HashiCorp Terraform Associate (004) Exam Questions

Area 1: Infrastructure as Code (IaC) with Terraform

What are the benefits of Infrastructure as Code tools like Terraform?

⬜ Manage and track infrastructure
⬜ Automate infrastructure changes
⬜ Support Reusable configuration
⬜ Collaboration using VCS (version control system)
⬜ All of the above

Which one do you think is an advantage of using Terraform as the IaC tool?

⬜ Terraform can manage infrastructure on multiple cloud platforms.
⬜ Terraform’s state allows you to track resource changes throughout your deployments.
⬜ You can commit your configurations to version control to safely collaborate on infrastructure.
⬜ All of the above

What are the benefits of using an “Infrastructure as Code” tool like Terraform? (select three)

⬜ An imperative approach, offers flexibility to describe each step you want IaC to follow to reach the desired state
⬜ You can commit your configurations to version control to safely collaborate on infrastructure
⬜ The human-readable configuration language helps you write infrastructure code quickly
⬜ Terraform can manage infrastructure on multiple cloud platforms

Which is NOT a benefit of using an IaC tool like Terraform??

⬜ You can commit your configurations to version control to safely collaborate on infrastructure
⬜ You can manage infrastructure on multiple cloud platforms
⬜ Infrastructure code is easy to maintain and understand without any Cloud knowledge
⬜ The human-readable configuration language helps you write infrastructure code quickly

Which of the following methods, used to provision resources into a public cloud, demonstrates the concept of Infrastructure as Code (IaC)?

⬜ curl commands manually run from a terminal
⬜ A sequence of REST requests you pass to a public cloud API endpoint
⬜ A script that contains a series of public cloud CLI commands
⬜ A series of commands you enter into a public cloud console

Does Terraform provide support for multiple cloud deployments?

⬜ True
⬜ False

How do you describe the Terraform precisely?

⬜ A programming language
⬜ An infrastructure as code (IaC) tool
⬜ A cloud provider
⬜ A containerization tool

Terraform is an Infrastructure as Code (IaC) tool that is? (select two)

⬜ Imperative
⬜ Declarative
⬜ Cloud-agnostic
⬜ Cloud-native

Which of the following describes the Terraform use case?

⬜ Provisioning infrastructure in both Azure and AWS
⬜ Enforce compliance and governance policies before any infrastructure changes
⬜ Deploy a Kubernetes cluster and manage its resources
⬜ All of the above

The activity of code provision and configuring your initial infrastructure in the Infrastructure Lifecycle is called?

⬜ Day 0
⬜ Day 1
⬜ Sprint 0
⬜ Sprint 1

Which characteristic of an IaC tool ensures the same infrastructure state, if the same code is applied multiple times?

⬜ Consistent
⬜ Repeatable
⬜ Idempotent
⬜ Predictable

You have recently started a new job at a retailer as an engineer. As part of this new role, you have been tasked with evaluating multiple outages that occurred during peak shopping time during the holiday season. Your investigation found that the team is manually deploying new compute instances and configuring each compute instance manually. This has led to inconsistent configuration between each compute instance. How would you solve this using Infrastructure as Code?

⬜ Implement a ticketing workflow that makes engineers submit a ticket before manually provisioning and configuring a resource
⬜ Implement a checklist that engineers can follow when configuring compute instances
⬜ Replace the compute instance type with a larger version to reduce the number of required deployments
⬜ Implement a provisioning pipeline that deploys infrastructure configurations committed to your version control system following code reviews

What distinguishes managing infrastructure with Infrastructure as Code (IaC) from running raw API calls or CLI commands by hand?

⬜ Terraform stores infrastructure logic in version control so that operations always run imperatively, step by step.
⬜ Terraform describes the desired end state declaratively and produces an execution plan before it applies any change.
⬜ Terraform guarantees that resources always match the desired state by updating them automatically on its own.
⬜ Terraform replaces each provider’s API with its own protocol, so you no longer authenticate to each cloud.

Why is it better to use one tool such as Terraform for multi-cloud deployments instead of a separate tool and workflow for each cloud?

⬜ It makes every cloud expose identical resource types and APIs, so provider-specific differences disappear.
⬜ It removes the need for cloud-specific credentials, because one token works with every provider by default.
⬜ It gives teams one common workflow and reusable modules, so CI/CD, reviews and policies stay consistent across clouds.
⬜ It automatically moves resources created with other tools into Terraform without any refactoring.

Your team runs long-lived VMs managed with a configuration management tool, and drift and rollbacks keep happening. Which option best shows an advantage of IaC over traditional configuration management here?

⬜ Use configuration management to provision resources and IaC to patch them, keeping the same mutable servers and processes.
⬜ Use declarative IaC with immutable infrastructure: define the desired state in code, replace resources instead of patching them, and version everything.
⬜ IaC doesn’t help here; run identical imperative scripts on every server during maintenance windows.
⬜ Keep configuration management for the servers and export the VMs as golden images once they have converged.

Your organization uses Chef to configure application settings and install packages on existing servers, and the DevOps team is considering Terraform alongside it. How do IaC tools like Terraform differ from configuration management tools?

⬜ IaC tools can only create cloud resources and VMs, while configuration management tools can also create on-premises and physical resources.
⬜ IaC tools provision infrastructure and manage its lifecycle, while configuration management tools install and manage software on servers that already exist.
⬜ IaC tools are always agentless, while configuration management tools always need an agent on every target system.
⬜ IaC tools use imperative, step-by-step models, while configuration management tools use declarative desired-state models.

Aaron wrote one Terraform configuration that he wants to use to deploy his organization’s resources. Which statements about it can be true? (select three)

⬜ It can manage resources in several cloud providers in the same run, if each provider is configured.
⬜ It needs a separate configuration for each provider, because one configuration can’t declare more than one provider.
⬜ Its state can live in a remote backend in one cloud while it provisions resources in another.
⬜ The backend decides where resources are created, so storing state in Azure restricts it to Azure resources.
⬜ The same configuration can deploy QA and Staging when given different variable values or variable files.

Your company deploys Azure workloads with ARM templates and is expanding to AWS and an on-premises Kubernetes cluster. Leadership wants one workflow and as little retraining as possible. Which approaches make the best use of Terraform’s multi-cloud, service-agnostic model? (select two)

⬜ Keep ARM for Azure, adopt CloudFormation for AWS and use kubectl YAML for Kubernetes, matching each platform’s native tools.
⬜ Build cloud-specific modules that share a consistent input/output interface, so teams can reuse the same patterns.
⬜ Keep a separate CLI workflow per platform, because Terraform can’t manage on-premises services such as Kubernetes.
⬜ Standardize the CI/CD pipeline on the same Terraform lifecycle and one common remote backend for state and locking everywhere.

Area 2: Terraform Fundamentals

*Terraform providers are part of the Terraform core binary.

⬜ True
⬜ False

A provider configuration block is required in every Terraform configuration.

provider "provider_name" {
  ...
}

⬜ True
⬜ False

Official Terraform providers are owned and maintained by HashiCorp.

⬜ True
⬜ False

How do you describe a Terraform provider?

⬜ A collection of resources that can be used to define a specific piece of infrastructure
⬜ A plugin that allows Terraform to interact with a specific cloud provider or service
⬜ A tool for managing Docker containers
⬜ A set of variables used to configure Terraform resources

*Which of the following is NOT True of Terraform providers?

⬜ Providers can be written by individuals
⬜ Providers can be maintained by a community of users
⬜ Some providers are maintained by HashiCorp
⬜ Major cloud vendors and non-cloud vendors can write, maintain, or collaborate on Terraform providers
⬜ None of the above

*You add a new provider to your configuration and immediately run terraform apply in the CLI using the local backend. Why does the apply fail?

⬜ Terraform needs to install the necessary plugins first.
⬜ Terraform requires you to manually run terraform plan first.
⬜ The Terraform CLI needs you to log into HCP Terraform first.
⬜ Terraform needs you to format your code according to best practices first.

Which provider configuration can be used to define multiple AWS providers with different regions?

⬜ provider
⬜ source
⬜ region
⬜ alias

What is a provider block without an alias meta argument?

⬜ The default provider configuration.
⬜ A broken provider configuration.
⬜ A partial provider configuration.
⬜ There must be an alias meta argument.

*You need to deploy resources into two different regions in the same Terraform configuration. To do this, you declare multiple provider configurations as shown in the Exhibit. What meta-argument do you need to configure in a resource block to deploy the resource to the us-west-2 AWS region?

provider "aws" {
  region = "us-east-1"
}

provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

⬜ provider = aws.west
⬜ provider = west
⬜ alias = west
⬜ alias = aws.west

How do you select the alternate aws provider for us-west-2 region?

# The default provider configuration
provider "aws" {
  region = "us-east-1"
}
# Additional provider configuration for west coast region
provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

⬜

resource "aws_instance" "foo" {
  provider = aws
}

⬜

resource "aws_instance" "foo" {
  provider = aws.west
}

⬜

resource "aws_instance" "foo" {
  provider = aws.us-west-2
}

⬜

resource "aws_instance" "foo" {
  provider = west
}

Terraform uses a lock file to ensure predictable runs when using ambiguous provider version constraints. How do you update the lock file?

⬜ terraform providers lock
⬜ terraform lock
⬜ terraform apply lock
⬜ terraform lock provider -provider={PROVIDER_NAME}

Terraform is running in an isolated network without access to Terraform registry. How can you configure Terraform to consult only a local filesystem mirror to download plugins?

⬜ terraform providers mirror
⬜ terraform mirror
⬜ terraform providers local
⬜ terraform plugins mirror

While creating a terraform module, which configuration under terraform block can be used to specify the requirement of a specific version of a provider?

⬜ required_providers
⬜ required_provider
⬜ required_versions
⬜ required_version

Which of the following is True for installing provider when terraform init command runs?

