How many Troubleshooting Scenario Questions questions are on this page?

This page has 7 Troubleshooting Scenario Questions scenario questions for the TF-003 exam, each with detailed explanations and wrong-answer analysis.

How should I approach TF-003 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to HashiCorp Terraform Associate TF-003 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise HashiCorp Terraform Associate TF-003 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

TF-003

exam code

HashiCorp

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A DevOps engineer is troubleshooting a failed 'terraform plan' command. The error message is: 'Error: Error acquiring the state lock' followed by a message that the lock is held by another process. The team uses Terraform Cloud with remote state. Which of the following is the most likely cause and correct resolution?

A
Disable state locking in the backend configuration.
Why wrong: Terraform Cloud does not allow disabling locking.
B
Wait for the lock to be released automatically.
Why wrong: If the lock is stuck (e.g., due to a crash), it may not release automatically.
C
Add the '-lock=false' flag to the plan command.
Why wrong: There is no '-lock=false' flag on plan; locking is part of the operation.
D
Identify the lock holder via Terraform Cloud UI and use 'terraform force-unlock' to release it.
The lock ID is available in the UI, and force-unlock can release it.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

A company uses Terraform to manage infrastructure in multiple AWS accounts. An engineer runs terraform plan and sees that a security group rule will be updated, but the change is not intended. The engineer wants to understand why Terraform is proposing the change without affecting other resources. Which approach should the engineer take to troubleshoot?

A
Run terraform state list to review the current state.
Why wrong: State list shows resources in state, not proposed changes.
B
Run terraform show to display the current state.
Why wrong: terraform show shows state or plan, but without a plan file it shows state, not proposed changes.
C
Run terraform validate to check for configuration errors.
Why wrong: Validate checks syntax and consistency, not plan logic.
D
Run terraform plan -out=plan.tfplan and then terraform show plan.tfplan.
This saves the plan and allows detailed inspection of proposed changes.

Full breakdown with real-world context →

Question 3mediummulti select

Full question →

A team runs terraform plan and sees changes that are unexpected. Which TWO actions should they take to investigate before applying?

A
Run terraform providers mirror to ensure provider versions are consistent.
Inconsistent provider versions can cause unexpected drift.
B
Save the plan with terraform plan -out=plan.tfplan and then use terraform show plan.tfplan to examine details.
show with a plan file gives a detailed diff.
C
Delete the state and re-import all resources.
Why wrong: Deleting state is drastic and should not be the first action.
D
Manually edit the state file to match the configuration.
Why wrong: Manual state editing is error-prone and not recommended.
E
Revert the configuration to the previous commit and re-run plan.
Why wrong: Reverting without understanding the change may mask the issue.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. A team is troubleshooting a Terraform deployment. What information can be inferred from this state file?

Exhibit

{
  "version": 4,
  "terraform_version": "1.5.0",
  "resources": [
    {
      "mode": "managed",
      "type": "aws_instance",
      "name": "web",
      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
      "instances": [
        {
          "attributes": {
            "id": "i-0a1b2c3d4e5f67890",
            "instance_type": "t2.micro"
          },
          "dependencies": [
            "aws_security_group.web_sg"
          ]
        }
      ]
    }
  ]
}

A
The Terraform version is outdated and must be upgraded.
Why wrong: Version 1.5.0 is a recent version, not necessarily outdated.
B
There is one EC2 instance of type t2.micro with a dependency on a security group.
The state shows exactly one instance with those attributes and a dependency.
C
The instance ID is invalid and needs to be recreated.
Why wrong: The ID appears valid; no indication of corruption.
D
The security group dependency was not applied.
Why wrong: The dependency is recorded, meaning it was applied; the security group may exist.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

A
Run 'terraform plan' to see the detailed error.
Why wrong: 'terraform plan' may not show the policy validation error; it's typically only caught during apply.
B
Use 'terraform console' to test the policy string.
Why wrong: 'terraform console' evaluates expressions but not IAM policy validation.
C
Use a JSON validator tool to check the policy string in the configuration.
Validating the JSON string locally identifies syntax issues before running apply.
D
Upgrade to the latest Terraform version.
Why wrong: Version upgrade won't fix a policy syntax error.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A developer is troubleshooting a Terraform configuration that fails during `terraform plan` with the error: "Error: Invalid reference". The error points to a line that references `var.environment` in a module block. What is the most likely cause?

A
The Terraform version does not support module variables
Why wrong: Module variables have been supported since early versions.
B
The variable `var.environment` is not defined in the root module's variables.tf
Why wrong: The root module uses `var.environment` in a module block, so it should be defined in root. But the error is about the module block, not the root's definition.
C
The variable `environment` is not defined in the child module's variables.tf
Correct! When referencing `var.environment` inside a module block, that variable must be declared in the child module.
D
The module source path is invalid
Why wrong: Invalid source would give a different error.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full NAT/PAT explanation →

A large enterprise uses Terraform Cloud with remote execution mode to manage infrastructure across multiple AWS accounts. Each environment (dev, staging, prod) has a separate workspace. The security team requires that all changes to production must be approved by a senior engineer before applying. Additionally, developers should be able to plan changes in production to preview the impact, but not apply them. The current setup uses the same Terraform Cloud team membership for all workspaces. When a developer runs a plan in production, the plan succeeds but they are unable to apply. However, the security team notices that the developer can accidentally apply if they quickly approve their own plan via the UI because the workspace is configured with 'Auto Apply' enabled. The security team wants to enforce the approval process without removing the developer's ability to plan. Which combination of changes should be made? (Select only one option.)

A
Keep 'Auto Apply' enabled but restrict the production workspace to only the infrastructure lead's Terraform Cloud account.
Why wrong: This would prevent developers from even planning, which is not desired.
B
Use run triggers to promote runs from dev to staging to production, and only the lead can promote to production.
Why wrong: Run triggers automate runs but do not enforce approval per plan.
C
Disable 'Auto Apply' on the production workspace and configure team permissions so that developers have 'plan' role and the infrastructure lead has 'write' role.
This enforces manual approval and restricts apply permissions.
D
Use VCS branch restrictions to only allow applies from the 'main' branch, and have developers plan from feature branches.
Why wrong: This only works if all runs come from VCS; developers might still apply via UI from a plan.

Full breakdown with real-world context →

These TF-003 practice questions are part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style TF-003 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related TF-003 topic practice pages

Understand IaC concepts practice questions

Understand Terraform basics practice questions

Understand Terraform's purpose practice questions

Use Terraform outside the core workflow practice questions

Interact with Terraform modules practice questions

Use the core Terraform workflow practice questions

Implement and maintain state practice questions

Read, generate and modify configuration practice questions

TF-003 fundamentals practice questions

TF-003 scenario practice questions

TF-003 troubleshooting practice questions

Practice scenarios

A team runs terraform plan and sees changes that are unexpected. Which TWO actions should they take to investigate before applying?

Refer to the exhibit. A team is troubleshooting a Terraform deployment. What information can be inferred from this state file?

Exhibit

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

A developer is troubleshooting a Terraform configuration that fails during `terraform plan` with the error: "Error: Invalid reference". The error points to a line that references `var.environment` in a module block. What is the most likely cause?