Understand Terraform basics →mediumMultiple ChoiceObjective-mapped

TF-004 Understand Terraform basics Practice Question

Exhibit

terraform plan

Terraform will perform the following actions:

  # aws_security_group.web_sg will be updated in-place
  ~ resource "aws_security_group" "web_sg" {
        id                     = "sg-12345678"
      ~ ingress {
          - cidr_blocks = ["0.0.0.0/0"]
          + cidr_blocks = ["10.0.0.0/8"]
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Refer to the exhibit. An engineer runs terraform plan and sees this output. Which statement about the planned change is true?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The change will replace the existing ingress rule with a new one.

The plan output shows a -/+ next to the ingress rule, indicating that Terraform will destroy the existing rule and create a new one with the updated CIDR block. This replacement occurs because the `cidr_blocks` attribute change for an ingress rule forces resource recreation. Thus, the existing ingress rule is replaced with a new one, matching option A.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The change will replace the existing ingress rule with a new one.
Why this is correct
The plan output shows '-/+' next to the ingress rule, meaning Terraform will destroy the existing rule and create a new one with the updated CIDR block. This is a replacement, not an in-place update.
✗
The security group will be destroyed and recreated.
Why it's wrong here
A full destroy and recreate of the entire security group resource would be explicitly indicated by "-/+" next to the `aws_security_group` resource block itself in the plan output. The exhibit, however, shows changes occurring *within* the `ingress[0]` block, which represents a specific rule inside the existing security group. This signifies an update to an attribute of the security group, not the replacement of the security group resource itself.
✗
Terraform will add a new ingress rule without removing the old one.
Why it's wrong here
An addition of a new ingress rule without removing an old one would typically be represented by only a "+" sign next to a new `ingress` block, potentially with a new index if it's a list. The "-/+" notation, however, specifically indicates that the existing `ingress[0]` block is first being destroyed (the "-" part) and then a new `ingress[0]` block is being created (the "+" part) with the updated `cidr_blocks`. This is a direct replacement, not an additive change.
✗
The security group will be updated but the ingress rule will remain unchanged.
Why it's wrong here
The `terraform plan` output clearly indicates changes to the ingress rule. Specifically, the line `ingress[0].cidr_blocks` shows a change from `["0.0.0.0/0"]` to `["10.0.0.0/8"]`, marked with "-/+". This explicit display of attribute modification, along with the "-/+" notation for the entire `ingress[0]` block, directly contradicts the statement that the ingress rule will remain unchanged.

Visual reference

Go deeper

TF-004 Understand Terraform basics Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question