How should I use these Understand IaC concepts practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Understand IaC concepts questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Understand IaC concepts domain.

TF-003 · topic practice

Understand IaC concepts practice questions

Practise HashiCorp Terraform Associate TF-003 Understand IaC concepts practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Understand IaC concepts

Practice 10 questions Browse domain →

What the exam tests

What to know about Understand IaC concepts

Understand IaC concepts questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Understand IaC concepts exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Understand IaC concepts questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Understand IaC concepts explanation →

A team is adopting Terraform to manage infrastructure. One requirement is that all configuration changes must be reviewed and approved before being applied. The team wants to ensure that the Terraform state file reflects the actual deployed infrastructure at all times. Which practice should they implement to meet these requirements?

Trap 1: Store state locally and use a manual approval process outside of…

Manual approval outside Terraform is not integrated and local state is not shared.

Trap 2: Store state locally and use a shared network drive for team access.

Local state on a network drive can cause corruption and lacks locking.

Trap 3: Have each team member run terraform apply from their local machine…

Local apply bypasses review and risks inconsistent state.

Study all Understand IaC concepts common traps →

A
Store state locally and use a manual approval process outside of Terraform.
Why wrong: Manual approval outside Terraform is not integrated and local state is not shared.
B
Store state remotely and use a version control system with pull requests to review changes before applying.
Remote state enables team collaboration and VCS with PRs enforces review.
C
Store state locally and use a shared network drive for team access.
Why wrong: Local state on a network drive can cause corruption and lacks locking.
D
Have each team member run terraform apply from their local machine after informal discussion.
Why wrong: Local apply bypasses review and risks inconsistent state.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Understand IaC concepts explanation →

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

Trap 1: Use a separate Git branch for each environment, each with its own…

Branch-per-environment can lead to drift and merge conflicts.

Trap 2: Write a single Terraform configuration that uses count and…

This leads to a monolithic configuration that is hard to read and test.

Trap 3: Use Terraform workspaces with a single configuration and define all…

One .tfvars file cannot hold multiple environment-specific values easily.

Study all Understand IaC concepts common traps →

A
Use a separate Git branch for each environment, each with its own Terraform configuration.
Why wrong: Branch-per-environment can lead to drift and merge conflicts.
B
Write a single Terraform configuration that uses count and conditional expressions to create resources based on environment variable.
Why wrong: This leads to a monolithic configuration that is hard to read and test.
C
Use Terraform workspaces with a single configuration and define all variable values in one .tfvars file.
Why wrong: One .tfvars file cannot hold multiple environment-specific values easily.
D
Organize the repository with a shared modules directory and separate subdirectories for each environment that call the same modules with environment-specific .tfvars files.
This structure maximizes reuse and keeps environment-specific variables separate.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Understand IaC concepts explanation →

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Trap 1: The instance type chosen does not support public IP addresses.

All instance types can have public IPs if configured.

Trap 2: The terraform init command failed and the apply did not actually…

If init fails, apply would not succeed.

Trap 3: The subnet is configured as private and does not have a route to…

This could be a reason, but the most likely missing piece is the security group rule.

Study all Understand IaC concepts common traps →

A
The instance type chosen does not support public IP addresses.
Why wrong: All instance types can have public IPs if configured.
B
The terraform init command failed and the apply did not actually create resources.
Why wrong: If init fails, apply would not succeed.
C
The subnet is configured as private and does not have a route to the internet.
Why wrong: This could be a reason, but the most likely missing piece is the security group rule.
D
The security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.
Security group rules control inbound traffic; without allowing HTTP/HTTPS, the server is not accessible.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Understand IaC concepts explanation →

A company uses Terraform to manage infrastructure on AWS. They have a configuration that creates an S3 bucket and a DynamoDB table for state locking. The team notices that sometimes when two members run terraform apply simultaneously, they get a state locking error. However, they want to allow concurrent operations on different workspaces. What is the best approach?

