- A
The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.
Why wrong: A stale lock would produce a locking error, not AccessDenied on loading state.
- B
The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.
Why wrong: The problem statement says permissions have not been changed.
- C
The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.
Why wrong: There is no indication of a policy change; the lifecycle policy does not change permissions.
- D
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
Once an object is in Glacier, standard GetObject requests fail with AccessDenied unless the object is restored first.
Quick Answer
The correct answer is that the state file was transitioned to Amazon S3 Glacier by the lifecycle policy, causing the Access Denied error because Terraform cannot read objects stored in the Glacier storage class without first restoring them. This occurs because the S3 lifecycle policy moved the state file to Glacier after 30 days, and since the file was last modified 35 days ago, it is no longer directly accessible. On the HashiCorp Terraform Associate TF-003 exam, this scenario tests your understanding of remote state storage limitations and S3 lifecycle interactions—a common trap is assuming IAM or bucket policy changes are at fault when the real issue is storage class incompatibility. Remember that Terraform requires objects to be in Standard or Standard-IA for direct reads; Glacier and Glacier Deep Archive are not supported without restoration. Memory tip: “Glacier freezes your state—thaw it with restore-object before you can update.”
TF-003 Implement and maintain state Practice Question
This TF-003 practice question tests your understanding of implement and maintain state. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a DevOps engineer for a company that uses Terraform to manage infrastructure across multiple AWS accounts (production, staging, development). Each account has its own Terraform configuration and remote state stored in an S3 bucket with DynamoDB locking. Recently, the production deployment pipeline failed with the error: 'Error: Error loading state: AccessDenied: Access Denied'. The pipeline runs under an IAM role that has been working for months. The S3 bucket policy and IAM role permissions have not been changed. However, the team did recently enable S3 bucket versioning and added a lifecycle policy to transition objects to Glacier after 30 days. The state file was last modified 35 days ago. What is the most likely cause of the error?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"most likely"Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
D is correct because the S3 lifecycle policy transitions objects to the Glacier storage class after 30 days. The state file was last modified 35 days ago, so it has been moved to Glacier. Terraform cannot read objects in the Glacier storage class directly; it requires a restoration (e.g., using `aws s3api restore-object`) before the state can be accessed, resulting in the 'AccessDenied' error.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.
Why it's wrong here
A stale lock would produce a locking error, not AccessDenied on loading state.
- ✗
The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.
Why it's wrong here
The problem statement says permissions have not been changed.
- ✗
The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.
Why it's wrong here
There is no indication of a policy change; the lifecycle policy does not change permissions.
- ✓
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
Why this is correct
Once an object is in Glacier, standard GetObject requests fail with AccessDenied unless the object is restored first.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
HashiCorp often tests the distinction between 'AccessDenied' errors caused by storage class transitions (e.g., Glacier) versus permission-based denials, and the trap here is that candidates may assume the error is due to a policy change or stale lock, ignoring the lifecycle policy's effect on object accessibility.
Detailed technical explanation
How to think about this question
When an S3 lifecycle policy transitions an object to the Glacier storage class, the object's storage class changes, and direct read operations (like `GetObject`) fail with an 'AccessDenied' error because Glacier requires a restore operation (using `RestoreObject`) before the object can be read. Terraform's state loading mechanism uses `GetObject` under the hood, so it cannot retrieve the state file until it is restored to a readable storage class (e.g., Standard). This is a common pitfall when enabling lifecycle policies without considering the impact on frequently accessed objects like Terraform state files.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the TF-003 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Implement and maintain state — study guide chapter
Learn the concepts, then practise the questions
- →
Implement and maintain state practice questions
Targeted practice on this topic area only
- →
All TF-003 questions
519 questions across all exam domains
- →
HashiCorp Terraform Associate TF-003 study guide
Full concept coverage aligned to exam objectives
- →
TF-003 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related TF-003 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Understand IaC concepts practice questions
Practise TF-003 questions linked to Understand IaC concepts.
Understand Terraform basics practice questions
Practise TF-003 questions linked to Understand Terraform basics.
Understand Terraform's purpose practice questions
Practise TF-003 questions linked to Understand Terraform's purpose.
Use Terraform outside the core workflow practice questions
Practise TF-003 questions linked to Use Terraform outside the core workflow.
Interact with Terraform modules practice questions
Practise TF-003 questions linked to Interact with Terraform modules.
Use the core Terraform workflow practice questions
Practise TF-003 questions linked to Use the core Terraform workflow.
Implement and maintain state practice questions
Practise TF-003 questions linked to Implement and maintain state.
Read, generate and modify configuration practice questions
Practise TF-003 questions linked to Read, generate and modify configuration.
TF-003 fundamentals practice questions
Practise TF-003 questions linked to TF-003 fundamentals.
TF-003 scenario practice questions
Practise TF-003 questions linked to TF-003 scenario.
TF-003 troubleshooting practice questions
Practise TF-003 questions linked to TF-003 troubleshooting.
Practice this exam
Start a free TF-003 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this TF-003 question test?
Implement and maintain state — This question tests Implement and maintain state — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration. — D is correct because the S3 lifecycle policy transitions objects to the Glacier storage class after 30 days. The state file was last modified 35 days ago, so it has been moved to Glacier. Terraform cannot read objects in the Glacier storage class directly; it requires a restoration (e.g., using `aws s3api restore-object`) before the state can be accessed, resulting in the 'AccessDenied' error.
What should I do if I get this TF-003 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This TF-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.