TF-004 Implement and maintain state Practice Question
Which two statements about Terraform state files are true? (Choose two.)
⚠ Common exam trap
The trap is assuming state is always encrypted and safe to commit; candidates conflate 'remote backend' with 'automatically encrypted and locked,' when both must be explicitly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
State files are used to map configuration to real-world resources.
Option C is correct because the Terraform state file is the authoritative record that maps each resource declared in the configuration to its corresponding real-world object (for example, an AWS instance ID), enabling Terraform to plan accurate create, update, and destroy operations. Option E is correct because state stores resource attributes in plain text, including values such as database passwords, connection strings, and private keys, which is why state must be protected with encryption and restricted access. Option A is wrong because encryption at rest is not automatic for all backends; local state is unencrypted by default, and remote backends like S3 require explicit SSE configuration or KMS. Option B is wrong because committing state to version control exposes secrets and causes conflicts; remote backends with locking are the recommended approach. Option D is wrong because concurrent operations on the same state can corrupt it, which is why backends such as S3 with DynamoDB or Terraform Cloud provide state locking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
State files are automatically encrypted at rest by all backends.
Why it's wrong here
State files are not automatically encrypted at rest by all backends; this statement is false. While many remote backends, such as AWS S3 or Azure Blob Storage, offer encryption capabilities, these are features of the underlying storage service and often require explicit configuration. The default `local` backend, for instance, stores the state file unencrypted on the filesystem where Terraform is executed, making it vulnerable if the host is compromised.
- ✗
State files should be stored in version control.
Why it's wrong here
Storing state files directly in version control systems (VCS) like Git is generally considered an anti-pattern and is not a recommended best practice. This approach can lead to significant issues such as merge conflicts, accidental exposure of sensitive data, and a lack of state locking, which is crucial for preventing concurrent modifications and state corruption when multiple users or automation systems interact with the infrastructure. Remote backends are designed to handle these challenges more effectively.
- ✓
State files are used to map configuration to real-world resources.
Why this is correct
State files are indeed used to map configuration to real-world resources, which is their primary and most fundamental function. The state file serves as the definitive source of truth, meticulously recording the unique identifiers and attributes of all infrastructure components provisioned by Terraform. This mapping allows Terraform to understand the current state of the infrastructure and accurately determine the necessary actions to reconcile it with the desired configuration defined in your HCL files.
- ✗
State files can be shared across multiple users simultaneously without issues.
Why it's wrong here
State files cannot be shared across multiple users simultaneously without issues; this statement is incorrect. Concurrent write operations to a single state file by multiple users or processes without proper synchronization mechanisms will inevitably lead to state corruption and an inconsistent view of the infrastructure. Remote backends address this critical challenge by implementing state locking, which ensures that only one operation can modify the state file at any given time, thereby preventing data integrity problems.
- ✓
State files can contain sensitive data such as database passwords.
Why this is correct
State files can and often do contain sensitive data, such as database passwords, API keys, or private SSH keys, if these values are provisioned or retrieved as attributes of managed resources. Terraform stores a complete snapshot of all resource attributes, including those marked as sensitive, within the state file. This inherent characteristic underscores the critical importance of securing state files through mechanisms like remote backends with robust access controls and encryption, as their compromise could expose critical credentials.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 434 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.