How should I use these Implement and maintain state practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Implement and maintain state questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Implement and maintain state domain.

TF-003 · topic practice

Implement and maintain state practice questions

Practise HashiCorp Terraform Associate TF-003 Implement and maintain state practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Implement and maintain state

Practice 10 questions Browse domain →

What the exam tests

What to know about Implement and maintain state

Implement and maintain state questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Implement and maintain state exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Implement and maintain state questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Implement and maintain state explanation →

A team is using a remote backend in Terraform Cloud. After a failed apply, the state file is locked. The team lead wants to unlock the state immediately. What should be done?

Trap 1: Delete the state file from the backend and reinitialize

Deleting the state file is destructive and can cause data loss.

Trap 2: Manually edit the state file to remove the lock

Editing the state file directly is risky and not recommended.

Trap 3: Run terraform unlock

There is no terraform unlock command; the correct command is terraform force-unlock.

Study all Implement and maintain state common traps →

A
Delete the state file from the backend and reinitialize
Why wrong: Deleting the state file is destructive and can cause data loss.
B
Run terraform force-unlock with the lock ID
The terraform force-unlock command with the lock ID manually releases the lock.
C
Manually edit the state file to remove the lock
Why wrong: Editing the state file directly is risky and not recommended.
D
Run terraform unlock
Why wrong: There is no terraform unlock command; the correct command is terraform force-unlock.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Implement and maintain state explanation →

An organization uses Terraform with AWS S3 backend and DynamoDB for state locking. During a plan, you receive an error: 'Error acquiring the state lock'. The lock information in DynamoDB shows a lock from a previous session that crashed. What is the most appropriate next step?

Trap 1: Run terraform unlock

There is no terraform unlock command.

Trap 2: Wait for the lock to expire automatically

Terraform locks do not expire automatically; they must be released manually.

Trap 3: Delete the lock item from DynamoDB table directly

While possible, it bypasses Terraform's safety checks and is not the recommended approach.

Study all Implement and maintain state common traps →

A
Run terraform unlock
Why wrong: There is no terraform unlock command.
B
Run terraform force-unlock with the lock ID
This command releases the lock from the previous session.
C
Wait for the lock to expire automatically
Why wrong: Terraform locks do not expire automatically; they must be released manually.
D
Delete the lock item from DynamoDB table directly
Why wrong: While possible, it bypasses Terraform's safety checks and is not the recommended approach.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Implement and maintain state explanation →

A developer is working on a Terraform configuration that manages a single resource. They want to import an existing AWS EC2 instance into state. Which command should they use?

Trap 1: terraform apply

terraform apply provisions resources, does not import.

Trap 2: terraform refresh

terraform refresh updates state with real-world data but does not import new resources.

Trap 3: terraform state mv

terraform state mv moves items within state, does not import.

Study all Implement and maintain state common traps →

A
terraform apply
Why wrong: terraform apply provisions resources, does not import.
B
terraform refresh
Why wrong: terraform refresh updates state with real-world data but does not import new resources.
C
terraform import
terraform import is the command to import existing resources into state.
D
terraform state mv
Why wrong: terraform state mv moves items within state, does not import.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Implement and maintain state explanation →

A team uses Terraform Cloud workspaces to manage multiple environments. They notice that the state file for the production workspace is stored in a different backend than the development workspace. Which Terraform feature allows different workspaces to use different backends?

Trap 1: Using the -backend-config flag

While -backend-config can override backend config, it's not workspace-specific unless combined with workspace-specific variables.

Trap 2: Using the backend block with a workspace key

Backend blocks do not have a workspace key; workspaces are handled separately.

Trap 3: Using a remote backend type

Remote backends support workspaces but do not automatically use different backends per workspace.

Study all Implement and maintain state common traps →

A
Using the -backend-config flag
Why wrong: While -backend-config can override backend config, it's not workspace-specific unless combined with workspace-specific variables.
B
Using the backend block with a workspace key
Why wrong: Backend blocks do not have a workspace key; workspaces are handled separately.
C
Using partial configuration with a backend block that has dynamic workspace references
Partial configuration allows injecting workspace-specific values like bucket keys.
D
Using a remote backend type
Why wrong: Remote backends support workspaces but do not automatically use different backends per workspace.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Implement and maintain state explanation →

After running terraform apply, you see the error: 'Error: Error loading state: state snapshot was created by Terraform v0.12.0, but this is Terraform v1.2.0'. What should you do to resolve this?

