TF-004 Use Terraform outside the core workflow Practice Question
An organization uses Terraform Cloud for team collaboration. They have a workspace that manages production infrastructure. Due to a security policy, they must ensure that all changes go through a peer review process before they are applied. How can they enforce this requirement?
⚠ Common exam trap
Candidates often confuse 'requiring a VCS pull request' (option B) with enforcing peer review, but without the approval step, the apply can still happen automatically after merge, bypassing the intended review gate.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'apply on merge' and set the workspace to require approval before applying.
Enabling 'apply on merge' combined with requiring approval before applying enforces a peer review process: changes must be merged via a VCS pull request (triggering the plan), and then a separate approval step is needed before Terraform Cloud applies the changes. This ensures that no change is applied without explicit human approval after the plan is reviewed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'apply on merge' and set the workspace to require approval before applying.
Why this is correct
Enabling 'apply on merge' configures the workspace to automatically initiate a Terraform run (plan) whenever code is merged into the configured VCS branch. By additionally setting the workspace to require explicit approval before applying, Terraform Cloud ensures that the planned changes are reviewed and approved by an authorized user within the TFC UI before they are actually provisioned. This combination provides a robust, automated, yet controlled deployment pipeline, aligning VCS changes with a mandatory human gate.
- ✗
Require all changes to be submitted via a VCS pull request.
Why it's wrong here
While requiring all changes to be submitted via a Version Control System (VCS) pull request is a fundamental best practice for code review and quality, it does not inherently enforce an approval step within Terraform Cloud for the actual infrastructure apply operation. A successful VCS merge only triggers a plan in Terraform Cloud; it doesn't guarantee that the subsequent apply will require or receive explicit approval from a designated approver within the Terraform Cloud run workflow itself. This approach only ensures code review, not infrastructure deployment approval.
- ✗
Use run triggers to automatically apply after a successful plan in another workspace.
Why it's wrong here
Run triggers are designed to automate the execution of Terraform runs across interconnected workspaces, typically for dependency management where one workspace's output feeds another's input. While they can automatically initiate a plan and even an apply in a dependent workspace upon a successful run in a source workspace, run triggers do not inherently incorporate an explicit approval step for the apply phase. Their primary function is automation and chaining, not enforcing a human review gate for deployment.
- ✗
Lock the workspace and only unlock it for approved changes.
Why it's wrong here
Locking a Terraform Cloud workspace is a mechanism primarily intended to prevent concurrent runs or accidental modifications during critical operations, ensuring state consistency. It is a temporary measure, not a sustainable workflow for managing approved changes. Manually locking and unlocking a workspace for every approved change is cumbersome, error-prone, and bypasses Terraform Cloud's built-in, more sophisticated run workflow and approval features. This approach severely hinders team collaboration and automation.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.