TF-004 Implement and maintain state Practice Question
A team uses an S3 backend for Terraform state. During a `terraform apply`, another team member accidentally runs a plan that also modifies the same state. Which feature prevents state corruption in this scenario?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
State locking via DynamoDB
State locking via DynamoDB prevents concurrent modifications to the state file, ensuring that only one operation can modify the state at a time. Option A (-lock=false) disables locking, which would allow concurrent modifications and risk corruption. Option B (Terraform Cloud remote operations) is not directly related to state locking in this S3 backend scenario. Option D (state versioning) helps recover from corruption but does not prevent simultaneous writes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The `-lock=false` flag
Why it's wrong here
The `-lock=false` flag explicitly disables Terraform's state locking mechanism. This action is counterproductive for protecting state during concurrent operations, as it removes the safeguard designed to prevent multiple users or automated processes from simultaneously modifying the remote state file. Disabling locking significantly increases the risk of state file corruption, lost updates, and inconsistent infrastructure deployments in collaborative environments.
- ✗
Terraform Cloud remote operations
Why it's wrong here
Terraform Cloud remote operations refer to the execution environment where Terraform commands are run within the Terraform Cloud platform. While Terraform Cloud inherently provides robust state locking as part of its managed remote execution capabilities, 'remote operations' itself is a broad platform feature, not the specific underlying mechanism (like DynamoDB) that performs the state locking. The platform leverages locking, but it is not the direct feature for preventing concurrent state modifications.
- ✓
State locking via DynamoDB
Why this is correct
State locking via DynamoDB is the correct and recommended mechanism for protecting Terraform state when using an S3 backend. Terraform utilizes a DynamoDB table to acquire and release a distributed lock before and after state modifications, ensuring that only one `terraform apply` or `terraform destroy` operation can proceed at a time. This prevents race conditions, safeguards state consistency, and avoids corruption in shared development or production environments.
- ✗
State versioning in S3
Why it's wrong here
State versioning in S3 automatically retains previous versions of the state file whenever it is updated or deleted, providing a crucial mechanism for disaster recovery and auditing. While versioning allows for rollbacks to earlier states and protects against accidental data loss, it does not prevent concurrent write operations from occurring. It addresses data integrity from a historical perspective, not from the perspective of preventing simultaneous modifications that could lead to state corruption.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.