CCNA Terraform Advanced Workflow Questions — Page 2 of 2

MCQhard

An organization uses Terraform Cloud to manage infrastructure across multiple teams. They need to enforce that all workspaces use a specific version of Terraform and that no workspace can be deleted accidentally. Which approach meets these requirements without using Sentinel or Terraform Enterprise?

A.Include `required_version` in each workspace's root module and configure workspace locks in the UI.

B.Set `required_providers` with version constraints in a global Terraform file.

C.Use the Terraform Cloud API to write an OPA policy that enforces Terraform version and prevents workspace deletion.

D.Configure version constraints in the Terraform Cloud workspace settings and enable deletion protection.

AnswerD

Terraform Cloud workspaces offer explicit settings to define the exact Terraform CLI version used for all runs within that workspace, ensuring consistent execution environments regardless of the configuration's `required_version`. Additionally, a dedicated "Prevent deletion" safeguard can be enabled directly in the workspace settings. This critical feature protects against accidental or unauthorized removal of the workspace and its associated infrastructure state.

Why this answer

Terraform Cloud allows configuring the Terraform version at the workspace level, ensuring a specific version is used. The 'Prevent deletion' option in workspace settings protects against accidental deletion. While per-workspace, administrators can enforce these settings across workspaces via API or organization defaults.

Options A and B do not prevent deletion; Option C is incorrect because OPA is not natively integrated—Sentinel is the built-in policy engine but is excluded.

Exam trap

Candidates may think that built-in workspace settings are not enough to enforce global compliance, but administrators can enforce these settings via organization defaults or API scripts. OPA integration is often mistakenly assumed to be available natively.

How to eliminate wrong answers

Option A is wrong because `required_version` in a root module only enforces the Terraform version at plan/apply time, not across all workspaces globally, and workspace locks in the UI prevent concurrent operations but do not prevent accidental deletion. Option B is wrong because `required_providers` with version constraints controls provider versions, not the Terraform CLI version, and does not address workspace deletion prevention. Option D is wrong because Terraform Cloud workspace settings allow you to set a Terraform version per workspace, but there is no built-in 'deletion protection' toggle; deletion protection requires Sentinel or OPA policies via the API.

Practice this question →

MCQeasy

A DevOps team is using Terraform Cloud to manage infrastructure. They want to integrate Terraform into their CI/CD pipeline by triggering runs programmatically. Which approach should they use to invoke a Terraform run from an external system?

A.Use the Terraform Cloud API to trigger a run.

B.Set up a webhook from the VCS provider to trigger runs.

C.Configure a remote backend to automatically run apply.

D.Execute 'terraform apply -auto-approve' in the CI pipeline.

AnswerA

This is the correct method for programmatic interaction with Terraform Cloud. The Terraform Cloud API provides specific endpoints to create, manage, and trigger runs for designated workspaces, enabling seamless integration with external systems like CI/CD pipelines, custom scripts, or other automation tools. This approach allows for precise control over the run lifecycle, including dynamic variable overrides and explicit plan/apply actions, without requiring direct VCS commits.

Why this answer

The Terraform Cloud API provides a programmatic endpoint to trigger runs, allowing external CI/CD systems to initiate Terraform operations without manual intervention. This is the correct approach because it directly invokes a run with full control over variables, configuration versions, and apply strategies, aligning with the requirement to integrate Terraform into a CI/CD pipeline programmatically.

Exam trap

HashiCorp often tests the distinction between event-driven triggers (VCS webhooks) and programmatic API calls, where candidates mistakenly choose webhooks because they seem 'automated,' but the question explicitly requires programmatic invocation from an external system, not a VCS event.

How to eliminate wrong answers

Option B is wrong because setting up a webhook from the VCS provider triggers runs automatically on code changes, not programmatically from an external CI/CD system; it is event-driven, not API-driven. Option C is wrong because configuring a remote backend does not trigger runs—it only stores state remotely and enables remote execution, but the run must be initiated separately. Option D is wrong because executing 'terraform apply -auto-approve' in the CI pipeline is a local CLI command that bypasses Terraform Cloud's run management, state locking, and policy checks, and it does not integrate with Terraform Cloud's API or remote execution capabilities.

Practice this question →

MCQhard

An organization uses Terraform with remote state stored in S3 and DynamoDB for state locking. During a plan, they receive the error: 'Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed'. What is the most likely cause?

A.The state file in S3 is corrupted.

B.The DynamoDB table is not configured with a primary key named LockID.

C.The S3 bucket does not have versioning enabled.

D.Another Terraform process is currently running and holds the state lock.

