TF-004 Use the core Terraform workflow Practice Question
A team uses Terraform to manage infrastructure. After running 'terraform apply', a developer notices that a new security group rule was added, but then immediately removed. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that Terraform only adds resources and never removes them, or that manual changes are automatically adopted; the trap here is that candidates confuse Terraform's 'import' capability (which requires explicit import) with automatic drift correction, leading them to think Terraform would preserve the manual rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group rule was added manually and Terraform removed it to match the configuration.
Terraform operates on a desired-state model: it compares the configuration in `.tf` files against the real-world infrastructure and the state file. If a security group rule was added manually outside of Terraform, Terraform detects it as a drift during the next `apply` and removes it to reconcile the actual state with the declared configuration. This is the core behavior of Terraform's lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The security group rule was added manually and Terraform removed it to match the configuration.
Why this is correct
Terraform's core principle is to manage infrastructure to match the desired state defined in its configuration files. When a security group rule is added manually outside of Terraform, it creates a "drift" between the actual infrastructure and Terraform's known desired state. During a subsequent `terraform apply` operation, Terraform detects this unmanaged rule and, in its effort to enforce the configured state, removes the rule to bring the infrastructure back into alignment with what is declared in the `.tf` files.
- ✗
The state file was corrupted and Terraform performed a refresh.
Why it's wrong here
A `terraform refresh` command, or the implicit refresh during `terraform plan` or `apply`, updates the Terraform state file to reflect the current actual state of resources in the cloud. While a corrupted state file could lead to unexpected behavior, a refresh operation itself is designed to *read* the current infrastructure and update the state, not to *modify* or remove resources from the remote system. Therefore, a refresh alone would not cause a security group rule to be removed.
- ✗
The configuration was changed to remove the rule after the apply.
Why it's wrong here
If the Terraform configuration files were modified to remove the security group rule *after* a successful `apply` operation, the rule would not be immediately removed from the infrastructure. The next `terraform plan` would then show that the rule is slated for destruction, and only a subsequent `terraform apply` command, executed *after* the configuration change, would actually perform the removal. The scenario describes the rule being removed *during* an apply, not as a result of a prior configuration change.
- ✗
The developer accidentally ran 'terraform destroy' instead.
Why it's wrong here
The `terraform destroy` command is specifically designed to tear down *all* resources managed by the current Terraform configuration within the workspace. If `terraform destroy` had been executed, it would have attempted to remove the entire infrastructure defined in the configuration, not just a single, newly added security group rule. The question implies only a specific rule was removed, making a full `destroy` operation an unlikely cause.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.