- A
Create a wrapper script that checks the workspace before running terraform destroy and requires a manual confirmation for prod.
Why wrong: This relies on external scripting and user discipline; it is not a Terraform-native safety mechanism.
- B
Use Terraform Sentinel policies with a mandatory policy that denies destroy on the prod workspace.
Why wrong: Sentinel requires Terraform Cloud/Enterprise and policy sets; it's not a built-in Terraform OSS feature.
- C
Configure a remote backend with state locking and force unlock only for non-prod workspaces.
Why wrong: Backend configuration doesn't provide conditional destroy prevention; state locking prevents concurrent operations, not destroy.
- D
Add a lifecycle precondition block in a null_resource that checks if the current workspace is 'prod' and fails if terraform destroy is attempted.
Correct: lifecycle preconditions are evaluated during plan and apply; they can prevent destroy on production workspace.
Quick Answer
The correct approach is to add a lifecycle precondition block in a null_resource that checks if the current workspace is 'prod' and fails if terraform destroy is attempted. This works because the lifecycle precondition evaluates during the planning phase, using the `terraform.workspace` expression to inspect the active workspace before any resources are actually destroyed. By embedding this check in a null_resource, you create a synthetic guard that halts the entire destroy operation when the workspace equals "prod", without needing to alter the provider or backend configuration. On the HashiCorp Terraform Associate TF-003 exam, this question tests your understanding of native Terraform safeguards versus external tooling—a common trap is reaching for workspace-level CLI flags or backend changes, which are not required here. Remember the mnemonic: "Precondition on null, destroy is nullified."
TF-003 Understand Terraform basics Practice Question
This TF-003 practice question tests your understanding of understand terraform basics. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a DevOps engineer managing a multi-environment Terraform setup using workspaces. Your team has three workspaces: dev, staging, and prod. All infrastructure is defined in a single root module with environment-specific variable values stored in separate .tfvars files. Recently, a colleague accidentally ran terraform destroy in the prod workspace, which deleted critical production resources. You need to implement a safety mechanism to prevent accidental destruction of production resources in the future. The solution should not require changes to the Terraform provider or backend configuration. Which approach should you take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Add a lifecycle precondition block in a null_resource that checks if the current workspace is 'prod' and fails if terraform destroy is attempted.
Option D is correct because a `lifecycle` precondition block in a `null_resource` can evaluate the current workspace at plan time using `terraform.workspace`. When `terraform destroy` is run, the precondition fails if the workspace is `prod`, preventing the destroy operation without altering the provider or backend configuration. This approach is native to Terraform, requires no external tools, and directly enforces the safety check within the configuration itself.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a wrapper script that checks the workspace before running terraform destroy and requires a manual confirmation for prod.
Why it's wrong here
This relies on external scripting and user discipline; it is not a Terraform-native safety mechanism.
- ✗
Use Terraform Sentinel policies with a mandatory policy that denies destroy on the prod workspace.
Why it's wrong here
Sentinel requires Terraform Cloud/Enterprise and policy sets; it's not a built-in Terraform OSS feature.
- ✗
Configure a remote backend with state locking and force unlock only for non-prod workspaces.
Why it's wrong here
Backend configuration doesn't provide conditional destroy prevention; state locking prevents concurrent operations, not destroy.
- ✓
Add a lifecycle precondition block in a null_resource that checks if the current workspace is 'prod' and fails if terraform destroy is attempted.
Why this is correct
Correct: lifecycle preconditions are evaluated during plan and apply; they can prevent destroy on production workspace.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
HashiCorp often tests the distinction between native Terraform features (like `lifecycle` preconditions) and external tools (like wrapper scripts or Sentinel) that require additional infrastructure or configuration changes, leading candidates to choose a non-native solution that is not self-contained within the root module.
Detailed technical explanation
How to think about this question
The `lifecycle` precondition block is evaluated during the planning phase, before any resources are modified, using the `condition` argument which can reference `terraform.workspace`. Under the hood, Terraform resolves `terraform.workspace` to the current workspace name from the state or environment variable `TF_WORKSPACE`. In a real-world scenario, this precondition can be combined with `prevent_destroy` on critical resources, but `prevent_destroy` only blocks `terraform destroy` on that specific resource, not the entire workspace, making the precondition a more comprehensive guard.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Understand Terraform basics — study guide chapter
Learn the concepts, then practise the questions
- →
Understand Terraform basics practice questions
Targeted practice on this topic area only
- →
All TF-003 questions
519 questions across all exam domains
- →
HashiCorp Terraform Associate TF-003 study guide
Full concept coverage aligned to exam objectives
- →
TF-003 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related TF-003 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Understand IaC concepts practice questions
Practise TF-003 questions linked to Understand IaC concepts.
Understand Terraform basics practice questions
Practise TF-003 questions linked to Understand Terraform basics.
Understand Terraform's purpose practice questions
Practise TF-003 questions linked to Understand Terraform's purpose.
Use Terraform outside the core workflow practice questions
Practise TF-003 questions linked to Use Terraform outside the core workflow.
Interact with Terraform modules practice questions
Practise TF-003 questions linked to Interact with Terraform modules.
Use the core Terraform workflow practice questions
Practise TF-003 questions linked to Use the core Terraform workflow.
Implement and maintain state practice questions
Practise TF-003 questions linked to Implement and maintain state.
Read, generate and modify configuration practice questions
Practise TF-003 questions linked to Read, generate and modify configuration.
TF-003 fundamentals practice questions
Practise TF-003 questions linked to TF-003 fundamentals.
TF-003 scenario practice questions
Practise TF-003 questions linked to TF-003 scenario.
TF-003 troubleshooting practice questions
Practise TF-003 questions linked to TF-003 troubleshooting.
Practice this exam
Start a free TF-003 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this TF-003 question test?
Understand Terraform basics — This question tests Understand Terraform basics — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Add a lifecycle precondition block in a null_resource that checks if the current workspace is 'prod' and fails if terraform destroy is attempted. — Option D is correct because a `lifecycle` precondition block in a `null_resource` can evaluate the current workspace at plan time using `terraform.workspace`. When `terraform destroy` is run, the precondition fails if the workspace is `prod`, preventing the destroy operation without altering the provider or backend configuration. This approach is native to Terraform, requires no external tools, and directly enforces the safety check within the configuration itself.
What should I do if I get this TF-003 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More TF-003 practice questions
- Which TWO statements accurately describe the purpose of Terraform? (Choose two.)
- A team is evaluating Terraform for managing their multi-cloud infrastructure. Which TWO statements accurately describe T…
- Which TWO of the following are valid use cases for using Terraform Cloud's Sentinel policies? (Choose two.)
- Match each Terraform function to its category.
- Match each Terraform provisioner to its typical use case.
- Match each Terraform meta-argument to its purpose.
Last reviewed: Jun 30, 2026
This TF-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-003 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.