TF-004 Use Terraform outside the core workflow Practice Question
Which TWO of the following are valid ways to use Terraform outside the core workflow (i.e., in automation or CI/CD pipelines)?
⚠ Common exam trap
HashiCorp often tests the distinction between commands that are part of the core workflow (plan, apply, destroy) versus auxiliary commands (state manipulation, graph generation, module initialization) that are not directly used for automated execution in CI/CD pipelines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.
The Terraform CLI's `-auto-approve` flag is designed for non-interactive environments like CI/CD pipelines, allowing automated execution of `terraform apply` after a successful plan without manual confirmation. This bypasses the interactive approval step, making it suitable for automation where human input is not possible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Using the Terraform CLI in a CI/CD pipeline with -auto-approve after a successful plan.
Why this is correct
Automating Terraform deployments in a CI/CD pipeline is a standard practice for achieving continuous delivery of infrastructure. After a `terraform plan` confirms the intended infrastructure changes, `terraform apply -auto-approve` can be safely executed to provision or modify resources without requiring manual confirmation. This enables fully automated, hands-off deployments, crucial for maintaining infrastructure as code principles and accelerating release cycles.
- ✗
Using 'terraform state mv' to reorganize state files.
Why it's wrong here
`terraform state mv` is a command designed for refactoring the Terraform state file by moving resources to new addresses or between modules within the configuration. While essential for state management and organizational changes, it is an administrative operation, not a primary mechanism for automating the provisioning or updating of infrastructure itself. This command typically requires careful, often manual, execution to prevent state corruption and is not part of a general automation workflow for deploying infrastructure.
- ✗
Using 'terraform init -from-module' to force module re-download.
Why it's wrong here
`terraform init -from-module=SOURCE` is used to initialize a new Terraform configuration by copying the contents of a specified module into the current working directory. This command is primarily for bootstrapping new projects or creating boilerplate configurations from existing modules, not for re-downloading or updating existing module dependencies within an active configuration. For updating modules, `terraform init -upgrade` is the correct command, making `-from-module` unsuitable for general automation of module updates.
- ✓
Using the Terraform Cloud API to trigger runs and check results.
Why this is correct
Terraform Cloud and Terraform Enterprise provide a robust API that allows external systems to programmatically interact with and control Terraform runs. This enables advanced automation scenarios, such as triggering infrastructure deployments from custom applications, integrating with incident response systems, or orchestrating complex workflows across multiple environments. The API facilitates monitoring run status, retrieving outputs, and managing workspaces, making it a powerful tool for automated infrastructure management.
- ✗
Using 'terraform graph' to generate visual output.
Why it's wrong here
`terraform graph` generates a visual representation of your Terraform configuration's resource dependencies in DOT format. This output is primarily intended for human consumption, aiding in understanding the relationships between resources and debugging complex configurations. While valuable for analysis and documentation, `terraform graph` does not execute any infrastructure changes or directly contribute to the automated deployment process itself.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.