⬜ If any acceptable versions are installed, Terraform uses the newest installed version that meets the constraint (even if the Terraform Registry has a newer acceptable version)
⬜ If no acceptable versions are installed and the plugin is one of the providers distributed by HashiCorp, Terraform downloads the newest acceptable version from the Terraform Registry and saves it in a subdirectory under .terraform/providers/
⬜ If no acceptable versions are installed and the plugin is not distributed in the Terraform Registry, initialization fails and the user must manually install an appropriate version.
⬜ All of the above

Which one of the following is considered as a Terraform plugin?

⬜ Terraform provisioner
⬜ Terraform module
⬜ Terraform provider
⬜ Terraform registry

Terraform remembers the compatible version of dependencies such as providers and modules through dependency lock file. What is the name of that file?

⬜ .terraform.lock.hcl
⬜ .terraform.lock.tf
⬜ .dependency.lock.hcl
⬜ .dependency.lock.tf

When does Terraform create the .terraform.lock.hcl file?

⬜ After your first terraform plan
⬜ After your first terraform apply
⬜ After your first terraform init
⬜ When you enable state locking

Which version constraint should use to set both a lower and upper bound on versions for each provider. Also known as pessimistic constraint operator?

⬜ >=
⬜ ~>
⬜ !=
⬜ <>

What does the specified contraint version = “~> 1.0.4” means in required_providers block?

terraform {
  required_providers {
    mycloud = {
      source  = "mycorp/mycloud"
      version = "~> 1.0.4"
    }
  }
}

⬜ >= 1.0.4 and <= 1.1.0
⬜ >= 1.0.4 and < 1.1.0
⬜ > 1.0.4 and < 2.0.0
⬜ >= 1.0.5 and < 1.1.0

What does this symbol version = “~> 1.0” mean when defining versions?

⬜ > 1.0 and < 2.0
⬜ >= 1.0 and < 2.0
⬜ >= 1.0 and <= 2.0
⬜ > 1.0.0 and < 2.0.0

What is the provider version of Google Cloud being used in Terraform? Select all valid options.

provider "google" {
  version = "~> 1.9.0"
}

⬜ 1.9.1
⬜ 1.10.0
⬜ 1.8.0
⬜ 1.9.9

How do you force users to use a particular version of required providers in your terraform code?

⬜

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "3.74.1"
    }
  }
}

⬜

terraform {
  aws = {
    source  = "hashicorp/aws"
    version = "~> 3.74.1"
  }
}

⬜

aws = {
  source  = "hashicorp/aws"
  version = "3.74.1"
}

⬜

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 3.74.1"
    }
  }
}

What is more accurate description of the below version constraint?

terraform {
  required_version = ">= 1.4.7"
}

⬜ All the terraform providers are should have a minimum 1.4.7 version
⬜ Terraform version older than 1.4.7 are not supported by Hashicorp
⬜ Terraform version older than 1.4.7 will produce an error running this configuration
⬜ The minimum version of the application using Terraform should be 1.4.7

*What is the purpose of state in Terraform?

⬜ State stores variables and lets you quickly reuse existing code.
⬜ State maps real world resources to your configuration and keeps track of metadata.
⬜ State lets you enforce resource configurations that relate to compliance policies.
⬜ State codifies the dependencies of related resources.

Which of the following best describes a Terraform state file?

⬜ A file that contains a list of available Terraform providers
⬜ A file that stores the current state of infrastructure managed by Terraform
⬜ A file that contains a list of Terraform modules used in a configuration
⬜ A file that stores the output of a Terraform plan

The terraform.tfstate file always matches your currently built infrastructure.

⬜ True
⬜ False

Terraform can inspect the real-world resources on every run to validate the desired state when the state file is missing.

⬜ True
⬜ False

Usernames and passwords referenced in the Terraform code, even as variables, will end up in plain text in the state file.

⬜ True
⬜ False

*Terraform encrypts sensitive values stored in your state file.

⬜ True
⬜ False

You injected some secrets from variables into your Terraform configuration. What happens after you run the terraform apply command and they are loaded into state?

⬜ They are shown in clear-text.
⬜ They are shown as their referenced variables.
⬜ They are shown as encrypted values.
⬜ They are omitted from state.

Which provider authentication method prevents credentials from being stored in the state file?

⬜ Using environment variables
⬜ Specifying the login credentials in the provider block
⬜ Setting credentials as Terraform variables
⬜ None of the above

*What is the name of the default file where Terraform stores the state?

⬜ terraform.tfstate
⬜ terraform.tfvars
⬜ .terraform.lock.hcl
⬜ terraform.state

Where is the default location that Terraform stores its state in?

⬜ The current working directory in which Terraform was run.
⬜ At the users root directory.
⬜ In the same location that Terraform is installed. E.g. /usr/bin/terraform
⬜ In ~/.terraform.d/plugins

After you run terraform init in a new working directory, the output shows the aws and time provider plugins being downloaded. Where on this machine does Terraform store those plugins?

⬜ In the .terraform/plugins directory of the current working directory
⬜ In the .terraform.d directory of the current working directory
⬜ In /etc/terraform/plugins
⬜ In the .terraform/providers directory of the current working directory

How do you tell Terraform which provider it should install for a configuration?

⬜ Download the provider binary yourself and put it in the folder with your configuration files.
⬜ Declare the provider in required_providers and add a matching provider block to the configuration.
⬜ Put the provider name in a variable and pass it with -var when you run terraform init.
⬜ Run terraform apply first so Terraform can detect and install the right provider automatically.

While reviewing a colleague’s Terraform project, you notice a .terraform/ directory. What is it used for?

⬜ It holds the validated configuration and the plan files used during terraform apply.
⬜ It is where Terraform saves the local state file and its backups by default.
⬜ It holds Terraform’s local working data, such as the installed providers and modules and the backend metadata.
⬜ It caches provider credentials and sensitive variables used for authentication.

Which of the following create a dependency on a provider in Terraform? (select three)

⬜ Declaring the provider in required_providers or adding a provider block for it
⬜ Having provider plugins present somewhere in the working directory
⬜ Using a resource or data block that belongs to that provider
⬜ Adding the provider’s documentation URL as a comment in the code
⬜ Having resource instances for that provider already recorded in the current state

Why should you set version constraints for the providers in your Terraform configuration?

⬜ To make the provider version match the Terraform version you are running
⬜ Because providers are released on their own schedule, separate from Terraform, so a newer provider version could bring breaking changes
⬜ To remove older versions of the provider from the machine
⬜ To match the version number of the application you deploy with Terraform

Which statements about provider configurations and modules are true? (select three)

⬜ Every child module must define its own provider blocks so it stays isolated.
⬜ A child module automatically inherits the default provider configurations of its parent module.
⬜ A module that contains provider blocks can still use depends_on, as long as the providers are passed explicitly.
⬜ A module that contains its own provider blocks can’t be called with for_each.
⬜ The providers argument of a module block passes specific provider configurations to the module explicitly.

You run terraform plan in a workspace that already manages infrastructure, and the plan shows 3 resources to update, 2 to create and 1 to destroy. How does Terraform work out which changes are needed?

⬜ It discovers every resource in the cloud account through the provider APIs and compares them with the configuration.
⬜ It reads the previous saved plan and re-applies whatever wasn’t completed.
⬜ It compares the desired state in the configuration with the current state recorded in the state file (refreshed as needed) and builds the plan from the differences.
⬜ It relies on the cloud provider’s own services to find resources that have drifted.

A project currently uses version 6.0.2 of the hashicorp/aws provider, and its constraint is ~> 6.0.0. Versions 6.0.5 and 6.1.0 have since been released. What does terraform init -upgrade do?

⬜ It keeps 6.0.2, because the constraint doesn’t apply to newer versions.
⬜ It installs the newest version allowed by ~> 6.0.0, which is 6.0.5.
⬜ It installs 6.1.0, the newest hashicorp/aws version, using the ~> 6.0.0 constraint.
⬜ It fails, because a provider version is already installed.

You run terraform apply on a large configuration, and a few resources fail during creation because a provisioner returns an error. What happens to the resources that were created successfully?

⬜ They stay deployed as they are, and the resources whose provisioning failed are marked as tainted.
⬜ Terraform rolls the whole apply back because of the error, so they are destroyed automatically.
⬜ They are marked for replacement.
⬜ Terraform deletes them on the next run.

Your configuration defines resources to deploy on VMware, but there is no state file yet. You have already run terraform init successfully. What happens when you run terraform apply?

⬜ Nothing is created on VMware, because the configuration has no state file.
⬜ Terraform returns an error, because there is no state file.
⬜ Terraform creates the resources in the configuration and writes a new state file.
⬜ Terraform deletes all existing VMware infrastructure and then creates the configured resources.

Which statements describe key benefits that Terraform providers give users? (select three)

⬜ They wrap the target platform’s API in a consistent schema of resources and data sources with a standard lifecycle.
⬜ They store, encrypt and lock state files across remote backends and workspaces.
⬜ They let one workflow manage resources on many platforms, by plugging in different providers.
⬜ They extend Terraform through a plugin model, so new services and features can ship without changing Terraform Core.

Where can Terraform install providers from? (select four)

⬜ The public Terraform Registry
⬜ The provider’s source code repository
⬜ A local filesystem mirror or a network mirror
⬜ The HCP Terraform private registry
⬜ A third-party (non-HashiCorp) registry that needs extra credentials

Your AWS provider is configured as below, so the provider block sets the region to us-west-2, while the AWS_REGION environment variable is set to eu-west-1. Which region does the provider use during terraform plan?

provider "aws" {
  region = "us-west-2"
  default_tags {
    tags = {
      Project = "Project-502"
    }
  }
}

⬜ eu-west-1, from the environment variable
⬜ Terraform returns an error because the settings conflict
⬜ us-west-2, from the provider block
⬜ The default region from the AWS credentials

A teammate deleted an EC2 instance that Terraform manages directly in the AWS console. What happens when you run terraform plan?

⬜ Terraform quietly removes the instance from the state file.
⬜ Terraform fails with an error that the resource can’t be found.
⬜ Terraform ignores the missing instance and reports no changes.
⬜ Terraform detects that the instance is gone and plans to create it again.

You use version 4.50.0 of the azurerm provider. To create some resources supported only in a newer release, you add the resource blocks and change required_providers to version = "4.53.0". What happens when you run terraform plan?