Trap 1: Remove the DynamoDB table and use local state files to avoid…

Local state removes locking and can cause corruption with concurrent operations.

Trap 2: Configure all team members to use the same workspace so that only…

This reduces parallelism and defeats workspace isolation.

Trap 3: Keep the current setup because the error is harmless and users can…

The error is expected but does not prevent concurrent operations; however, this is not the best approach as it causes friction.

Study all Understand IaC concepts common traps →

A
Remove the DynamoDB table and use local state files to avoid locking issues.
Why wrong: Local state removes locking and can cause corruption with concurrent operations.
B
Configure all team members to use the same workspace so that only one person can apply at a time.
Why wrong: This reduces parallelism and defeats workspace isolation.
C
Keep the current setup because the error is harmless and users can retry.
Why wrong: The error is expected but does not prevent concurrent operations; however, this is not the best approach as it causes friction.
D
Use separate state files per workspace and ensure each workspace has its own lock entry in DynamoDB; the current setup already supports this.
Workspaces use separate state files and DynamoDB locks per state file, allowing concurrent operations on different workspaces.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Understand IaC concepts explanation →

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Trap 1: The same code can be used for any cloud provider without…

Terraform providers are provider-specific; code needs changes.

Trap 2: No learning curve is required; existing knowledge of manual…

IaC introduces new tools and languages that require learning.

Study all Understand IaC concepts common traps →

A
Automated testing and deployment pipelines can be integrated.
IaC can be tested and deployed in CI/CD.
B
Infrastructure can be replicated consistently across environments.
Same configuration can be applied to multiple environments with different variables.
C
The same code can be used for any cloud provider without modification.
Why wrong: Terraform providers are provider-specific; code needs changes.
D
Infrastructure can be version controlled and changes tracked.
Configuration files are text, easily versioned.
E
No learning curve is required; existing knowledge of manual processes applies directly.
Why wrong: IaC introduces new tools and languages that require learning.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Understand IaC concepts explanation →

You are a DevOps engineer at a growing startup. The infrastructure currently consists of a single AWS EC2 instance running a web application, manually configured. The company plans to scale to multiple instances and environments (development, staging, production). They want to adopt Infrastructure as Code using Terraform. The team has limited experience with Terraform and wants to start small, then gradually adopt more advanced features. The current manual infrastructure must be imported into Terraform. The team also wants to ensure that code changes are reviewed via pull requests before being applied. Which of the following is the best course of action to meet these requirements?

Trap 1: Install Terraform on the existing instance, run terraform init and…

Local state is not collaborative and sharing via folder can cause corruption.

Trap 2: Write Terraform configuration from scratch to match the existing…

Destroying production resources without importing causes downtime and is risky.

Trap 3: Create separate Git branches for each environment (dev, staging,…

Separate branches without proper merging leads to configuration drift and no single source of truth.

Study all Understand IaC concepts common traps →

A
Install Terraform on the existing instance, run terraform init and apply directly to manage it, and store state locally. Have team members share the state file via a shared folder.
Why wrong: Local state is not collaborative and sharing via folder can cause corruption.
B
Write Terraform configuration from scratch to match the existing instance, but do not import; instead, destroy the old instance and recreate it with Terraform.
Why wrong: Destroying production resources without importing causes downtime and is risky.
C
Create separate Git branches for each environment (dev, staging, prod) and have each team member work independently on their branch, merging occasionally.
Why wrong: Separate branches without proper merging leads to configuration drift and no single source of truth.
D
Create a Git repository with a main branch. Write a minimal Terraform configuration that describes the existing EC2 instance. Use terraform import to bring the instance under Terraform management. Store the state file remotely in S3 with DynamoDB locking. Set up a CI pipeline that runs terraform plan on pull requests and requires approval before merging.
This approach imports existing infrastructure, uses remote state for team access, and enforces code review through PRs.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Understand IaC concepts explanation →

Which TWO statements about Infrastructure as Code (IaC) are correct?

