Understand Terraform basics →mediumMultiple Choice

TF-004 Understand Terraform basics Practice Question

Exhibit

terraform plan

Terraform will perform the following actions:

  # aws_security_group.web_sg will be updated in-place
  ~ resource "aws_security_group" "web_sg" {
        id                     = "sg-12345678"
      ~ ingress {
          - cidr_blocks = ["0.0.0.0/0"]
          + cidr_blocks = ["10.0.0.0/8"]
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Refer to the exhibit. An engineer runs terraform plan and sees this output. Which statement about the planned change is true?

⚠ Common exam trap

The trap is misreading the plan symbol — candidates see a change on the security group and assume the whole resource is being destroyed, when only the nested ingress rule is being replaced.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The change will replace the existing ingress rule with a new one.

When Terraform's plan output shows an ingress rule being replaced — typically indicated by a `-/+` symbol or a `~` with a `# forces replacement` annotation on the ingress block — it means the existing rule cannot be updated in place and must be destroyed and recreated. This happens because the ingress attribute is a set of objects, and changing a set element's identity forces Terraform to remove the old element and add the new one. The security group itself remains, only the rule is swapped.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The change will replace the existing ingress rule with a new one.
Why this is correct
The plan output shows '-/+' next to the ingress rule, meaning Terraform will destroy the existing rule and create a new one with the updated CIDR block. This is a replacement, not an in-place update.
✗
The security group will be destroyed and recreated.
Why it's wrong here
A full destroy and recreate of the entire security group resource would be explicitly indicated by "-/+" next to the `aws_security_group` resource block itself in the plan output. The exhibit, however, shows changes occurring *within* the `ingress[0]` block, which represents a specific rule inside the existing security group. This signifies an update to an attribute of the security group, not the replacement of the security group resource itself.
✗
Terraform will add a new ingress rule without removing the old one.
Why it's wrong here
An addition of a new ingress rule without removing an old one would typically be represented by only a "+" sign next to a new `ingress` block, potentially with a new index if it's a list. The "-/+" notation, however, specifically indicates that the existing `ingress[0]` block is first being destroyed (the "-" part) and then a new `ingress[0]` block is being created (the "+" part) with the updated `cidr_blocks`. This is a direct replacement, not an additive change.
✗
The security group will be updated but the ingress rule will remain unchanged.
Why it's wrong here
The `terraform plan` output clearly indicates changes to the ingress rule. Specifically, the line `ingress[0].cidr_blocks` shows a change from `["0.0.0.0/0"]` to `["10.0.0.0/8"]`, marked with "-/+". This explicit display of attribute modification, along with the "-/+" notation for the entire `ingress[0]` block, directly contradicts the statement that the ingress rule will remain unchanged.

Go deeper

TF-004 Understand Terraform basics Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question