TF-004 Implement and maintain state Practice Question
A Terraform state file is stored in an S3 bucket with versioning enabled. During a deployment, the state file becomes corrupted due to a network error. What is the best way to recover?
⚠ Common exam trap
A common trap is assuming that `terraform state pull` can fix corruption, but it only retrieves the current state; the real recovery mechanism is S3 versioning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore the previous version of the state file from S3 versioning.
S3 versioning preserves previous versions of objects, including Terraform state files. When the current state file becomes corrupted, you can restore a prior, uncorrupted version directly from the S3 bucket without data loss or manual re-creation of resources. This is the safest and most efficient recovery method.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use `terraform state pull` to overwrite the corrupted state.
Why it's wrong here
Use `terraform state pull` to overwrite the corrupted state. retrieves the *current* remote state and outputs it to standard output or a local file. If the remote state file stored in the S3 bucket is already corrupted, executing `terraform state pull` will simply retrieve this corrupted version. This command is a read operation and does not possess any capabilities to repair, restore, or replace a corrupted state file with a previous, valid version. Therefore, it cannot be used to fix the problem.
- ✗
Run `terraform import` to import all resources.
Why it's wrong here
Running `terraform import` requires manually mapping existing real-world infrastructure to specific resource addresses within the configuration, which fails to restore the lost metadata and dependency graph contained in a corrupted state file. This command is designed for bringing unmanaged resources under Terraform control rather than recovering data from a failed backend. You would use it when you have already deployed resources via a console or CLI and need to synchronise them with your code.
- ✓
Restore the previous version of the state file from S3 versioning.
Why this is correct
S3 versioning, when enabled on the bucket storing the Terraform state file, automatically retains multiple historical versions of the state object. In the event of state file corruption, an administrator can directly access the S3 bucket, locate the corrupted state file, and restore a previous, known-good version of that file. This action effectively rolls back the Terraform state to a functional point, allowing operations to resume without data loss or manual reconciliation.
- ✗
Delete the state file and run `terraform apply` to recreate all resources.
Why it's wrong here
Deleting the Terraform state file completely removes Terraform's record of the infrastructure it manages. Consequently, if `terraform apply` is then executed, Terraform will perceive that no resources currently exist and will attempt to *create* every resource defined in the configuration from scratch. This would inevitably lead to errors for resources that already exist in the cloud (e.g., "resource already exists") or, in some cases, create duplicate resources, causing significant infrastructure drift and potential service disruptions.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.