⬜ Terraform downloads 4.53.0 and plans the new resources.
⬜ Terraform reports an error and tells you to run terraform init -upgrade.
⬜ Terraform keeps using 4.50.0 and plans the new resources.
⬜ Terraform deletes the lock file and creates a new one with 4.53.0.

In special cases, Terraform can deploy and manage resources without any state.

⬜ True
⬜ False

Your configuration has two aws provider blocks: one with no alias set to us-east-1, and one with alias = "west" set to us-west-2. An aws_instance resource doesn’t set the provider argument. Which provider configuration does Terraform use for it?

⬜ The default aws provider configuration, the one without an alias (us-east-1).
⬜ The aliased aws.west configuration, because it is declared last.
⬜ Terraform reports an error, because the resource must choose a provider explicitly.
⬜ Terraform asks you to choose a provider configuration during terraform plan.

Which statements about the required_providers block and the provider block are correct? (select three)

⬜ required_providers is nested inside the top-level terraform block.
⬜ required_providers declares each provider’s source address and version constraint.
⬜ A provider block is a top-level block that holds provider settings, such as the region, and can set an alias.
⬜ A provider block is the place to set a provider’s version constraint in current Terraform versions.
⬜ required_providers is a top-level block that holds the provider’s credentials.

You remove every resource block from your configuration, but the state file still tracks several resources. What happens when you run terraform apply?

⬜ Nothing changes, because there are no resources in the configuration to apply.
⬜ Terraform reports an error, because the configuration has no resources.
⬜ Terraform plans to destroy every resource tracked in the state and, once you approve, destroys them.
⬜ Terraform removes the resources from the state but leaves the real infrastructure running.

Area 3: Core Terraform Workflow

How are the Core Terrform Workflow steps played out by an Individual Practitioner?

⬜ Plan, Write, Apply
⬜ Write, Plan, Apply
⬜ Apply, Write, Plan
⬜ Apply, Plan, Write

*What is the workflow for deploying new infrastructure with Terraform?

⬜ Terraform plan to import the current infrastructure to the state file, make code changes, and terraform apply to update the infrastructure.
⬜ Write a Terraform configuration, run terraform show to view proposed changes, and terraform apply to create new infrastructure.
⬜ Terraform import to import the current infrastructure to the state file, make code changes, and terraform apply to update the infrastructure.
⬜ Write a Terraform configuration, run terraform init, run terraform plan to view planned infrastructure changes, and terraform apply to create new infrastructure.

Terraform binary is available to download and install on different operating systems and platforms. Which of the following operating systems are supported?

⬜ macOS
⬜ Solaris
⬜ FreeBSD
⬜ Windows
⬜ All of the above

Which Terraform files should be excluded from Git commit by adding them in .gitingnore file? (select two)

⬜ output.tf
⬜ terraform.tfstate
⬜ terraform.tfvars
⬜ variables.tf

How many Indent spaces are required at each nested level in the Terraform language style convention?

⬜ 1
⬜ 2
⬜ 3
⬜ 4

*Before you can use a new backend or HCP Terraform integration, you must first execute terraform init.

⬜ True
⬜ False

*terraform init retrieves and caches the configuration for all remote modules.

⬜ True
⬜ False

When should you run terraform init?

⬜ Every time you run terraform apply
⬜ Before you start coding a new Terraform project
⬜ After you run terraform plan for the first time in a new Terraform project and before you run terraform apply
⬜ After you start coding a new Terraform project and before you run terraform plan for the first time

*You have just developed a new Terraform configuration for two virtual machines with a cloud provider. You would like to create the infrastructure for the first time. Which Terraform command should you run first?

⬜ terraform apply
⬜ terraform show
⬜ terraform plan
⬜ terraform init

What command does Terraform require the first time you run it within a configuration directory?

⬜ terraform import
⬜ terraform init
⬜ terraform plan
⬜ terraform workspace

Which command need to run before Terraform plan or apply if you have added a new resource block in the configuration from different provider?

⬜ terraform refresh
⬜ terraform eval
⬜ terraform init
⬜ terraform validate

How can you check out the configuration from version control and initialize a directory?

⬜ terraform init -from-module={MODULE-SOURCE}
⬜ terraform init -source={PATH}
⬜ terraform init {PATH}
⬜ terraform init -plugin-dir={PATH}

*As a developer, you want to ensure your plugins are up-to-date with the latest versions. Which Terraform command should you use?

⬜ terraform refresh -upgrade
⬜ terraform apply -upgrade
⬜ terraform providers -upgrade
⬜ terraform init -upgrade

Whenever you add a new module to a configuration, Terraform must install the module before it can be used. Which two commands will install and update modules? (select two)

⬜ terraform plan
⬜ terraform refresh
⬜ terraform init
⬜ terraform get

Which command is used to create an execution plan in Terraform?

⬜ terraform plan
⬜ terraform apply
⬜ terraform init
⬜ terraform validate

By default, when running terraform plan, what files are scanned?

⬜ All *.tf files in the current directory.
⬜ Only files in the .terraform directory
⬜ Only files you specify with the -file-path flag.
⬜ All files on your hard drive.

*What happens when you execute terraform plan?

⬜ Imports all of your existing cloud provider resources to the state
⬜ Compares your Terraform code and local state file to the remote state file in a cloud provider and determines if any changes need to be made
⬜ Installs all providers and modules referenced by configuration
⬜ Refreshes your state, then compares your state file to your Terraform configuration and creates an execution plan if changes need to be made

*How can terraform plan aid in the development process?

⬜ Initializes your working directory containing your Terraform configuration files
⬜ Validates your expectations against the execution plan without permanently modifying state
⬜ Formats your Terraform configuration files
⬜ Reconciles Terraform’s state against deployed resources and permanently modifies state using the current status of deployed resources

Which command is used to apply changes to infrastructure in Terraform?

⬜ terraform destroy
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Which command is used to destroy infrastructure in Terraform?

⬜ terraform destroy
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Which Terraform command can be used to delete all of your managed infrastructure? (select two)

⬜ terraform init -destroy
⬜ terraform apply -destroy
⬜ terraform destroy
⬜ terraform plan -destroy

If different teams are working on the same configuration. How do you make files to have consistent formatting?

⬜ terraform fmt
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Which of these commands makes your code more human-readable?

⬜ terraform validate
⬜ terraform output
⬜ terraform show
⬜ ``terraform fmt`

What Terraform command modifies a HashiCorp Configuration Language (HCL) file to adhere to the recommended spacing rules for HCL files?

⬜ terraform fmt
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Your teammate is worried that if they run the terraform fmt command on their current directory, it will change their configuration files too much. What flag do you tell them to pass into the command such that they can see the differences?

⬜ -diff
⬜ -check
⬜ -refresh
⬜ -list=True

Your organization want to ensure that all Terraform configuration files follows the Terraform language format and style convention. You have main.tf in the current directory, which calls modules stored in module directory. Which command can be used to format all the configuration files in the current directory and all subdirectories?

⬜ terraform fmt -check -recursive
⬜ terraform fmt -diff
⬜ terraform fmt -check
⬜ terraform fmt -list=True

*Which Terraform command checks that your configuration syntax is correct?

⬜ terraform validate
⬜ terraform show
⬜ terraform init
⬜ terraform fmt

How would you get the JSON output of the terraform validate command?

⬜ terraform validate -json
⬜ terraform validate json
⬜ terraform validate -output=json
⬜ terraform json validate

Does the terraform validate command connect to remote APIs and state when being ran?

⬜ No it does not.
⬜ Only if configured to do so on the backend.
⬜ If the -remote=True is set, yes it does.
⬜ If there are providers set, it will attempt to.

Which command provides an interactive command-line console for evaluating and experimenting with expressions?

⬜ terraform show
⬜ terraform eval
⬜ terraform console
⬜ terraform exec

Which command is used to extract the value of an output variable from the state file?

⬜ terraform exec
⬜ terraform show
⬜ terraform output
⬜ terraform state

You have defined the values for your variables in the file terraform.tfvars, and saved it in the same directory as your Terraform configuration. Which of the following commands will use those values when creating an execution plan?

⬜ terraform plan
⬜ terraform plan -var-file=terraform.tfvars
⬜ All of the above
⬜ None of the above

*Which two steps are required to provision new infrastructure in the Terraform workflow? (Choose Two.)

⬜ terraform init
⬜ terraform import
⬜ terraform apply
⬜ terraform validate
⬜ terraform destroy

It is necessary to run terraform plan command before terraform apply in the Terraform Workflow.

⬜ True
⬜ False

What happens when you apply Terraform configuration? (Choose Two.)

⬜ Terraform makes any infrastructure changes defined in your configuration.
⬜ Terraform gets the plugins that the configuration requires.
⬜ Terraform updates the state file with any configuration changes it made.
⬜ Terraform corrects formatting errors in your configuration.
⬜ Terraform destroys and recreates all your infrastructure from scratch.

Which flag is used to find more information about a Terraform command? For example, you need additional information about how to use the plan command. You would type: terraform plan _____.

⬜ -help
⬜ -info
⬜ -describe
⬜ -usage

Which flag would you add to terraform plan to save the execution plan to a file? You would type: terraform plan _____

⬜ -out=FILENAME
⬜ -save=FILENAME
⬜ -plan=FILENAME
⬜ -file=FILENAME

You just added a new set of resources to your configuration and would only like to see them when you run your terraform plan command. What flag do you specify when running the terraform plan command to only see their plans?

⬜ -target={resources}
⬜ -refresh=True
⬜ -state={new_state_file}
⬜ -lock=True

You have a simple Terraform configuration containing one virtual machine (VM) in a cloud provider. You run terraform apply and the VM is created successfully. What will happen if you delete the VM using the cloud provider console, and run terraform apply again without changing any Terraform code?

⬜ Terraform will remove the VM from state file
⬜ Terraform will report an error
⬜ Terraform will not make any changes
⬜ Terraform will recreate the VM

You have a simple Terraform configuration containing one virtual machine (VM) in a cloud provider. You run terraform apply and the VM is created successfully. What will happen if you run terraform apply again immediately afterwards without changing any Terraform code?

