TF-004 Use Terraform outside the core workflow Practice Question
Which THREE of the following are best practices for Terraform state management?
⚠ Common exam trap
HashiCorp often tests the misconception that state files should be version-controlled like code, but the trap is that state files contain sensitive data and are not idempotent, making remote backends with locking the correct practice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use workspaces to manage different environments.
Terraform workspaces allow you to manage multiple distinct state files for the same configuration, enabling environment separation (e.g., dev, staging, prod) without duplicating code or backends. Each workspace maintains its own state, preventing cross-environment interference and simplifying infrastructure lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually edit state files to fix configuration drift.
Why it's wrong here
Manually editing Terraform state files is a highly discouraged practice due to the significant risk of introducing corruption or inconsistencies. The state file is a precise JSON representation of your infrastructure, and even minor syntax errors or incorrect resource IDs can render it unusable, leading to catastrophic failures during subsequent `terraform plan` or `apply` operations. Instead, Terraform provides specific `terraform state` subcommands, such as `terraform state mv` or `terraform state rm`, which safely manipulate the state while maintaining its integrity and validity.
- ✗
Commit state files to version control.
Why it's wrong here
Committing Terraform state files directly to version control systems like Git is a severe security and operational anti-pattern. State files often contain sensitive information, including API keys, database credentials, or other secrets, which would then be exposed in the repository's history. Furthermore, in a team environment, local state files lead to constant merge conflicts and race conditions, making collaborative infrastructure management impossible. Remote backends are designed to securely store and manage state, providing locking mechanisms for concurrent operations.
- ✓
Use workspaces to manage different environments.
Why this is correct
Terraform workspaces provide a robust mechanism for managing multiple distinct environments, such as development, staging, and production, using the same configuration code. Each workspace maintains its own isolated state file, preventing resource conflicts and accidental modifications across environments. This isolation ensures that changes intended for one environment do not inadvertently affect another, promoting safer and more organized infrastructure deployments without duplicating configuration files.
- ✓
Store state file in a remote backend with locking enabled.
Why this is correct
Storing Terraform state files in a remote backend is a fundamental best practice, especially for team collaboration and production environments. Remote backends centralize the state, making it accessible to all team members and preventing local state inconsistencies. Crucially, enabling state locking within the remote backend prevents concurrent `terraform apply` operations from multiple users, which could otherwise lead to race conditions, state corruption, or unintended infrastructure changes.
- ✓
Use 'terraform state rm' to remove resources from state when needed.
Why this is correct
The `terraform state rm` command is the correct and safe method to remove a specific resource from Terraform's state file without destroying the actual cloud resource. This is particularly useful when you want Terraform to stop managing a resource, perhaps because it will now be managed manually or by another system, but you need the resource to remain operational. Using this command ensures the state file remains valid and consistent, unlike error-prone manual edits.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.