TF-004 Implement and maintain state Practice Question
Which four of the following statements about Terraform state management are correct? (Choose all that apply. There are four correct answers.)
⚠ Common exam trap
HashiCorp often tests the misconception that `terraform state list` can modify state or that automatic backups are built-in, when in fact Terraform requires explicit backend versioning or manual backup configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using remote state storage with a backend like S3 or Azure Storage provides locking to prevent concurrent modifications.
Remote state backends like S3 or Azure Storage support state locking (via DynamoDB or Azure Blob lease) to prevent concurrent modifications, ensuring consistency. The `terraform state rm` command removes a resource from state without destroying the real infrastructure, which is useful for detaching management. Encrypting the state backend at rest (e.g., S3 server-side encryption or Azure Storage encryption) protects sensitive data like passwords or keys stored in the state file. The `terraform import` command updates the state file to include an existing resource, allowing Terraform to take over its management without recreating it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using remote state storage with a backend like S3 or Azure Storage provides locking to prevent concurrent modifications.
Why this is correct
Remote state backends, such as AWS S3 with DynamoDB for locking or Azure Storage with blob leases, are crucial for collaborative Terraform environments. They implement state locking mechanisms to prevent multiple users or automated processes from simultaneously writing to the state file. This ensures state consistency and avoids corruption that could arise from concurrent `terraform apply` operations.
- ✓
The `terraform state rm` command can be used to remove a resource from state without destroying the real infrastructure.
Why this is correct
The `terraform state rm` command is specifically designed to remove a resource's entry from the Terraform state file. This action effectively tells Terraform to "forget" about that particular resource without interacting with the actual cloud provider to delete the underlying infrastructure. It's useful for scenarios where a resource should no longer be managed by Terraform but needs to persist in the environment.
- ✓
Sensitive data stored in state files can be protected by encrypting the state backend at rest.
Why this is correct
Terraform state files often contain sensitive information, including database credentials, API keys, or network configurations. While Terraform itself does not encrypt the state file contents, remote backends like AWS S3 or Azure Storage accounts offer server-side encryption (SSE) at rest. Enabling this encryption on the backend ensures that the state data is encrypted when stored, providing a critical layer of security for sensitive information.
- ✓
The `terraform import` command updates the state file to include an existing resource, enabling Terraform to manage it.
Why this is correct
The `terraform import` command is used to bring existing infrastructure resources, which were not originally created by Terraform, under Terraform's management. When executed, it reads the configuration of a specified existing resource from the cloud provider and adds a corresponding entry to the Terraform state file. This allows subsequent `terraform plan` and `apply` operations to detect and manage that resource.
- ✗
Terraform automatically backs up the previous state file every time a new state is written.
Why it's wrong here
Terraform does create a `terraform.tfstate.backup` file when modifying local state. However, for remote state backends, which are the recommended practice for production, Terraform typically relies on the backend's versioning capabilities (e.g., S3 bucket versioning) rather than creating a separate `.backup` file itself. The statement is too generalized and doesn't accurately represent how backups are handled across all state management scenarios, especially with remote state.
- ✗
The `terraform state list` command can modify the state file to rename a resource.
Why it's wrong here
The `terraform state list` command is a read-only operation designed solely to display the resources currently tracked within the Terraform state file. It provides a list of resource addresses but does not possess any capabilities to alter, rename, or modify the state file's contents. To rename a resource within the state, the `terraform state mv` command must be used, which explicitly moves a resource from one address to another.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.