⬜ Terraform will terminate and recreate the VM
⬜ Terraform will create another duplicate VM
⬜ Terraform will apply the VM to the state file
⬜ Nothing

You have a Terraform configuration that defines a single virtual machine with no references to it. You have run terraform apply to create the resource, and then removed the resource definition from your Terraform configuration file. What will happen when you run terraform apply in the working directory again?

⬜ Nothing
⬜ Terraform will destroy the virtual machine
⬜ Terraform will error
⬜ Terraform will remove the virtual machine from the state file, but the resource will still exist

You have multiple team members collaborating on infrastructure as code (IaC) using Terraform, and want to apply formatting standards for readability.How can you format Terraform HCL (HashiCorp Configuration Language) code according to standard Terraform style convention?

⬜ Run the terraform fmt command during the code linting phase of your CI/CD process
⬜ Designate one person in each team to review and format everyone’s code
⬜ Manually apply two spaces indentation and align equal sign “=” characters in every Terraform file ( .tf)
⬜ Write a shell script to transform Terraform files using tools such as AWK, Python, and sed

Terraform uses parallelism to walk through the dependency graph during terraform apply to provision the resources. What is the default value of parallelism?

⬜ 100
⬜ 10
⬜ 5
⬜ 1

Say you wanted to increase the number of operations that terraform is concurrently using to create your resources. Which command would you run, with what specific flag, to accomplish this? (Choose 2 answers)

⬜ terraform apply
⬜ -parallelism={NUMBER-OF-OPERATIONS}
⬜ terraform init
⬜ -concurrent={NUMBER-OF-OPERATIONS}

Lately you noticed that your Terraform jobs are failing in your CI/CD pipeline. The error that is coming back mentions something about hitting a rate limit. Without altering the time that the builds are ran, what could you pass into the terraform apply command to slow your operations down?

⬜ -parallelism={NUMBER_OF_OPERATIONS}
⬜ -concurrent={NUMBER_OF_OPERATIONS}
⬜ -rate-limit={NUMBER_OF_OPERATIONS}
⬜ -refresh=False

Your repository has three folders, /dev, /staging and /prod, and each folder holds a separate Terraform configuration for that environment. Where must you run terraform init before deploying?

⬜ Only in the repository root, which initializes every environment at once
⬜ In each of /dev, /staging and /prod, because each is its own working directory
⬜ Only in /prod, because dev and staging can share its initialization
⬜ In any one folder, then copy its .terraform folder into the other two

What does Terraform use its dependency graph for?

⬜ Running resources in the order the .tf files appear, so runs are predictable
⬜ Working out the dependencies between objects so it can perform create, update and destroy operations in the right order
⬜ Sorting resources by type and name to draw a picture used only for create operations
⬜ Letting each provider decide the ordering, relying on the cloud APIs to handle dependencies

You split a large module into several .tf files and moved some resource blocks around, without changing any arguments or references. What will terraform plan show?

⬜ No changes, because block order doesn’t matter: Terraform reads all .tf files in a module together.
⬜ A few changes, because Terraform plans resources in the order it reads the files.
⬜ Many changes, because Terraform tracks which file each resource lives in and moving it forces a replacement.
⬜ Some changes, because providers decide the order from where the blocks appear in the configuration.

Your change process requires every Terraform change to be reviewed before it runs. You run terraform plan -out=bk-project.tfplan and share it for review, and approval arrives two hours later. Which command applies exactly the changes that were approved?

⬜ terraform apply, because Terraform automatically uses the last plan it created
⬜ terraform plan again to check for drift, followed by terraform apply
⬜ terraform apply bk-project.tfplan, which runs the saved plan
⬜ terraform apply -auto-approve, which skips the confirmation prompt

By default, terraform destroy asks you to confirm before it destroys anything.

⬜ True
⬜ False

Your Google Cloud project has 50 Terraform-managed resources across several services. You need to decommission only the Cloud SQL instance and its backup policy and keep everything else running. What is the most appropriate approach?

⬜ Run terraform destroy for everything, then terraform apply to recreate everything except the database.
⬜ Delete the database and backup resource blocks from the configuration, then run terraform apply.
⬜ Run terraform destroy -target=google_sql_database_instance.main -target=google_sql_backup_run.policy.
⬜ Replace the two resource blocks with removed blocks that set lifecycle { destroy = false }.

Which of these does terraform init do? (select three)

⬜ Downloads the modules referenced in the configuration
⬜ Creates the resources declared in the configuration
⬜ Initializes the backend configuration
⬜ Downloads the providers (plugins) needed to run the configuration

In the output of terraform plan, one resource has a tilde (~) next to it. What does that mean?

⬜ The resource will be destroyed and created again.
⬜ The resource will be created.
⬜ The resource will be updated in place.
⬜ Terraform can’t decide what to do because of a problem with the state file.

Your terraform plan shows 4 resources marked -/+, meaning they will be destroyed and recreated. What should you do before running terraform apply? (select two)

⬜ Check which resources are being replaced and understand why Terraform must replace them.
⬜ Run terraform init -upgrade to get the newest provider versions.
⬜ Check whether replacing them will cause downtime or data loss.
⬜ Run terraform validate to confirm the plan is correct.
⬜ Go ahead and apply, because the plan has already validated the configuration.

Which problem will terraform validate report?

⬜ The arguments in a resource block aren’t aligned with spaces.
⬜ A resource block uses a variable that hasn’t been declared.
⬜ The managed infrastructure has drifted from the configuration.
⬜ There is no state file for the configuration yet.

You run terraform destroy to remove the three test VMs on a new cluster, but Terraform removes only two of them and one keeps running. Why?

⬜ The remaining VM has vSphere tags that protect it from deletion.
⬜ terraform destroy can delete at most two resources per run.
⬜ The remaining VM wasn’t created by Terraform, so Terraform doesn’t know about it and can’t destroy it.
⬜ The vSphere credentials are invalid, so Terraform can’t reach the third VM.

A workspace manages the Azure resources below, and you run terraform destroy. In which order does Terraform destroy them?

resource "azurerm_resource_group" "main" {
  name     = "production-bk"
  location = "East US"
}

resource "azurerm_virtual_network" "main" {
  name                = "prod-bk-vnet"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  address_space       = ["172.16.0.0/16"]
}

resource "azurerm_subnet" "main" {
  name                 = "prod-bk-subnet"
  resource_group_name  = azurerm_resource_group.main.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["172.16.67.0/24"]
}

⬜ In the order they appear in the configuration: resource group, virtual network, subnet
⬜ All three at the same time, because of Terraform’s default parallelism
⬜ Along the dependency chain in reverse: subnet, virtual network, resource group
⬜ Alphabetically by resource type: virtual network, subnet, resource group

Last night a colleague changed a security group in the AWS console to allow emergency access. This morning you run terraform plan without changing any configuration files. What does the plan show?

⬜ The security group needs updating to undo the manual change and match your configuration.
⬜ The security group needs updating to match its current settings in AWS.
⬜ An error saying the state is out of sync and must be refreshed by hand first.
⬜ No changes, because Terraform only looks at the configuration files.

Running terraform fmt modifies the configuration files in the current directory and in all of its subdirectories.

⬜ True
⬜ False

Your teammate runs terraform plan and shares output showing 15 resources to create, and you approve it. Before applying, your teammate runs terraform plan again. What happens?

⬜ Terraform runs the earlier plan, because it was created first.
⬜ Terraform creates a new plan, which may differ from the first one if the state, the infrastructure or the configuration changed in between.
⬜ Terraform skips planning, because a plan was just created.
⬜ Terraform reports an error that a plan already exists and must be applied first.

Your team pinned the AWS provider to version = "6.0.0", installed from the public Terraform Registry. A critical security fix is released in 6.0.3, so you change the constraint to version = "~> 6.0.0" and run terraform init. Why does Terraform still use 6.0.0?

⬜ The dependency lock file still records 6.0.0, and terraform init without -upgrade keeps the locked version.
⬜ A ~> constraint doesn’t allow patch updates for providers from the public Registry.
⬜ You didn’t delete the .terraform directory first, so Terraform reused the provider already downloaded.
⬜ Public Registry providers don’t update automatically, even with new constraints, because they need manual approval.

During a terraform apply that creates 10 resources, your network connection drops after 6 have been created. When the connection returns, you run terraform plan. What does the plan show?

⬜ All 10 resources, because a failed apply rolls back the whole state.
⬜ Only the resources that weren’t created successfully, because Terraform recorded the 6 created resources in the state as it went.
⬜ No changes, because Terraform marks the apply as complete.
⬜ An error, until you delete the state file and start again.

After terraform destroy finishes successfully, what happens to the state file?

⬜ Terraform deletes the state file.
⬜ The state file remains, but no longer contains any resources.
⬜ The state file keeps the destroyed resources, marked as deleted.
⬜ The state file is renamed to terraform.tfstate.destroyed.

Area 4: Terraform Configuration

Which file is typically used to define resources in a Terraform configuration?

⬜ main.tf
⬜ terraform.tfvars
⬜ variables.tf
⬜ outputs.tf

What is the type of the block in below Terraform configuration?

resource "aws_instance" "example" {
  ami           = "abc123"
  instance_type = "t2.micro"
}

⬜ resource
⬜ aws_instance
⬜ t2.micro
⬜ instance_type

Which of the following is NOT a valid Terraform block type?

⬜ provider
⬜ resource
⬜ output
⬜ module
⬜ data
⬜ bucket

Terraform configuration can be written in which language? (select two)

⬜ XML
⬜ JSON
⬜ Hashicorp Configuration Language (HCL)
⬜ YAML

Terraform language is widely expressed in Hashicorp Configuration Language (HCL) syntax. Which other syntax is supported?