Trap 1: IaC is only applicable to cloud-based infrastructure.

IaC can manage on-premises and hybrid environments.

Trap 2: IaC eliminates configuration drift entirely.

IaC helps manage drift but does not eliminate it.

Trap 3: IaC tools require manual execution of scripts.

IaC can be automated via CI/CD.

Study all Understand IaC concepts common traps →

A
IaC is only applicable to cloud-based infrastructure.
Why wrong: IaC can manage on-premises and hybrid environments.
B
IaC eliminates configuration drift entirely.
Why wrong: IaC helps manage drift but does not eliminate it.
C
IaC enables automated provisioning and management of infrastructure.
Automation is a core benefit of IaC.
D
IaC allows the same configuration to be applied multiple times with the same result.
Idempotency is a key property of IaC.
E
IaC tools require manual execution of scripts.
Why wrong: IaC can be automated via CI/CD.

Full breakdown with real-world context →

Question 8hardmultiple choice

Read the full Understand IaC concepts explanation →

A developer runs terraform apply with the configuration above. The resource is created successfully, but the provisioner fails because the public_ip attribute is not yet known at plan time. What is the most likely cause?

Exhibit

Refer to the exhibit.

```hcl
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"

  provisioner "local-exec" {
    command = "echo ${aws_instance.web.public_ip} > ip.txt"
  }
}
```

Trap 1: The AMI ID is incorrect.

The AMI ID is valid for Amazon Linux 2.

Trap 2: The local-exec provisioner requires network access to the instance.

local-exec runs on the machine running Terraform, not on the instance.

Trap 3: The provisioner runs before the state file is written.

Provisioners run after resource creation, not before state write.

Study all Understand IaC concepts common traps →

A
The AMI ID is incorrect.
Why wrong: The AMI ID is valid for Amazon Linux 2.
B
The local-exec provisioner requires network access to the instance.
Why wrong: local-exec runs on the machine running Terraform, not on the instance.
C
The provisioner references a computed attribute that is not known until after resource creation.
The public_ip is not known until after the instance is created and assigned an IP.
D
The provisioner runs before the state file is written.
Why wrong: Provisioners run after resource creation, not before state write.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Understand IaC concepts explanation →

You are a platform engineer at a growing startup. The company currently manages infrastructure manually by SSH-ing into servers to install packages and update configurations. As the team grows, this approach has led to frequent configuration drift, inconsistent environments, and manual errors. Deploying a new environment takes several days and requires detailed runbooks. The CTO has asked you to propose a solution that improves consistency, reduces deployment time, and enables version control of infrastructure. You are evaluating Infrastructure as Code (IaC) tools like Terraform. Which course of action best addresses the CTO's requirements?

Trap 1: Improve SSH key management and use configuration management tools…

Configuration management tools can help but still require manual triggers and do not enforce version control as effectively as IaC.

Trap 2: Migrate all applications to containers and use Kubernetes for…

Containerization does not manage the underlying infrastructure provisioning.

Trap 3: Create more detailed runbooks and require peer review for all…

Runbooks still rely on manual steps and do not enforce consistency or speed.

Study all Understand IaC concepts common traps →

A
Improve SSH key management and use configuration management tools like Ansible to apply changes.
Why wrong: Configuration management tools can help but still require manual triggers and do not enforce version control as effectively as IaC.
B
Migrate all applications to containers and use Kubernetes for orchestration.
Why wrong: Containerization does not manage the underlying infrastructure provisioning.
C
Adopt Terraform to define all infrastructure as code, store configurations in a Git repository, and use a CI/CD pipeline to apply changes automatically.
Declarative IaC with automation addresses all requirements.
D
Create more detailed runbooks and require peer review for all manual changes.
Why wrong: Runbooks still rely on manual steps and do not enforce consistency or speed.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Understand IaC concepts explanation →

Which three statements correctly describe concepts of Infrastructure as Code (IaC) as implemented by Terraform? (Choose three.)

