TF-004 Use the core Terraform workflow Practice Question
A team is using Terraform with multiple environments (dev, staging, prod) and wants to use separate state files. They are considering workspaces. A senior engineer suggests using separate directory structures instead of workspaces for prod. What is the strongest reason for this recommendation?
⚠ Common exam trap
HashiCorp often tests the misconception that workspaces provide full isolation, when in fact they only isolate state file keys, not the backend configuration or access controls, making separate directories safer for production environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Workspaces share the same backend configuration, increasing the risk of accidental changes to production.
Workspaces share the same backend configuration, meaning all workspaces (including prod) use the same state storage location and access controls. This increases the risk of accidental changes to production because a single backend misconfiguration or a mistaken workspace switch can lead to unintended modifications to the production state file. Separate directory structures allow for independent backend configurations, enabling stricter access controls and isolation for production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Workspaces share the same backend configuration, increasing the risk of accidental changes to production.
Why this is correct
Workspaces, by design, share the same backend configuration, meaning a single `terraform init` command configures access to a specific remote state location (e.g., an S3 bucket or Azure Storage Account) for all workspaces. This shared backend increases the risk that an operator might accidentally switch to a production workspace while intending to work in a development environment, leading to unintended modifications or destruction of critical production infrastructure. The underlying backend access credentials and configuration are identical across all workspaces within that directory.
- ✗
Workspaces cannot isolate state files.
Why it's wrong here
This statement is incorrect because Terraform workspaces are specifically designed to isolate state files within a single backend configuration. Each workspace (e.g., `default`, `dev`, `prod`) corresponds to a unique path or key prefix within the remote state backend, ensuring that the infrastructure resources managed by one workspace are distinct from those managed by another. This logical separation prevents state conflicts and allows for independent management of different environment instances.
- ✗
Workspaces make it harder to refactor configurations.
Why it's wrong here
Refactoring Terraform configurations, which involves reorganizing resources or moving them between modules, is not inherently made harder by the use of workspaces. While state manipulation commands like `terraform state mv` must be executed within the context of the correct workspace, the structural changes to the `.tf` files themselves are largely independent of the workspace concept. The complexity of refactoring is more closely tied to the overall architecture and organization of the Terraform code, rather than the presence of multiple workspaces.
- ✗
Workspaces do not support state locking.
Why it's wrong here
This statement is false, as Terraform's state locking mechanism is fully supported and functional across all workspaces within a given backend. When an operation like `terraform apply` or `terraform plan` is initiated for a specific workspace, Terraform attempts to acquire a lock for that workspace's state file. This critical feature prevents concurrent modifications to the state, ensuring data integrity and preventing corruption, regardless of which workspace is being targeted by the operation.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.