⬜ XML
⬜ JSON
⬜ YAML
⬜ Protobuf

Which of the statements accurately describes the Terraform language? (select two)

⬜ Terraform is declarative Infrastructure as Code provisioning language based on Hashicorp Configuration Language, or optionally YAML.
⬜ Terraform is declarative Infrastructure as Code provisioning language based on Hashicorp Configuration Language, or optionally JSON.
⬜ Code in the Terraform language is stored in plain text files with the .tf file extension, or optionally with the .tf.json file extension
⬜ Code in the Terraform language is stored in plain text files with the .tf file extension, or optionally with the .tf.yml file extension

You want to deploy multiple subnets within a VPC in AWS and looking for a for loop-like expression to iterate over a list of subnet CIDR blocks. Which feature of Terraform configuration you can use?

⬜ terraform import
⬜ dynamic blocks
⬜ splat expression
⬜ dynamic backend

How do you describe a dynamic block?

⬜ It requests that Terraform read from a given data source and export the result under the given local name
⬜ It declares a resource of a given type with a given local name
⬜ It iterates over a given complex value, and generates a nested block for each element of that complex value
⬜ It exports a value exported by a module or configuration

*What is one disadvantage of using dynamic blocks in Terraform?

⬜ Dynamic blocks can construct repeatable nested blocks.
⬜ Terraform will run more slowly.
⬜ They cannot be used to loop through a list of values.
⬜ They make configuration harder to read and understand.

Terraform builds a dependency graph from the Terraform configurations. Which is NOT a correct step of building a Graph?

⬜ Resources are mapped to provisioners if they have any defined.
⬜ Resources are mapped to providers.
⬜ Resources nodes are added to the graph from the configuration.
⬜ Resources are not added to the graph that are no longer present in the configuration but are present in the state file.

Which type of block fetches or computes information for use elsewhere in a Terraform configuration?

⬜ provider
⬜ resource
⬜ local
⬜ data

How does Terraform manage most dependencies between resources?

⬜ Terraform will automatically manage most resource dependencies
⬜ Using the depends_on parameter
⬜ By defining dependencies as modules and including them in a particular order
⬜ The order that resources appear in Terraform configuration indicates dependencies

*What is the provider for the resource shown in the Exhibit?

resource "aws_vpc" "main" {
    name = "test"
}

⬜ VPC
⬜ main
⬜ aws
⬜ test

*A resource block is shown in the Exhibit space. What is the Terraform resource name of that resource block?

resource "azurerm_resource_group" "dev" {
  name     = "test"
  location = "westus"
}

⬜ azurerm_resource_group
⬜ dev
⬜ test
⬜ azurerm

*A resource block is shown in the Exhibit space. What is the Terraform resource name of the resource block?

resource "google_compute_instance" "main" {
  name = "test"
}

⬜ test
⬜ main
⬜ compute_instance
⬜ google

Which of the following is an implicit dependency in the below example?

resource "aws_s3_bucket" "financial_report" { }

resource "aws_instance" "banking_service" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t2.micro"
  depends_on    = [aws_s3_bucket.financial_report]
}

⬜ S3 Bucket financial_report
⬜ EC2 Instance Type t2.micro
⬜ AMI amazon_linux
⬜ EC2 Instance banking_service

Which type of dependency is created in the below example using depends_on argument?

resource "aws_s3_bucket" "financial_report" { }

resource "aws_instance" "banking_service" {
  ami           = data.aws_ami.amazon_linux.id
  instance_type = "t2.micro"
  depends_on    = [aws_s3_bucket.financial_report]
}

module "example_sqs_queue" {
  source        = "terraform-aws-modules/sqs/aws"
  version       = "3.3.0"
  depends_on    = [aws_s3_bucket.financial_report, aws_instance.banking_service]
}

⬜ internal dependency
⬜ implicit dependency
⬜ external dependency
⬜ explicit dependency

What is the syntax to correctly reference a data source?

⬜ data.<DATA TYPE>.<NAME>
⬜ data.<NAME>
⬜ data.<NAME>.<DATA TYPE>
⬜ <DATA TYPE>.<NAME>.data

Examine the following Terraform configuration, which uses the data source for an AWS AMI. What value should you enter for the ami argument in the AWS instance resource?

data "aws_ami" "ubuntu" {
  ...
}

resource "aws_instance" "web" {
  ami           = _____________
  instance_type = "t3.micro"
}

⬜ aws_ami.ubuntu
⬜ data.aws_ami.ubuntu
⬜ data.aws_ami.ubuntu.id
⬜ aws_ami.ubuntu.id

How could you reference an attribute from the vsphere_datacenter data source for use with the datacenter_id argument within the vsphere_folder resource in the following configuration?

data "vsphere_datacenter" "dc" {}

resource "vsphere_folder" "parent" {
  path          = "Production"
  type          = "vm"
  datacenter_id = ____________
}

⬜ data.vsphere_datacenter.dc.id
⬜ vsphere_datacenter.dc.id
⬜ data.dc.id
⬜ data.vsphere_datacenter.dc

What’s the correct syntax for referencing a resource within the configuration file?

⬜ <RESOURCE TYPE>.<NAME>
⬜ <NAME>.<RESOURCE TYPE>
⬜ <PROVIDER>.<RESOURCE TYPE>
⬜ <LOCAL/REMOTE STATE>.<RESOURCE TYPE>

*A resource block is shown in the Exhibit. How would you reference the attribute name of this resource in HCL?

resource "kubernetes_namespace" "example" {
  name = "test"
}

⬜ resource.kubernetes_namespace.example.name
⬜ kubernetes_namespace.test.name
⬜ kubernetes_namespace.example.name
⬜ data.kubernetes_namespace.name

You want to use the terraform state show to see the attributes of a single resource created by the for_each in below resource block. What resource address should be used for the instance related to vault?

resource "aws_instance" "demo" {
  # ...
  for_each = {
    "terraform": "infrastructure",
    "vault":     "security",
    "consul":    "connectivity",
    "nomad":     "scheduler",
  }
}

⬜ aws_instance.demo[1]
⬜ aws_instance.demo["2"]
⬜ aws_instance.demo.vault
⬜ aws_instance.demo["vault"]

*A configuration block is shown in the Exhibit. How would you reference the volume IDs associated with the ebs_block_device blocks in this configuration?

resource "aws_instance" "example" {
  ami           = "ami-abc123"
  instance_type = "t2.micro"

  ebs_block_device {
    device_name = "sda2"
    volume_size = 16
  }
  ebs_block_device {
    device_name = "sda3"
    volume_size = 20
  }
}

⬜ aws_instance.example.ebs_block_device.volume_ids
⬜ aws_instance.example.ebs_block_device[*].volume_id
⬜ aws_instance.example.ebs_block_device.*.volume_id
⬜ aws_instance.example.ebs_block_device[sda2, sda3].volume_id

Terraform can only manage resource dependencies if you set them explicitly with the depends_on argument.

⬜ True
⬜ False

How can you set the value to a variable “region” declared in the configuration file?

⬜ Using command line terraform apply -var="region=us-east-1"
⬜ Using variable file terraform apply -var-file="variables.tfvars" where the file contains: region=us-east-1
⬜ Using environment variable export TF_VAR_region=us-east-1
⬜ All of the above

Which one of the following takes higher precedence in loading variable in Terraform?

⬜ Command line flag - terraform apply -var="region=us-east-1"
⬜ Configuration file - set in your terraform.tfvars file
⬜ Environment variable - export TF_VAR_region=us-east-1
⬜ Default Config - default value in variables.tf

Which of the following is an invalid argument for defining input variable in Terraform?

⬜ default
⬜ type
⬜ description
⬜ validation
⬜ sensitive
⬜ nullable
⬜ depends_on

How would you configure your input variable to fallback to a pre-declared value in your variable block?

⬜ By specifying the default meta-argument.
⬜ By specifying the fallback meta-argument.
⬜ Terraform has a list of fallbacks that it will always implement if nothing is specified. E.g. aws_instance will fall back to a t2.micro if the size is not specifed.
⬜ Terraform will ask you to set a fallback when you run the terraform apply command.

You defined a variable and would like to reference it in your terraform configuration file. What is the syntax required to do so?

⬜ var.<VARIABLE_NAME>
⬜ <VARIABLE_NAME>.var
⬜ var.<VARIABLE_NAME>.<RESOURCE_NAME>
⬜ <RESOURCE_NAME>.var.<VARIABLE_NAME>

Consider the following configuration snippet: How would you define the cidr_block for us-east-1 in the aws_vpc resource using a variable?

variable "vpc_cidrs" {
  type = map
  default = {
    us-east-1 = "10.0.0.0/16"
    us-east-2 = "10.1.0.0/16"
    us-west-1 = "10.2.0.0/16"
    us-west-2 = "10.3.0.0/16"
  }
}

resource "aws_vpc" "shared" {
  cidr_block = _____________
}

⬜ var.vpc_cidrs["us-east-1"]
⬜ var.vpc_cidrs.0
⬜ vpc_cidrs["us-east-1"]
⬜ var.vpc_cidrs[0]

A new variable fruits has been created of type list as shown below. How would you reference banana in your configuration?

variable "fruits" {
    type = list(string)
    default = [
        "mango",
        "apple",
        "banana",
        "orange",
        "grapes"
    ]
}

⬜ var.fruits[2]
⬜ var.fruits.banana
⬜ var.list.fruits[2]
⬜ var.fruits[3]

A Terraform local value can reference other Terraform local values?

⬜ True
⬜ False

When are output variables ran and sent to stdout?

⬜ Only with terraform apply.
⬜ Only on terraform plan or apply.
⬜ With any terraform command.
⬜ Only if you specify the -outputs flag on apply.

*Which of the following arguments are required when declaring a Terraform output?

⬜ value
⬜ description
⬜ default
⬜ sensitive

Environment variable <?>_region=us-west-1 can be used to set the value of region input variable. What is <?> here?

⬜ TF_VAR
⬜ TF_ENV
⬜ TF_VAL
⬜ TF_VARIABLE

You have a Terraform variable that is declared as follows:

variable "num" {
 default = 3
}

You have also defined the following environment variables in your BASH shell:-

export TF_VAR_num=10

You also have a terraform.tfvars file with the following contents:-

num = 7

When you run the following apply command, what is the value assigned to the num variable?

terraform apply -var num=4

⬜ 4
⬜ 7
⬜ 3
⬜ 10

Which of the following is a valid variable name in Terraform?

