TF-004 Understand Terraform basics Practice Question
Your team uses Terraform to manage a multi-region AWS deployment consisting of over 500 resources. The state file is stored in an S3 backend with DynamoDB locking. Recently, one of your colleagues accidentally deleted the state file from S3 while trying to clean up old backups. Fortunately, you have a backup from two days ago. However, after restoring the backup, you notice that several recent changes, including two new EC2 instances and a security group, are missing from the state. The actual resources still exist in AWS. You need to bring the state back in sync with the real-world infrastructure without recreating these resources. What should you do?
⚠ Common exam trap
A common misconception is that `terraform refresh` can discover and add missing resources to state, but refresh only updates attributes for resources already in state and cannot import new resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use `terraform import` for each missing resource to add them to state
`terraform import` is the intended mechanism to bring existing infrastructure under Terraform management without recreating it. Since the missing EC2 instances and security group still exist in AWS but are absent from the state file, importing each resource by its AWS ID will add the corresponding state entries, allowing Terraform to manage them going forward. This avoids the downtime and potential configuration drift that would occur with `terraform apply` or manual state editing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use `terraform import` for each missing resource to add them to state
Why this is correct
The `terraform import` command is the correct and intended mechanism for bringing existing infrastructure resources, which were not originally provisioned by Terraform, under Terraform's management. It reads the current state of a specified resource from the cloud provider and adds a corresponding entry to the Terraform state file, linking it to a defined resource block in the configuration. This process ensures that Terraform can subsequently manage, update, or destroy the imported resource.
- ✗
Run `terraform apply` to recreate the missing resources
Why it's wrong here
Running `terraform apply` when resources exist in the configuration but are missing from the state file will instruct Terraform to attempt to *create* those resources. Since the resources already physically exist in the AWS environment, this operation will inevitably fail with errors indicating that the resource already exists, such as duplicate names, IDs, or other conflicts. `apply` is for provisioning new infrastructure or modifying existing, state-tracked resources.
- ✗
Manually edit the state file to add the missing resource entries
Why it's wrong here
Manually editing the `terraform.tfstate` file is an extremely risky and error-prone practice that should be strictly avoided. The state file is a complex, sensitive JSON document that tracks resource IDs, attributes, dependencies, and crucial metadata for Terraform's operations. Any manual modification can easily introduce syntax errors, corrupt the state, or create inconsistencies between Terraform's understanding and the actual infrastructure, leading to unpredictable behavior, data loss, or unmanageable resources. Terraform provides specific commands for safe state manipulation.
- ✗
Run `terraform refresh` to update the state with the missing resources
Why it's wrong here
The `terraform refresh` command, or the refresh phase within `plan` and `apply`, is designed to reconcile the known state in the `tfstate` file with the actual state of resources in the cloud provider. It reads the current attributes of *resources already tracked in the state file* and updates their values to reflect any out-of-band changes. However, `refresh` cannot discover or add entirely new resources that are present in the cloud but absent from Terraform's state; its functionality is limited to updating existing entries.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.