TF-004 Understand Terraform basics Practice Question
You are a platform engineer at a fintech company. Your team manages a multi-region application on AWS using Terraform. The infrastructure includes VPCs, subnets, EC2 instances, and an Application Load Balancer (ALB). The configuration uses modules from the Terraform Registry and remote state in S3 with DynamoDB locking.
Recently, after a colleague ran `terraform apply` in the us-east-1 region, the application experienced downtime because the ALB's target group was accidentally updated to point to instances in us-west-2 instead of us-east-1. The root cause was that the Terraform configuration for the ALB used a variable `target_region` which was hardcoded to us-west-2 in a `terraform.tfvars` file that was not intended for that workspace.
Your team wants to prevent such misconfigurations in the future. Which course of action would most effectively reduce the risk of using incorrect variable values across workspaces?
⚠ Common exam trap
Many candidates assume workspaces provide sufficient isolation for multi-region deployments, but workspaces share the same variable files and backend configuration, making them unsuitable for preventing cross-region variable misconfigurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate Terraform configurations for each region, each with its own backend configuration and variable files, and use directory structure to enforce separation
Creating separate Terraform configurations for each region enforces strict isolation at the directory and backend level, preventing accidental cross-region variable injection. This approach ensures that each region's configuration has its own dedicated variable files and state, eliminating the risk of a `terraform.tfvars` file from one workspace affecting another. It aligns with infrastructure-as-code best practices for multi-region deployments where environment boundaries must be explicit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a CI/CD pipeline that runs `terraform plan` for every workspace and requires manual approval before apply
Why it's wrong here
Implementing a CI/CD pipeline that runs `terraform plan` and requires manual approval, while a good practice for review, does not inherently prevent the application of incorrect variable values across regions. The plan output shows *what* changes will occur, but it doesn't validate the *intent* or confirm that the chosen variables are correct for the target region. Manual reviewers can still overlook subtle misconfigurations, especially with complex variable sets or multiple environments, as this approach lacks strong technical enforcement against using the wrong variables.
- ✗
Use the same S3 backend for all regions but with different state file keys, and enforce naming conventions
Why it's wrong here
Using the same S3 backend for all regions but with different state file keys only separates the state data, not the configuration or variable files. If all regions share a single Terraform configuration directory, it remains easy to accidentally apply variable values intended for one region (e.g., `us-east-1.tfvars`) to another (e.g., `eu-west-1`). Naming conventions are procedural guidelines, not technical enforcements, and cannot reliably prevent human error in selecting or applying the wrong variable set.
- ✗
Store all variables in a single `terraform.tfvars` file and use conditionals with `terraform.workspace` to select values
Why it's wrong here
Storing all variables in a single `terraform.tfvars` file and relying on `terraform.workspace` conditionals introduces significant complexity and potential for error. This monolithic file becomes difficult to maintain, review, and debug, increasing the risk of incorrect conditional logic or syntax errors that could impact multiple regions. While `terraform.workspace` provides logical separation of state, it does not provide physical separation of variable definitions, making it less robust than dedicated configurations.
- ✓
Create separate Terraform configurations for each region, each with its own backend configuration and variable files, and use directory structure to enforce separation
Why this is correct
Creating separate Terraform configurations for each region, each within its own dedicated directory, provides the strongest form of isolation. This approach ensures that each region has its own backend configuration, state file, and explicitly defined variable files (e.g., `region.tfvars`). This physical separation makes it virtually impossible to accidentally apply variables or configurations meant for one region to another, as the `terraform` command must be executed from the correct, isolated directory.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.