⬜ 1234
⬜ 1_aws_vpc
⬜ invalid
⬜ count

What are Data Sources in terraform?

⬜ Data to be fetched or computed for use elsewhere in terraform configuration.
⬜ Similar to resources, they specify data to be created in the corresponding provider.
⬜ A binary set of operators that tell resources how to behave with certain meta-arguments.
⬜ Data sources are a way for terraform to keep track of all resources created in the provider’s infrastructure.

*In Terraform HCL, an object type of object({ name = string, age = number }) would match which of these values?

⬜

{
  name = "John"
  age  = 52
}

⬜

{
  name = John
  age  = "52"
}

⬜

{
  name = "John"
  age  = fifty two
}

⬜

{
  name = John
  age  = fifty two
}

You are adding input variables in the Terraform module for customization. Which of the following is NOT a valid primitive variable type in Terraform?

⬜ string
⬜ number
⬜ float
⬜ bool

What are two complex types in terraform? (Choose 2 answers)

⬜ A Collection Type
⬜ A Structural Type
⬜ A String Type
⬜ A float64 type

What are complex types in terraform?

⬜ A type that groups multiple values into a single value.
⬜ A variation of a string type.
⬜ A variance of a data source.
⬜ A type that derives its value from RegEx logic.

If an input variable has no type value set, what type does it accept?

⬜ Any type.
⬜ None, it has to have a type value set.
⬜ Terraform infers the type when it is referenced.
⬜ Type string. As strings can be interpreted in a number of ways by Terraform.

Which of the following is not a valid Terraform Collection type?

⬜ list
⬜ map
⬜ tree
⬜ set

Which of the followings are valid Terraform Structural types? (Choose 2 answers)

⬜ optional
⬜ object
⬜ pair
⬜ tuple

What are the similar kind of complex types in Terraform? (select three)

⬜ list
⬜ map
⬜ set
⬜ tuple

You want to define a single input variable to store information about servers mainly server-name of type string and memory-size of type number. Which variable type should you choose?

⬜ list
⬜ map
⬜ object
⬜ set

Which Terraform collection type should you use to store key/value pairs?

⬜ list
⬜ tuple
⬜ map
⬜ set

Which of the following is not a valid string function in Terraform?

⬜ split()
⬜ join()
⬜ slice()
⬜ chomp()

What are some built-in functions that terraform provides? (Choose 3 answers)

⬜ max()
⬜ regex()
⬜ alltrue()
⬜ delete()

*You’re writing a Terraform configuration that needs to read input from a local file called id_rsa.pub. Which built-in Terraform function can you use to import the file’s contents as a string?

⬜ file("id_rsa.pub")
⬜ templaTefil("id_rsa.pub")
⬜ filebase64("id_rsa.pub")
⬜ fileset("id_rsa.pub")

Provisioners add a considerable amount of complexity and uncertainty to Terraform usage and should be used as a last resort. True or False?

⬜ True
⬜ False

You want to execute a script on the provisioned AWS instance. You can add a provisioner block inside which block type to achieve this?

⬜ terraform block
⬜ data block
⬜ provider block
⬜ resource block

Which option will you use to run provisioners that are not associated with any real infrastructure resource?

⬜ terraform_data resource
⬜ file
⬜ local-exec
⬜ remote-exec

Which provisioner copies files or directories from the machine running Terraform to the newly created resource?

⬜ null_resource
⬜ file
⬜ local-exec
⬜ remote-exec

Which type of connections supported by file provisioner? Select all valid options.

⬜ ssh
⬜ sftp
⬜ winrm
⬜ rdc

Which provisioner invokes a process on the machine running Terraform, not on the resource?

⬜ null_resource
⬜ file
⬜ local-exec
⬜ remote-exec

Where does the ’local-exec’ provisioner execute its code provided in its block?

⬜ On the remote resource specified.
⬜ On the local machine running terraform.
⬜ On a spot-instance on your cloud provider.
⬜ In a container on your machine provided by the Terraform binary.

Which provisioner invokes a process on the resource created by Terraform?

⬜ null_resource
⬜ file
⬜ local-exec
⬜ remote-exec

What are the two accepted values for provisioners that have the “on_failure” key specified? (Choose 2 answers)

⬜ continue
⬜ fail
⬜ abort
⬜ retry

What does the following provisioner block specify?

provisioner "local-exec" {
  when    = destroy
  command = "echo 'Destroy-time provisioner'"
}

⬜ Before the resource is destroyed, the provisioner will invoke “echo ‘Destroy-time provisioner’”
⬜ If the resource receives a ‘destroy’ command locally, it will echo ‘Destroy-time provisioner’
⬜ After the resource is destroyed, it will invoke “echo ‘Destroy-time provisioner’”
⬜ On the next ’terraform apply’ the resource will be destroyed

*You want terraform plan to fail with a clear message when someone sets the input variable instance_type to a value outside an approved list. What should you add?

⬜ A validation block with condition and error_message inside the variable "instance_type" block
⬜ A check block with an assert in the root module
⬜ A sensitive = true argument in the variable block
⬜ A postcondition block in the output block

Before Terraform creates an aws_instance, you want to verify that the AMI returned by the data.aws_ami.app data source uses the x86_64 architecture, and stop with an error if it doesn’t. Where do you declare this condition?

⬜ In a precondition block inside the lifecycle block of the aws_instance resource
⬜ In a postcondition block inside the output block
⬜ In a depends_on argument of the aws_instance resource
⬜ In a validation block inside the provider "aws" block

What happens when the assert condition inside a check block evaluates to false during terraform apply?

⬜ Terraform shows a warning and continues the operation
⬜ Terraform shows an error and stops the apply
⬜ Terraform destroys the resources that failed the check
⬜ Terraform rolls back the changes made during the apply

Your security team scanned some Terraform workspaces and found secrets stored in a plaintext in state files. How can you protect sensitive data stored in Terraform state files?

⬜ Delete the state file every time you run Terraform
⬜ Store the state in an encrypted backend
⬜ Edit your state file to scrub out the sensitive data
⬜ Always store your secrets in a secrets.tfvars file.

If you manage any sensitive data with Terraform (like database passwords, user passwords, or private keys), treat the state itself as sensitive data. What is recommended to protect the state file? (select two)

⬜ use the S3 bucket using the encrypt option to ensure state is encrypted
⬜ enable native encryption in Terraform as configured in the terraform block
⬜ use HCP Terraform which always encrypts state at rest
⬜ replicate the state file to an encrypted storage device

*You want to use API tokens and other secrets within your team’s Terraform workspaces. Where does HashiCorp recommend you store these sensitive values? (Pick 3 correct responses)

⬜ In an HCP Terraform variable, with the sensitive option checked
⬜ In HashiCorp Vault
⬜ In a terraform.tfvars file, securely managed and shared with your team
⬜ In a terraform.tfvars file, checked into your version control system
⬜ In a plaintext document on a shared drive

*You set sensitive = true on an output value that returns a database password. What is the effect?

⬜ Terraform redacts the value in CLI output, but still stores it in plain text in the state file
⬜ Terraform encrypts the value in the state file
⬜ Terraform does not store the value in the state file
⬜ Other modules can no longer reference the output value

You need to use a short-lived token during a Terraform run, and the value must never be written to the plan or state files. Which feature should you use? (Terraform 1.10 and later)

⬜ Ephemeral values, e.g. ephemeral = true on a variable or an ephemeral resource block
⬜ sensitive = true on the variable
⬜ A locals block
⬜ nullable = false on the variable

An aws_db_instance resource sets its master password with the password_wo argument, which is a write-only argument. Which statement is true?

⬜ Terraform passes the value to the provider but does not store it in the plan or state, and you change password_wo_version to make Terraform send a new value
⬜ Terraform stores the value encrypted in the state file
⬜ Write-only arguments can only receive hard-coded literal values
⬜ Terraform shows the value in plain text in the plan output

Your configuration reads a database password from HashiCorp Vault using a data source of the vault provider and passes it to a resource. What should you be aware of?

⬜ The secret value is stored in the Terraform state file, so you must protect the state
⬜ The Vault provider encrypts the secret in the state file automatically
⬜ Terraform cannot pass secrets read from Vault to other resources
⬜ The secret is never shown or stored anywhere because it comes from Vault

Which of these variable declarations makes Terraform report a type error before apply?

⬜ variable "instance_count" with type = number and default = 3
⬜ variable "tags" with type = map(string) and default = { Environment = "prod", Owner = "platform-team" }
⬜ variable "names" with type = list(string) and default = {}
⬜ variable "enabled" with type = bool and default = true

A variable holds a list of subnet CIDR blocks, ["10.0.5.0/24", "10.0.0.0/24", "10.0.2.0/24"]. Which function tells you how many subnets the list contains?

⬜ keys(var.subnet_cidrs)
⬜ values(var.subnet_cidrs)
⬜ length(var.subnet_cidrs)
⬜ contains(var.subnet_cidrs)

A variable has the validation block below, and a user sets instance_count = 15. When does Terraform report the validation error?

variable "instance_count" {
  type = number

  validation {
    condition     = var.instance_count > 0 && var.instance_count <= 10
    error_message = "Instance count must be between 1 and 10."
  }
}

⬜ During terraform apply, when it tries to create the instances
⬜ During terraform init, when the configuration is first loaded
⬜ Never, because 15 is a valid value for the number type
⬜ During terraform plan, before Terraform tries to create any resources

A central network team manages all of your company’s Azure virtual networks. Your application team must deploy virtual machines into the prod-network VNet that the network team created. What is the right approach in your configuration?

⬜ Use a resource block to import the existing VNet into your state, then create the VMs.
⬜ Write a new resource block for a VNet with the same name, then create the VMs.
⬜ Use a data block to look up the existing VNet, and build the VM resources from the data source’s attributes.
⬜ Ask the network team to add a depends_on between their VNet and your VMs.

