is the purpose of this output block?

Accepted Answer

To display the public IP address of the instance after apply.. The output block shown in the exhibit is a Terraform output value, which is defined using the `output` block in a configuration file. Its purpose is to display the public IP address of the instance in the terminal after `terraform apply` completes, providing a quick reference for the user. Option D correctly identifies this behavior, as outputs are designed to surface resource attributes to the user without storing them or creating external records.

Answer

To store the public IP in a local file.

Answer

To set the public IP as a variable for use in other configurations.

Answer

To create a DNS record with the public IP.

Question 7

Refer to the exhibit. What is the purpose of the data source?

Accepted Answer

To fetch an existing AMI ID. In Terraform, a data source allows you to fetch or compute information from external sources that is not defined within the current configuration. The correct answer is B because the data source in the exhibit (e.g., `aws_ami`) is used to query and retrieve the ID of an existing AMI that matches specified filters, such as name, owner, or tag, without creating a new AMI. This enables dynamic referencing of pre-existing resources in your infrastructure.

Answer

To create a new AMI

Answer

To define a variable

Answer

To output the AMI name

Question 8

A team uses Terraform with remote state in Azure Storage. They have a CI/CD pipeline that runs terraform plan and apply. Recently, a team member ran terraform apply manually from their local machine and the process crashed due to a network interruption. Now, the pipeline's next run fails with an error: "Error: Error acquiring the state lock". The team is unsure who holds the lock. They need to proceed with the pipeline as soon as possible. What should they do?

Accepted Answer

Use terraform force-unlock with the lock ID to break the lock.. The correct action is to use `terraform force-unlock` with the lock ID to break the stale lock. When a Terraform process crashes while holding a state lock (stored in Azure Blob Storage via the `azurerm` backend), the lock remains in place, blocking all subsequent operations. The `force-unlock` command is the designed mechanism to manually release such locks, and the lock ID can be obtained from the error message or by querying the Azure Storage blob's lease state.

Answer

Wait for the lock to expire automatically.

Answer

Re-run terraform apply with -lock=false to skip locking.

Answer

Delete the .terraform folder and reinitialize.

Question 9

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Accepted Answer

Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.. It leverages Terraform's module system to define reusable infrastructure components in a shared directory, while each environment (dev, staging, prod) has its own subdirectory with a root configuration that calls those modules and passes environment-specific `.tfvars` files. This minimizes code duplication by keeping the module logic in one place, and allows per-environment variable values without mixing concerns. It follows the recommended pattern for multi-environment management in Terraform, avoiding the pitfalls of branches, workspaces, or conditional logic that can lead to complexity or state corruption.

Answer

Use a separate Git branch for each environment, each with its own Terraform configuration.

Answer

Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.

Answer

Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.

Question 10

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

Accepted Answer

Another Terraform process is currently running and holds the state lock.. The error 'ConditionalCheckFailedException' occurs when DynamoDB's conditional put operation fails, which happens when a lock item already exists in the DynamoDB table. This indicates another Terraform process currently holds the state lock, preventing concurrent operations. Terraform uses DynamoDB's conditional writes to ensure only one process can acquire the lock at a time.

Answer

The state file in S3 is corrupted.

Answer

The DynamoDB table is not configured with a primary key named LockID.

Answer

The S3 bucket does not have versioning enabled.

Question 11

In Terraform, the `terraform plan` command compares the current state with the configuration. This is an example of which IaC principle?

Accepted Answer

Desired state enforcement. The `terraform plan` command compares the current state (what is deployed) with the configuration (what is declared) and computes the changes needed to align the real-world infrastructure with the declared configuration. This is the essence of desired state enforcement: the tool continuously reconciles the actual state toward the user-defined desired state, rather than executing imperative steps. Option D is correct because Terraform's core loop—plan, apply, refresh—is built around this declarative, state-driven model.

Answer

Version control integration

Answer

Continuous delivery

Answer

Modular architecture

Question 12

A junior engineer is asked to review a Terraform configuration that defines a module from the Terraform Registry. In which files are the descriptions of the module’s inputs and outputs typically found?

Accepted Answer

variables.tf. In Terraform modules, input variables are declared in `variables.tf` with `description` arguments to document their purpose, and output values are declared in `outputs.tf` with `description` arguments. Therefore, descriptions of both inputs and outputs are found in these two files. Neither file alone describes both; the question's phrasing implies consideration of both files, making both B and C correct.

Answer

versions.tf

Answer

main.tf

Question 13

Refer to the exhibit. A team is troubleshooting a Terraform deployment. What information can be inferred from this state file?

Accepted Answer

There is one EC2 instance of type t2.micro with a dependency on a security group.. The state file explicitly shows a resource of type `aws_instance` with `instance_type = "t2.micro"` and a `depends_on` meta-argument referencing `aws_security_group.example`. This indicates that Terraform recorded the EC2 instance as created with a t2.micro type and that it has a formal dependency on a security group resource, ensuring the security group is created before the instance during apply.

Answer

The Terraform version is outdated and must be upgraded.

Answer

The instance ID is invalid and needs to be recreated.

Answer

The security group dependency was not applied.

Question 14

A team uses Terraform with remote state in an S3 backend and DynamoDB for state locking. A user runs 'terraform apply' and receives the error: 'Error acquiring the state lock'. The lock info shows a lock ID and caller. What is the best immediate course of action?

Accepted Answer

Check if another Terraform process is running; if not, use 'terraform force-unlock' with the lock ID.. The error indicates a state lock is held, typically by another Terraform process or a stale lock. The best immediate course is to verify no other process is running (e.g., via 'ps' or task manager), then use 'terraform force-unlock -lock-id=<LOCK_ID>' to release the lock. This is the safe, documented procedure that preserves the state file and DynamoDB lock table integrity.

Answer

Delete the state file from S3 and re-run apply.

Answer

Manually delete the DynamoDB lock table item.

Answer

Wait for 15 minutes and re-run apply.

Question 15

An engineer modifies a Terraform configuration by increasing the instance_count for an AWS EC2 resource from 2 to 5. After running terraform plan, which change will be displayed?

Accepted Answer

Three new resources will be created, two unchanged.. Terraform's `instance_count` meta-argument uses a count-based resource management strategy. When the count increases from 2 to 5, Terraform treats the existing resources (index 0 and 1) as unchanged and plans to create three new resources (indices 2, 3, and 4). No in-place updates or destructions occur because the existing resources' configurations remain identical.

Answer

One new resource will be created and two modified.

Answer

Two existing resources will be destroyed and five new created.

Answer

All five resources will be updated in-place.

HashiCorp Terraform Associate TF-004 practice test

Three ways to study

Study TF-004 by domain

Study TF-004 by topic

Use Terraform outside the core workflow practice questions

Understand IaC concepts practice questions

Interact with Terraform modules practice questions

Understand Terraform's purpose practice questions

Understand Terraform basics practice questions

Implement and maintain state practice questions

Use the core Terraform workflow practice questions

Read, generate and modify configuration practice questions

TF-004 fundamentals practice questions

TF-004 scenario practice questions

TF-004 troubleshooting practice questions

Top TF-004 questions

HashiCorp Terraform Associate TF-004 practice questions