Trap 1: Run terraform state upgrade

There is no terraform state upgrade command.

Trap 2: Delete the state file and reimport resources

This is destructive and unnecessary.

Trap 3: Downgrade Terraform to v0.12.0

Downgrading is not a good practice and may cause compatibility issues with providers.

Study all Implement and maintain state common traps →

A
Run terraform state upgrade
Why wrong: There is no terraform state upgrade command.
B
Run terraform apply with no changes to upgrade the state format
Running terraform apply will upgrade the state to the current version.
C
Delete the state file and reimport resources
Why wrong: This is destructive and unnecessary.
D
Downgrade Terraform to v0.12.0
Why wrong: Downgrading is not a good practice and may cause compatibility issues with providers.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full Implement and maintain state explanation →

A user wants to remove a specific resource from Terraform state without destroying the actual infrastructure. Which command should they use?

Trap 1: terraform taint resource

Taint marks resource for recreation, not removal from state.

Trap 2: terraform state mv resource

This moves the resource to a new address, not removal.

Trap 3: terraform destroy -target=resource

Destroy destroys the resource, not just state removal.

Study all Implement and maintain state common traps →

A
terraform state rm resource
This removes the resource from state without affecting the real infrastructure.
B
terraform taint resource
Why wrong: Taint marks resource for recreation, not removal from state.
C
terraform state mv resource
Why wrong: This moves the resource to a new address, not removal.
D
terraform destroy -target=resource
Why wrong: Destroy destroys the resource, not just state removal.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Implement and maintain state explanation →

A company uses Terraform to manage infrastructure across multiple AWS accounts. They want to use a single S3 bucket to store state files for all accounts, but ensure that state files are isolated per account. What is the best approach?

Trap 1: Use Terraform workspaces with a single state file

Workspaces still store state in the same backend, but separate state files; however, they can be used with different keys.

Trap 2: Store all state in the same S3 key

Using the same key would overwrite state, causing data loss.

Trap 3: Use a DynamoDB table with different lock IDs per account

Locking doesn't isolate state; it only prevents concurrent access.

Study all Implement and maintain state common traps →

A
Use Terraform workspaces with a single state file
Why wrong: Workspaces still store state in the same backend, but separate state files; however, they can be used with different keys.
B
Use separate state files with unique S3 key prefixes per account
Unique key prefixes ensure each account has its own state file.
C
Store all state in the same S3 key
Why wrong: Using the same key would overwrite state, causing data loss.
D
Use a DynamoDB table with different lock IDs per account
Why wrong: Locking doesn't isolate state; it only prevents concurrent access.

Full breakdown with real-world context →

Question 8mediummulti select

Read the full Implement and maintain state explanation →

Which TWO of the following are valid methods to share data between Terraform configurations?

Trap 1: Use output variables across configurations

Outputs are not accessible across configurations without remote state.

Trap 2: Use modules to share state

Modules share code, not state.

Trap 3: Use depends_on to pass values

depends_on only affects ordering, not data passing.

Study all Implement and maintain state common traps →

A
Use output variables across configurations
Why wrong: Outputs are not accessible across configurations without remote state.
B
Use modules to share state
Why wrong: Modules share code, not state.
C
Use depends_on to pass values
Why wrong: depends_on only affects ordering, not data passing.
D
Store shared data in a common backend and read it via data sources
Same as A, but a broader description.
E
Use terraform_remote_state data source
Allows reading outputs from another state file.

Full breakdown with real-world context →

Question 9hardmulti select

Read the full Implement and maintain state explanation →

Which THREE of the following are best practices for managing Terraform state?

Trap 1: Edit state files directly to fix drift

Should use terraform commands to modify state.

Trap 2: Store state files locally to avoid network latency

Local state is not recommended for team environments due to lack of locking and sharing.

Study all Implement and maintain state common traps →

A
Edit state files directly to fix drift
Why wrong: Should use terraform commands to modify state.
B
Use remote backends to store state files
Remote backends enable sharing and locking.
C
Enable versioning on the state storage backend
Provides history and recovery options.
D
Store state files locally to avoid network latency
Why wrong: Local state is not recommended for team environments due to lack of locking and sharing.
E
Use state locking to prevent concurrent modifications
Essential for team collaboration.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Implement and maintain state explanation →

Which TWO of the following are true about Terraform workspaces?

Trap 1: Workspaces can be used to manage different provider configurations

Provider configurations are not workspace-specific.

Trap 2: All workspaces share the same state file

They have separate state files.

