TF-004 Implement and maintain state Practice Question
Which two statements about Terraform state files are true? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
State files are used to map configuration to real-world resources.
Terraform state files serve as a mapping between configuration and real-world resources (C). They can contain sensitive data such as database passwords or resource attributes (E). However, state files are not automatically encrypted by all backends; encryption depends on the backend configuration (A false). State files should not be stored in version control due to potential sensitive content (B false). Concurrent writes to state files can cause corruption or conflicts, so sharing without locking is problematic (D false).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
State files are automatically encrypted at rest by all backends.
Why it's wrong here
State files are not automatically encrypted at rest by all backends; this statement is false. While many remote backends, such as AWS S3 or Azure Blob Storage, offer encryption capabilities, these are features of the underlying storage service and often require explicit configuration. The default `local` backend, for instance, stores the state file unencrypted on the filesystem where Terraform is executed, making it vulnerable if the host is compromised.
- ✗
State files should be stored in version control.
Why it's wrong here
Storing state files directly in version control systems (VCS) like Git is generally considered an anti-pattern and is not a recommended best practice. This approach can lead to significant issues such as merge conflicts, accidental exposure of sensitive data, and a lack of state locking, which is crucial for preventing concurrent modifications and state corruption when multiple users or automation systems interact with the infrastructure. Remote backends are designed to handle these challenges more effectively.
- ✓
State files are used to map configuration to real-world resources.
Why this is correct
State files are indeed used to map configuration to real-world resources, which is their primary and most fundamental function. The state file serves as the definitive source of truth, meticulously recording the unique identifiers and attributes of all infrastructure components provisioned by Terraform. This mapping allows Terraform to understand the current state of the infrastructure and accurately determine the necessary actions to reconcile it with the desired configuration defined in your HCL files.
- ✗
State files can be shared across multiple users simultaneously without issues.
Why it's wrong here
State files cannot be shared across multiple users simultaneously without issues; this statement is incorrect. Concurrent write operations to a single state file by multiple users or processes without proper synchronization mechanisms will inevitably lead to state corruption and an inconsistent view of the infrastructure. Remote backends address this critical challenge by implementing state locking, which ensures that only one operation can modify the state file at any given time, thereby preventing data integrity problems.
- ✓
State files can contain sensitive data such as database passwords.
Why this is correct
State files can and often do contain sensitive data, such as database passwords, API keys, or private SSH keys, if these values are provisioned or retrieved as attributes of managed resources. Terraform stores a complete snapshot of all resource attributes, including those marked as sensitive, within the state file. This inherent characteristic underscores the critical importance of securing state files through mechanisms like remote backends with robust access controls and encryption, as their compromise could expose critical credentials.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.