A module creates VMs with the vSphere provider and hard-codes values such as datastore = "DS1", network_label = "VM Network" and folder = "Dev/Apps". The same module must work in the Lab, QA and Prod vCenter environments without editing its code. What is the best change?

⬜ Move the values into locals and keep a separate branch per environment with different locals.
⬜ Turn the hard-coded values into input variables and supply each environment’s values through .tfvars files or variable sets at plan and apply time.
⬜ Add preconditions that fail when the environment is different, so operators must edit the file when switching sites.
⬜ Expose the values as outputs and override them from a second module that runs after the first.

Which default value is valid for a variable declared with type = map(string)?

⬜

default = [
  { environment = "production", owner = "dev-team" },
  { environment = "staging", owner = "qa-team" }
]

⬜

default = {
  "environment" = "production"
  "owner"       = "dev-team"
}

⬜

default = {
  "environment" = "production"
  "tags"        = { team = "dev" }
}

⬜

default [
  "environment" = "production",
  "owner" = "dev-team"
]

How do you reference the build-tag value of the variable below in an expression?

variable "metadata" {
  type = map(string)
  default = {
    owner     = "platform"
    build-tag = "v5.0.2"
    service   = "billing"
  }
}

⬜ var.metadata.build-tag
⬜ var.metadata["build-tag"]
⬜ var["metadata"]["build-tag"]
⬜ lookup(var.metadata, build-tag, "")

Shared tags for all resources are in var.common_tags, and resource-specific tags are in local.resource_tags. Which expression combines both for a resource?

⬜ concat(var.common_tags, local.resource_tags)
⬜ flatten(var.common_tags, local.resource_tags)
⬜ merge(var.common_tags, local.resource_tags)
⬜ join(var.common_tags, local.resource_tags)

A production SQL database holds live data. Changing its pricing tier forces Terraform to destroy and recreate it, and you want the new database created before the old one is destroyed to avoid downtime. What should you add to the resource?

⬜ A lifecycle block with prevent_destroy = true
⬜ A count argument set to 2 so both databases exist
⬜ A depends_on argument that points to the new database
⬜ A lifecycle block with create_before_destroy = true

terraform plan fails with the error below. What stops Terraform from producing a plan?

Planning failed. Terraform encountered an error while generating this plan.

Error: Invalid value for variable

  on variables.tf line 7:
   7: variable "cluster_endpoint" {
    var.cluster_endpoint is ""
    var.create_cluster is false

You must specify a value for cluster_endpoint if create_cluster is false.

⬜ A precondition on a resource that uses cluster_endpoint failed after the plan was computed, so Terraform aborted.
⬜ A validation rule on cluster_endpoint requires a non-empty value when create_cluster is false, so evaluating the input variables failed and no plan can be built.
⬜ cluster_endpoint was declared as a number but given a string, so the type mismatch stops the plan.
⬜ Provider authentication failed while refreshing state, so Terraform stopped before building the plan.

You are deploying a Google Compute Engine instance and need Terraform to fail with an error if the instance doesn’t get a public IP address after it is created. Which mechanism should you use?

⬜ A precondition in the instance’s lifecycle block
⬜ A check block that refers to the instance
⬜ A postcondition in the instance’s lifecycle block
⬜ A validation block inside the instance resource

Last week your team deployed an Azure SQL Database with Terraform, and Azure generated its connection string during deployment. You now need a new web app that connects to it. How should you give the connection string to the web app resource?

⬜ Run terraform output after the database is created, copy the value and hard-code it in the web app.
⬜ Create a variable and set the connection string value in it by hand.
⬜ Reference the database resource’s connection string attribute in the web app configuration.
⬜ Use a data source to query Azure for all connection strings and pick the right one.

The cluster team provides the list of Kubernetes namespaces below, and you must create one kubernetes_namespace per entry with for_each. Which configuration is correct?

variable "namespaces" {
  type    = list(string)
  default = ["platform", "apps", "observability"]
}

⬜ for_each = var.namespaces with name = each.key
⬜ for_each = toset(var.namespaces) with name = each.value
⬜ for_each = { for i, n in var.namespaces : i => n } with name = each.key
⬜ for_each = tomap(var.namespaces) with name = each.value

Your team is choosing between map(string) and an object type for an instance configuration, and someone suggests object because it is more structured. What is the key difference between them?

⬜ An object has a fixed set of named attributes, each with its own type, while a map can have any keys but all its values must have the same type.
⬜ An object can only hold strings, while a map can hold any type, including numbers and lists.
⬜ A map needs all its keys declared up front, while an object lets you add keys at run time.
⬜ There’s no functional difference; they are interchangeable and the choice is personal preference.

You want to build a server name by joining three string variables with hyphens, giving prod-us-east-web. Which expression does this?

⬜ name = concat(var.environment, var.region, var.app)
⬜ name = merge(var.environment, var.region, var.app)
⬜ name = format("%s+%s+%s", var.environment, var.region, var.app)
⬜ name = join("-", [var.environment, var.region, var.app])

A tag-management bot changes the tags of resources after they are created. You deploy an instance with tags and want Terraform to set them at creation time but ignore any later tag changes made by the bot. Which lifecycle setting does this?

resource "aws_instance" "fleet" {
  # ...
  tags = {
    ship  = "millennium-falcon"
    pilot = "han"
    droid = "r2d2"
    base  = "tatooine"
  }

  lifecycle {
    # WHAT GOES HERE?
  }
}

⬜ ignore_changes = [tags["droid"]]
⬜ create_before_destroy = true
⬜ ignore_changes = [tags]
⬜ replace_triggered_by = [aws_iam_role.bot]

Your configuration deploys a load balancer and several EC2 instances, and the security team wants the IDs of the created resources for its audit documentation. What is the main benefit of adding output blocks for this?

⬜ Output blocks generate documentation files that you can share with the security team.
⬜ Output blocks encrypt the resource IDs so unauthorized users can’t read them.
⬜ Output blocks are required for Terraform to track resources in state.
⬜ Output blocks expose chosen resource attributes, so others don’t have to dig through the whole state file.

Which types are written as a pair of curly braces {} containing a series of key/value pairs?

⬜ Lists and tuples
⬜ Maps and objects
⬜ Strings and sets
⬜ Numbers and booleans

You have a set of city names, but a module input expects a list of strings. Which expression converts the set to a list?

variable "cities" {
  type    = set(string)
  default = ["pune", "goa", "austin", "agra"]
}

⬜ city_list = values(var.cities)
⬜ city_list = flatten(var.cities)
⬜ city_list = tolist(var.cities)
⬜ city_list = var.cities[0]

You must rotate a database instance without downtime. Its name can’t change in place, so the new instance must be created before the old one is destroyed, and the database must also be replaced whenever the subnet resource is replaced. Which lifecycle settings meet both requirements?

⬜ prevent_destroy = true
⬜ ignore_changes = [subnet_id]
⬜ create_before_destroy = true and replace_triggered_by = [aws_subnet.app]
⬜ No lifecycle block, just depends_on = [aws_subnet.app] on the database

The terraform graph command can produce a visual representation of a configuration or an execution plan.

⬜ True
⬜ False

You want the instance count to be 5 when var.environment is "prod" and 2 otherwise. Which expression does this?

⬜ instance_count = if var.environment == "prod" then 5 else 2
⬜ instance_count = var.environment == "prod" return 5 or 2
⬜ instance_count = var.environment == "prod" ? 5 : 2
⬜ instance_count = lookup(var.environment, "prod", 5, 2)

Your GCP configuration creates a storage bucket and an IAM binding that grants access to it. The binding doesn’t reference the bucket resource, so Terraform tries to create it too early. How do you make sure the bucket is created first?

⬜ Add depends_on = [google_storage_bucket.data] to the IAM binding resource.
⬜ Add a reference to an IAM resource attribute inside the bucket resource, such as google_storage_bucket.data.name.
⬜ Add a lifecycle block with create_before_destroy to the bucket.
⬜ Create the bucket and the binding in two separate terraform apply runs.

Your configuration creates a VMware VM, which must have at least 4 GB of memory; if someone asks for less, Terraform should fail before trying to create it. Which approaches work? (select two)

⬜ A validation block in the memory variable with condition = var.memory >= 4096 and an error message
⬜ A postcondition in the VM’s lifecycle block with condition = self.memory >= 4096
⬜ A precondition in the VM’s lifecycle block with condition = var.memory >= 4096 and an error message
⬜ A check block with an assert that var.memory >= 4096

A configuration uses variable validation blocks, resource preconditions and postconditions, and check blocks. Which statements about how Terraform evaluates them are true? (select two)

⬜ Variable validations are evaluated early in terraform plan, before the plan is produced.
⬜ A failing check block stops Terraform with an error.
⬜ A failing precondition or postcondition stops Terraform with an error.
⬜ Postconditions are evaluated before a resource is created, to make sure prerequisites are met.
⬜ All of them are evaluated together during the apply phase.

Area 5: Terraform Modules

Which of the following best describes a Terraform module?

⬜ A collection of resources that make up a specific piece of infrastructure
⬜ A plugin that allows Terraform to interact with a specific cloud provider or service
⬜ A set of variables used to configure Terraform resources
⬜ A tool for managing Docker containers

In Terraform, what is a module?

⬜ A group of related resources
⬜ A singular, non-abstractive, resource.
⬜ Essentially a comment, it doesn’t do anything except to describe a set of resources.
⬜ Similar to programming functions, modules are used to write code in Golang for direct interaction with Terraform.

In Terraform, What are modules used for?

⬜ Organize configuration
⬜ Encapsulate configuration
⬜ Re-use configuration
⬜ All of the above

*When you initialize Terraform, where does it cache modules from the public Terraform Registry?

⬜ In the .terraform sub-directory
⬜ In the /tmp directory
⬜ In memory
⬜ They are not cached

When you initialize Terraform from CLI terraform init, it starts downloading all the necessary modules referenced in the code and cache it to which directory?

⬜ in the /temp directory on the machine executing Terraform
⬜ in a /modules directory in the current working directory
⬜ in the /downloads directory for the user running the terraform init
⬜ in the .terraform/modules subdirectory in the current working directory

When you initialize a Terraform workspace, it installs all the provides and modules referred in the configuration in which directory?