Trap 3: The default workspace can be deleted

The default workspace cannot be deleted.

Study all Implement and maintain state common traps →

A
Workspaces can be used to manage different provider configurations
Why wrong: Provider configurations are not workspace-specific.
B
All workspaces share the same state file
Why wrong: They have separate state files.
C
The default workspace can be deleted
Why wrong: The default workspace cannot be deleted.
D
The default workspace is named 'default'
The default workspace is indeed named 'default'.
E
Each workspace has its own state file
Workspaces isolate state.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Implement and maintain state explanation →

You are a DevOps engineer at a company that uses Terraform to manage infrastructure in AWS. The team recently adopted Terraform Cloud for remote state management and collaboration. They have a single workspace named 'production' that manages all production resources. Currently, the state file is stored in Terraform Cloud's default backend. The team wants to implement a disaster recovery strategy where they can restore the state file if Terraform Cloud experiences an outage. They also want to ensure that state file backups are taken automatically before every apply. Which approach should they recommend?

Trap 1: Manually download the state file from Terraform Cloud UI after each…

Manual process is error-prone and not automated.

Trap 2: Enable S3 replication on Terraform Cloud's internal state storage

You cannot configure replication on Terraform Cloud's internal storage.

Trap 3: Switch to an S3 backend with DynamoDB locking and configure…

This defeats the purpose of remote state and collaboration.

Study all Implement and maintain state common traps →

A
Manually download the state file from Terraform Cloud UI after each apply
Why wrong: Manual process is error-prone and not automated.
B
Enable S3 replication on Terraform Cloud's internal state storage
Why wrong: You cannot configure replication on Terraform Cloud's internal storage.
C
Switch to an S3 backend with DynamoDB locking and configure Terraform Cloud to run remotely but store state locally
Why wrong: This defeats the purpose of remote state and collaboration.
D
Use Terraform Cloud's API to download the state file before each apply and store it in a secure S3 bucket with versioning enabled
This automates backups before each apply and provides a separate location for recovery.

Full breakdown with real-world context →

Question 12mediummultiple choice

Read the full Implement and maintain state explanation →

A team manages infrastructure with Terraform and uses a remote backend in an S3 bucket. After a recent state migration, a developer runs 'terraform plan' and gets an error: 'Error: Error loading state: NoSuchKey: The specified key does not exist.' The developer confirms that the state file exists in the bucket. What is the most likely cause?

Trap 1: Terraform state locking is enabled but the lock was not released.

State locking issues produce different errors, such as 'Error acquiring state lock'.

Trap 2: The S3 bucket policy does not allow reading the state file.

A bucket policy issue would result in an AccessDenied error, not NoSuchKey.

Trap 3: S3 bucket versioning is enabled, and the state file is a…

By default, Terraform reads the latest version; non-current versions are not accessed unless specifically requested.

Study all Implement and maintain state common traps →

A
The backend configuration in the Terraform code does not match the actual state file path.
If the backend key or workspace changed, Terraform looks for a different key, causing NoSuchKey.
B
Terraform state locking is enabled but the lock was not released.
Why wrong: State locking issues produce different errors, such as 'Error acquiring state lock'.
C
The S3 bucket policy does not allow reading the state file.
Why wrong: A bucket policy issue would result in an AccessDenied error, not NoSuchKey.
D
S3 bucket versioning is enabled, and the state file is a non-current version.
Why wrong: By default, Terraform reads the latest version; non-current versions are not accessed unless specifically requested.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Implement and maintain state explanation →

An organization uses Terraform with the AzureRM backend. The team recently split a large configuration into multiple smaller configurations, each with its own state file. They want to share outputs from one configuration (networking) as inputs to another (compute). Which approach should they use to reference the networking state from the compute configuration without duplicating data?

Trap 1: Define output values in the networking configuration and they will…

Output values are only visible in the same configuration; they are not automatically shared across configurations.

Trap 2: Run 'terraform output' on the networking state and save the values…

The terraform_remote_state data source reads directly from the state backend; there is no need to manually export to a file.

Trap 3: Hardcode the subnet IDs from the networking configuration into the…

Hardcoding creates maintenance issues and duplicates data; it is not a best practice.