AnswerD

DynamoDB state locking uses a conditional write on the lock item. ConditionalCheckFailedException means the lock item already exists and its condition was not met, which occurs when another Terraform process holds the lock and has not yet released it.

Why this answer

The error 'ConditionalCheckFailedException' occurs when DynamoDB's conditional put operation fails, which happens when a lock item already exists in the DynamoDB table. This indicates another Terraform process currently holds the state lock, preventing concurrent operations. Terraform uses DynamoDB's conditional writes to ensure only one process can acquire the lock at a time.

Exam trap

A common pitfall in Terraform exams is confusing S3 state file corruption with DynamoDB state lock contention. The ConditionalCheckFailedException specifically indicates that another process holds the lock, not that the state file is damaged.

How to eliminate wrong answers

Option A is wrong because a corrupted state file in S3 would cause a different error, such as 'Error loading state: JSON syntax error' or 'Failed to read state file', not a DynamoDB conditional check failure. Option B is wrong because if the DynamoDB table lacked a primary key named LockID, Terraform would fail during initialization with an error like 'Error configuring the backend' or 'DynamoDB table does not have a primary key attribute named LockID', not during a plan. Option C is wrong because S3 bucket versioning is not required for state locking; it is used for state file versioning and recovery, and its absence would not cause a DynamoDB conditional check failure.

Practice this question →

Multi-Selecteasy

Which TWO of the following are valid methods for importing existing infrastructure into Terraform management? (Choose two.)

Select 2 answers

A.Use terraform apply directly on existing resources

B.Use a third-party tool like Terraformer to generate configuration

C.Use terraform state push to manually add state entries

D.Write configuration for the resource and use terraform import

E.Use terraform import without any prior configuration

AnswersB, D

Using a third-party tool like Terraformer is a valid method because these tools automate the complex process of reverse-engineering existing cloud infrastructure into Terraform HCL configuration files. By generating the necessary `resource` blocks, they provide the essential configuration required for Terraform to manage existing resources. This significantly streamlines the adoption of Terraform for existing environments, often also facilitating the population of the Terraform state.

Why this answer

Option B is correct because Terraformer is a real third-party tool that reads existing cloud infrastructure via provider APIs and generates both Terraform configuration files and matching state, letting you bring resources under management without hand-writing everything. Option D is correct because the canonical native workflow is to write the resource block in your configuration first, then run terraform import <address> <resource-id> so Terraform maps the existing object into state and subsequent plans reconcile it. Option A is wrong because terraform apply only creates or updates resources described in configuration and state; it cannot discover or adopt pre-existing infrastructure.

Option C is wrong because terraform state push writes a state file you supply, which is a state-manipulation operation, not a supported import mechanism, and it does not generate configuration. Option E is wrong because terraform import requires the target resource address to already exist in configuration (in modern Terraform), so importing without prior configuration fails or leaves the resource unmanaged in config.

Exam trap

TF-004 often tests whether candidates know that terraform import requires pre-existing configuration and that terraform apply cannot adopt resources — the misconception is that apply or state push can import.

Practice this question →

MCQeasy

A developer wants to use Terraform in a CI pipeline where the pipeline runs on pull requests. They need to preview infrastructure changes without applying them. Which command should be used?

A.terraform plan

B.terraform validate

C.terraform init

D.terraform apply

AnswerA

The `terraform plan` command generates an execution plan, detailing the actions Terraform will perform to reach the desired state defined in the configuration files. It compares the current state (from the state file) with the desired state (from the configuration) and the actual infrastructure, providing a preview of all proposed infrastructure changes (creations, updates, or destructions) without actually making them. This makes it ideal for CI/CD pipelines to review changes before approval.

Why this answer

`terraform plan` creates an execution plan that shows what actions Terraform will take to change infrastructure to match the configuration, without actually applying any changes. This is the standard command for previewing infrastructure changes in a CI pipeline triggered by pull requests, enabling developers to review proposed modifications before merging.

Exam trap

HashiCorp often tests the distinction between validation and planning, so the trap here is that candidates confuse `terraform validate` (syntax check) with `terraform plan` (infrastructure preview), assuming validation alone is sufficient to preview changes.

How to eliminate wrong answers

Option B is wrong because `terraform validate` checks only the syntactic correctness and internal consistency of Terraform configuration files, not the actual state or planned changes against real infrastructure. Option C is wrong because `terraform init` initializes the working directory by downloading providers and modules, but does not generate any preview of infrastructure changes. Option D is wrong because `terraform apply` executes the planned changes and modifies real infrastructure, which is the opposite of a preview-only operation and should not be used in a pull request pipeline without prior approval.

Practice this question →