Question 11mediummulti select

Read the full Understand IaC concepts explanation →

Which of the following are key benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management? (Choose four.)

Question 12mediumdrag order

Read the full Understand IaC concepts explanation →

Drag and drop the steps to initialize a Terraform working directory in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 13mediumdrag order

Read the full Understand IaC concepts explanation →

Drag and drop the steps to upgrade Terraform providers in a configuration in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediummatching

Read the full Understand IaC concepts explanation →

Match each Terraform command to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Initialize a working directory with provider plugins

Create an execution plan

Execute the actions proposed in a plan

Destroy previously-created infrastructure

Check configuration for syntax and internal consistency

Question 15mediummatching

Read the full Understand IaC concepts explanation →

Match each Terraform cloud/enterprise feature to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Organize state and runs for different environments

Integrate third-party policy or compliance checks

Policy as code framework for governance

Store state securely in Terraform Cloud

Trigger runs automatically from version control

Question 16easymultiple choice

Read the full Understand IaC concepts explanation →

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

Trap 1: Dynamic provider credentials

Dynamic credentials are about security, not consistency.

Trap 2: Modularity

Modularity helps reuse but doesn't enforce repeatability.

Trap 3: Version control

Version control tracks changes but does not ensure idempotent applies.

Study all Understand IaC concepts common traps →

A
Dynamic provider credentials
Why wrong: Dynamic credentials are about security, not consistency.
B
Modularity
Why wrong: Modularity helps reuse but doesn't enforce repeatability.
C
Version control
Why wrong: Version control tracks changes but does not ensure idempotent applies.
D
Idempotency
Idempotency guarantees repeated runs produce the same outcome.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Ansible explanation →

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

Trap 1: Client-server vs agentless

This is an architectural difference.

Trap 2: Immutable vs mutable

This relates to update behavior, not language style.

Trap 3: Push vs pull

This refers to how changes are delivered.

Study all Understand IaC concepts common traps →

A
Declarative vs imperative
Terraform declares desired state; Ansible defines imperative steps.
B
Client-server vs agentless
Why wrong: This is an architectural difference.
C
Immutable vs mutable
Why wrong: This relates to update behavior, not language style.
D
Push vs pull
Why wrong: This refers to how changes are delivered.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Understand IaC concepts explanation →

A team of five engineers uses Terraform with a remote backend in AWS S3 with DynamoDB state locking. One engineer runs 'terraform apply' but it hangs at 'Acquiring state lock'. What is the most likely cause?

Trap 1: The S3 bucket policy denies the request.

This would result in an access denied error.

Trap 2: A recent 'terraform init' was run without the proper backend…

This would prevent backend initialization entirely.

Trap 3: The DynamoDB table is in a different AWS region.

This would cause a region mismatch error.

Study all Understand IaC concepts common traps →

A
Another engineer has an active lock from a previous run that was not released.
A held lock causes 'terraform apply' to wait until the lock is released.
B
The S3 bucket policy denies the request.
Why wrong: This would result in an access denied error.
C
A recent 'terraform init' was run without the proper backend configuration.
Why wrong: This would prevent backend initialization entirely.
D
The DynamoDB table is in a different AWS region.
Why wrong: This would cause a region mismatch error.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Understand IaC concepts explanation →

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

Trap 1: The backend configuration changed after the last apply.

Backend changes require re-initialization.

Trap 2: The state file was manually edited in S3.

Manual editing typically causes corruption, not absence.

Trap 3: Another user ran 'terraform apply' concurrently.

Concurrent runs would cause a lock, not a missing state.

Study all Understand IaC concepts common traps →

A
The backend configuration changed after the last apply.
Why wrong: Backend changes require re-initialization.
B
The state file was manually edited in S3.
Why wrong: Manual editing typically causes corruption, not absence.
C
Another user ran 'terraform apply' concurrently.
Why wrong: Concurrent runs would cause a lock, not a missing state.
D
The workspace does not exist.
If the workspace is new or deleted, no state file exists.