Study all Implement and maintain state common traps →

A
Define output values in the networking configuration and they will be automatically available in the compute configuration.
Why wrong: Output values are only visible in the same configuration; they are not automatically shared across configurations.
B
Run 'terraform output' on the networking state and save the values to a JSON file, then use 'terraform_remote_state' to read them.
Why wrong: The terraform_remote_state data source reads directly from the state backend; there is no need to manually export to a file.
C
Use a 'data' 'terraform_remote_state' block in the compute configuration to read the networking state.
This data source retrieves the outputs from the specified remote state, enabling cross-configuration references.
D
Hardcode the subnet IDs from the networking configuration into the compute configuration.
Why wrong: Hardcoding creates maintenance issues and duplicates data; it is not a best practice.

Full breakdown with real-world context →

Question 14easymulti select

Read the full Implement and maintain state explanation →

Which TWO of the following are valid reasons to use Terraform state?

Trap 1: Automatically applying changes when configuration files are saved.

Terraform does not auto-apply; apply must be explicitly run.

Trap 2: Storing sensitive data like passwords and API keys.

State may contain sensitive data, but it is not a recommended store; use a secret backend.

Trap 3: Providing a backup of the infrastructure to restore in case of…

State is not a backup; it is a mapping. Disaster recovery requires separate backups.

Study all Implement and maintain state common traps →

A
Automatically applying changes when configuration files are saved.
Why wrong: Terraform does not auto-apply; apply must be explicitly run.
B
Storing sensitive data like passwords and API keys.
Why wrong: State may contain sensitive data, but it is not a recommended store; use a secret backend.
C
Providing a backup of the infrastructure to restore in case of disaster.
Why wrong: State is not a backup; it is a mapping. Disaster recovery requires separate backups.
D
Improving performance for large infrastructures by caching resource attributes.
State caches attribute values, reducing API calls during planning.
E
Mapping real-world resources to configuration.
State maintains a mapping between resources in configuration and their real-world counterparts.

Full breakdown with real-world context →

Question 15hardmultiple choice

Read the full Implement and maintain state explanation →

You are a DevOps engineer for a company that uses Terraform to manage infrastructure across multiple AWS accounts (production, staging, development). Each account has its own Terraform configuration and remote state stored in an S3 bucket with DynamoDB locking. Recently, the production deployment pipeline failed with the error: 'Error: Error loading state: AccessDenied: Access Denied'. The pipeline runs under an IAM role that has been working for months. The S3 bucket policy and IAM role permissions have not been changed. However, the team did recently enable S3 bucket versioning and added a lifecycle policy to transition objects to Glacier after 30 days. The state file was last modified 35 days ago. What is the most likely cause of the error?

Trap 1: The DynamoDB lock table has a stale lock from a previous deployment…

A stale lock would produce a locking error, not AccessDenied on loading state.

Trap 2: The IAM role's permissions were inadvertently revoked due to a…

The problem statement says permissions have not been changed.

Trap 3: The S3 bucket policy now denies access to objects older than 30…

There is no indication of a policy change; the lifecycle policy does not change permissions.

Study all Implement and maintain state common traps →

A
The DynamoDB lock table has a stale lock from a previous deployment that is blocking read access.
Why wrong: A stale lock would produce a locking error, not AccessDenied on loading state.
B
The IAM role's permissions were inadvertently revoked due to a recent AWS policy change.
Why wrong: The problem statement says permissions have not been changed.
C
The S3 bucket policy now denies access to objects older than 30 days due to a new condition key.
Why wrong: There is no indication of a policy change; the lifecycle policy does not change permissions.
D
The state file was transitioned to Amazon S3 Glacier by the lifecycle policy, and Terraform cannot read it without restoration.
Once an object is in Glacier, standard GetObject requests fail with AccessDenied unless the object is restored first.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Implement and maintain state explanation →

A team is using a shared backend for Terraform state. After running terraform apply, the state file is locked for an extended period, causing other team members to fail with 'Error acquiring the state lock'. What is the most likely cause?

Trap 1: Another team member is actively running terraform apply on the same…

This would cause a temporary lock, not an extended one.

Trap 2: The backend configuration was changed without running terraform…

This would cause a different error, not a lock error.

Trap 3: The state file contains resources that no longer exist in the cloud…

State drift does not cause lock errors.

Study all Implement and maintain state common traps →

A
A previous terraform apply command was interrupted or crashed, leaving a stale lock.
A broken lock file causes the lock to persist indefinitely.
B
Another team member is actively running terraform apply on the same state.
Why wrong: This would cause a temporary lock, not an extended one.
C
The backend configuration was changed without running terraform init.
Why wrong: This would cause a different error, not a lock error.
D
The state file contains resources that no longer exist in the cloud provider.
Why wrong: State drift does not cause lock errors.

Full breakdown with real-world context →

Question 17mediummulti select

Read the full Implement and maintain state explanation →

Which THREE actions should be taken when migrating Terraform state from local to a remote backend?

Trap 1: Remove the local state file before running terraform init.

Terraform init uses the local state for migration; removing it would lose data.

Trap 2: Manually import all existing resources into the remote state.

Resources are already in local state; no import needed.

Study all Implement and maintain state common traps →

A
Remove the local state file before running terraform init.
Why wrong: Terraform init uses the local state for migration; removing it would lose data.
B
Run terraform init to initialize the backend and migrate state.
This command handles the migration.
C
Manually import all existing resources into the remote state.
Why wrong: Resources are already in local state; no import needed.
D
Confirm migration by typing 'yes' when prompted.
Terraform prompts for confirmation before overwriting remote state.
E
Add a backend block to the configuration.
Required to define the remote backend.

Full breakdown with real-world context →

Question 18mediummulti select

Read the full Implement and maintain state explanation →

Which four of the following statements about Terraform state management are correct? (Choose all that apply. There are four correct answers.)

Question 19mediumdrag order

Read the full Implement and maintain state explanation →

Drag and drop the steps to use Terraform modules from the registry in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediummatching

Read the full Implement and maintain state explanation →

Match each Terraform state command to its action.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

List resources in the state

Show details of a single resource in state

Move an item in the state

Remove an item from the state

Download current state from backend

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Implement and maintain state sessions

Start a Implement and maintain state only practice session

Every question in these sessions is drawn from the Implement and maintain state domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Implement and maintain state questions →Mixed TF-003 session

Frequently asked questions

What does the TF-003 exam test about Implement and maintain state?: Implement and maintain state questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Implement and maintain state questions in a focused session?: Yes — the session launcher on this page draws every question from the Implement and maintain state domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other TF-003 topics?: Use the topic links above to move to related areas, or go back to the TF-003 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the TF-003 exam covers. They are not copied from any real exam or dump site.

Implement and maintain state only

10 questions 20 questions 30 questions 50 questions

Mixed TF-003 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All TF-003 questions Implement and maintain state domain overview TF-003 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Implement and maintain state practice questions

What to know about Implement and maintain state

Common Implement and maintain state exam traps

Implement and maintain state questions

A team is using a remote backend in Terraform Cloud. After a failed apply, the state file is locked. The team lead wants to unlock the state immediately. What should be done?

An organization uses Terraform with AWS S3 backend and DynamoDB for state locking. During a plan, you receive an error: 'Error acquiring the state lock'. The lock information in DynamoDB shows a lock from a previous session that crashed. What is the most appropriate next step?

A developer is working on a Terraform configuration that manages a single resource. They want to import an existing AWS EC2 instance into state. Which command should they use?

A team uses Terraform Cloud workspaces to manage multiple environments. They notice that the state file for the production workspace is stored in a different backend than the development workspace. Which Terraform feature allows different workspaces to use different backends?

After running terraform apply, you see the error: 'Error: Error loading state: state snapshot was created by Terraform v0.12.0, but this is Terraform v1.2.0'. What should you do to resolve this?

A user wants to remove a specific resource from Terraform state without destroying the actual infrastructure. Which command should they use?

A company uses Terraform to manage infrastructure across multiple AWS accounts. They want to use a single S3 bucket to store state files for all accounts, but ensure that state files are isolated per account. What is the best approach?

Which TWO of the following are valid methods to share data between Terraform configurations?

Which THREE of the following are best practices for managing Terraform state?

Which TWO of the following are true about Terraform workspaces?

Which TWO of the following are valid reasons to use Terraform state?

A team is using a shared backend for Terraform state. After running terraform apply, the state file is locked for an extended period, causing other team members to fail with 'Error acquiring the state lock'. What is the most likely cause?

Which THREE actions should be taken when migrating Terraform state from local to a remote backend?

Which four of the following statements about Terraform state management are correct? (Choose all that apply. There are four correct answers.)

Drag and drop the steps to use Terraform modules from the registry in the correct order.

Match each Terraform state command to its action.

Track your progress over time

Start a Implement and maintain state only practice session

Related TF-003 topic practice pages

Understand IaC concepts practice questions

Understand Terraform basics practice questions

Understand Terraform's purpose practice questions

Use Terraform outside the core workflow practice questions

Interact with Terraform modules practice questions

Use the core Terraform workflow practice questions