Full breakdown with real-world context →

Question 20mediummultiple choice

Review the full subnetting walkthrough →

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Trap 1: Store the module in a shared S3 bucket and reference it with the…

S3 storage works but lacks version management; registry is preferred.

Trap 2: Use a data source to fetch the module's output from another state.

Data sources are for outputs, not module reuse.

Trap 3: Copy the module code into each root configuration's directory.

Duplication leads to maintenance overhead.

Study all Understand IaC concepts common traps →

A
Store the module in a shared S3 bucket and reference it with the module source.
Why wrong: S3 storage works but lacks version management; registry is preferred.
B
Use a module registry and specify a version constraint.
Registries provide versioning and easy sharing.
C
Use a data source to fetch the module's output from another state.
Why wrong: Data sources are for outputs, not module reuse.
D
Copy the module code into each root configuration's directory.
Why wrong: Duplication leads to maintenance overhead.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Understand IaC concepts sessions

Start a Understand IaC concepts only practice session

Every question in these sessions is drawn from the Understand IaC concepts domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Understand IaC concepts questions →Mixed TF-003 session

Frequently asked questions

What does the TF-003 exam test about Understand IaC concepts?: Understand IaC concepts questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Understand IaC concepts questions in a focused session?: Yes — the session launcher on this page draws every question from the Understand IaC concepts domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other TF-003 topics?: Use the topic links above to move to related areas, or go back to the TF-003 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the TF-003 exam covers. They are not copied from any real exam or dump site.

Understand IaC concepts only

10 questions 20 questions 30 questions 50 questions

Mixed TF-003 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All TF-003 questions Understand IaC concepts domain overview TF-003 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Understand IaC concepts practice questions

What to know about Understand IaC concepts

Common Understand IaC concepts exam traps

Understand IaC concepts questions

An organization manages multiple environments (dev, staging, prod) using Terraform. They want to minimize code duplication while allowing environment-specific variable values. Which approach best achieves this goal?

A junior administrator wants to practice Terraform by deploying a single web server in AWS. They write a configuration file and run terraform init and terraform apply. The deployment succeeds but they notice the web server is not accessible from the internet. What is the most likely reason?

Which THREE of the following are benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management?

Which TWO statements about Infrastructure as Code (IaC) are correct?

A developer runs terraform apply with the configuration above. The resource is created successfully, but the provisioner fails because the public_ip attribute is not yet known at plan time. What is the most likely cause?

Exhibit

Which three statements correctly describe concepts of Infrastructure as Code (IaC) as implemented by Terraform? (Choose three.)

Which of the following are key benefits of using Infrastructure as Code (IaC) compared to manual infrastructure management? (Choose four.)

Drag and drop the steps to initialize a Terraform working directory in the correct order.

Drag and drop the steps to upgrade Terraform providers in a configuration in the correct order.

Match each Terraform command to its primary function.

Match each Terraform cloud/enterprise feature to its purpose.

An organization wants to ensure that running the same Terraform configuration multiple times produces the same result without unintended changes. Which IaC concept is most critical for this goal?

A team is evaluating Terraform and Ansible for infrastructure provisioning. They note that Terraform describes the desired end state, while Ansible defines steps to reach that state. This difference is best described as:

A team of five engineers uses Terraform with a remote backend in AWS S3 with DynamoDB state locking. One engineer runs 'terraform apply' but it hangs at 'Acquiring state lock'. What is the most likely cause?

A user runs 'terraform plan' and gets an error: 'No state file was found!'. Which is the most likely cause?

A company has a Terraform module that creates an AWS VPC with subnets. They want to reuse this module across multiple AWS accounts. What is the best practice for referencing the module from different root configurations?

Track your progress over time

Start a Understand IaC concepts only practice session

Related TF-003 topic practice pages