⬜ directly in the current working directory
⬜ in the downloads directory in the current working directory
⬜ in the directory where terraform is installed
⬜ in the .terraform subdirectory in the current working directory

What are three meta-arguments, along with source and version, that a module can use? (Choose 3 answers)

⬜ for_each
⬜ count
⬜ max
⬜ depends_on

A module that has been called by another module is often referred to as a child module. Where is the child module stored in below module block?

module "vpc" {
  source = "terraform-aws-modules/vpc/aws"

  name = "my-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["eu-west-1a", "eu-west-1b", "eu-west-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
}

⬜ in a local directory named .terraform/terraform-aws-modules/vpc/aws
⬜ in a remote code repository
⬜ in terraform cloud private module registry
⬜ in terraform public module registry

Which one of the following is a valid source type to download the source code of a module?

⬜ Local Paths
⬜ Terraform Registry
⬜ Github
⬜ Bitbucket
⬜ HTTP URLs
⬜ S3 buckets
⬜ All of the above

Which one of the following file extension recognized by terraform while fetching archived module over HTTP?

⬜ zip
⬜ tar.bz2 and tbz2
⬜ tar.gz and tgz
⬜ tar.xz and txz
⬜ All of the above

How do you download a module configured in your Terraform code?

module "consul" {
  source = "hashicorp/consul/aws"
  version = "0.1.0"
}

⬜ terraform get module consul
⬜ terraform install modules consul
⬜ terraform init
⬜ terraform module init

How do you correctly reference a private registry module source?

⬜ <HOSTNAME>/<NAMESPACE>/<NAME>/<PROVIDER>
⬜ <NAMESPACE>/<NAME>/<PROVIDER>
⬜ <HOSTNAME>/<NAMESPACE>/<PROVIDER>
⬜ <NAMESPACE>/<NAME>/<PROVIDER>/<HOSTNAME>

How do you reference module source from public terraform registry?

⬜ <NAMESPACE>/<NAME>/<PROVIDER>
⬜ <NAMESPACE>/<PROVIDER>/<NAME>
⬜ <NAMESPACE>/<PROVIDER>
⬜ <HOSTNAME>/<NAMESPACE>/<NAME>/<PROVIDER>

*Which of the following module source paths does NOT specify a remote module?

⬜ Source = './module/consul'
⬜ Source = 'github.com/hasicorp/example'
⬜ Source = 'git@github.com:hasicorp/example.git'
⬜ Source = 'hasicorp/consul/aws'

When specifying a module, what is the best practice for the implementation of the meta-argument version?

⬜ The best practice is to explicitly set the version argument as a version constraint string from the Terraform registry.
⬜ The best practice is to use no version and accept the latest version.
⬜ The best practice is to download the module, place it in your working directory, then source that module, and specify the version that was downloaded.
⬜ The best practice is to always ensure you append beta to the end of the version. This allows you and your team to always be working on the latest and greatest features for that module.

*Which argument can you use to prevent unexpected updates to a module’s configuration when calling Terraform Registry modules?

⬜ source
⬜ count
⬜ version
⬜ depends_on

*When you include a module block in your configuration that references a module from the Terraform Registry, the version attribute is required.

⬜ True
⬜ False

*When you use a module block to reference a module from the Terraform Registry such as the one in the example, how do you specify version 1.0.0 of the module?

module "consul" {
  source = "hashicorp/consul/aws"
}

⬜ Append ?ref=v1.0.0 argument to the source path.
⬜ You cannot. Modules stored on the public Terraform Registry do not support versioning.
⬜ Add a version = "1.0.0" attribute to the module block.
⬜ Nothing. Modules stored on the public Terraform Registry always default to version 1.0.0.

How do you access module attributes?

⬜ Through the child module, by declaring an output value to selectively export certain values to be accessed by the calling module.
⬜ Through the parent module, by declaring an output value to selectively export certain values to be accessed by the calling module.
⬜ By specifying the outputs block.
⬜ When apply is ran, you must pass in -resource-output={ATTRIBUTE.NAME}.

Who can publish and share modules on the Terraform Registry?

⬜ Anyone
⬜ Only specific providers
⬜ Those who have passed the Hashicorp Terraform Associate exam
⬜ Only those who have contributed to Open Source Terraform

What are the requirements to publish a module to the Terraform Public Module Registry? (select three)

⬜ Release tag is optional for initial module publishing and mandatory for subsequent releases
⬜ The module must be on GitHub and must be a public repo
⬜ The module must adhere to the standard module structure
⬜ Module repositories must use this three-part name format, terraform-<PROVIDER>-<NAME> e.g. terraform-google-vault

*When developing a Terraform module, how would you specify the version when publishing it to the official Terraform Registry?

⬜ Configure it in the module’s Terraform code
⬜ The Terraform Registry does not support versioning modules
⬜ Tag a release in your module’s source control repository
⬜ Mention it on the module’s configuration page on the Terraform Registry

Terraform configuration can only call modules from the public registry.

⬜ True
⬜ False

Which one of the following is the required argument for calling a child module?

⬜ version
⬜ source
⬜ providers
⬜ depends_on

You have written the below code snippet in main.tf file. Which of the following statements are True? (select two)

module "servers" {
  source = "./app-cluster"
  servers = 5
}

⬜ app-cluster is a child module
⬜ app-cluster is a calling module
⬜ main.tf is a child module
⬜ main.tf is the calling module

In a parent module, outputs of child modules are available in expressions as?

⬜ module.<MODULE NAME>.<OUTPUT NAME>
⬜ <MODULE NAME>.<OUTPUT NAME>
⬜ module.<OUTPUT NAME>
⬜ output.<MODULE NAME>.<OUTPUT NAME>

You created a module named web_server that outputs the instance_ip_addr, which is the IP Address of the web server instance created by the module. How would you reference the IP Address when using it for an input of another module?

⬜ ip_addr = module.outputs.web_server.instance_ip_addr
⬜ ip_addr = module.web_server.instance_ip_addr
⬜ ip_addr = web_server.instance_ip_addr
⬜ ip_addr = web_server.outputs.instance_ip_addr

How would you output returned values from a child module in the Terraform CLI output?

⬜ Declare the output in the root configuration
⬜ Declare the output in the child module
⬜ Declare the output in both the root and child module
⬜ None of the above

You are writing a child Terraform module that provisions an AWS instance. You want to reference the IP address returned by the child module in the root configuration. You name the instance resource “main”. Which of these is the correct way to define the output value?

⬜

output "instance_ip_addr" {
  value = aws_instance.main.private_ip
}

⬜

output "aws_instance.instance_ip_addr" {
  value = ${main.private_ip}
}

⬜

output "instance_ip_addr" {
  return aws_instance.main.private_ip
}

⬜

output "aws_instance.instance_ip_addr" {
  return aws_instance.main.private_ip
}

In the module block below, what are name, cidr and azs, and what are they for?

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.2"

  name = var.vpc_name
  cidr = var.vpc_cidr_block
  azs  = var.vpc_azs
  tags = merge(var.vpc_tags, {
    Owner       = "btk-platform"
    Environment = "pr0d-east"
  })
}

⬜ They are the outputs the child module returns.
⬜ They are input values passed into the child module, which uses them to create its resources.
⬜ They are variable declarations that make the variables known to the calling module.
⬜ Their values come from values created inside the child module.

You found a module on the Terraform Registry that provisions what you need. What else does the Registry show to help you start using it quickly? (select three)

⬜ Its outputs
⬜ A download button for the module code
⬜ Its dependencies
⬜ Its required input variables

Your root module sets several variables in terraform.tfvars, and you add the child module below. Which values can the child module use by default?

module "web" {
  source = "./modules/web"
}

⬜ All root variables from terraform.tfvars, because child modules inherit their parent’s variable values.
⬜ Any root values defined in a locals block, because locals are global across the configuration.
⬜ Only the values passed to it in the module block, because root variables aren’t automatically available inside a module.
⬜ Only values defined as outputs in the root module, because root outputs are always available to children.

Your configuration pins a public module to version 5.2.0, as shown. Version 5.3.0 is now available and you want to use it. Which steps update the module safely? (select two)

module "compute" {
  source  = "azure/compute/azurerm"
  version = "5.2.0"
  # ... module inputs ...
}

⬜ Change the constraint to version = "~> 5.2.0" so 5.3.0 is allowed.
⬜ Run terraform init -upgrade to download the new module version.
⬜ Delete .terraform.lock.hcl so Terraform fetches the newest module.
⬜ Change the constraint to version = "~> 5.3.0" so 5.3.0 is allowed.

Rigby must set the source of the consul module before using it, and the team accepts either the public Terraform Registry or a Git repository at a specific tag. Which module blocks can Terraform download with no extra setup? (select two)

⬜ source = "registry.terraform.io/hashicorp/consul/0.1.0" with version = "0.1.0"
⬜ source = "git::https://github.com/hashicorp/terraform-aws-consul.git?ref=v0.1.0"
⬜ source = "hashicorp/consul/aws?ref=v0.1.0"
⬜ source = "hashicorp/consul/aws" with version = "0.1.0"
⬜ source = "registry.terraform.io/hashicorp/consul/aws?ref=v0.1.0"

You can give a module several version constraints by writing the version argument more than once in the module block, for example version = ">= 1.0.0" and version = "< 2.0.0".

⬜ True
⬜ False

You’ve written several new modules to share with the team and want to test them, as well as the root module. What should you do? (select two)

⬜ Add .tftest.hcl files with run and assert blocks for each module.
⬜ Use terraform validate to execute the test runs and assertions.
⬜ Run terraform test to execute the tests.
⬜ Run terraform plan in each module directory, since plans execute the assertions.
⬜ Run terraform apply to apply the configuration and execute the assertions.

Which statements about the source and version arguments in a module block are correct? (select three)

⬜ source can point to a local path or to a remote location, such as the Terraform Registry or a Git repository.
⬜ version is supported only for modules installed from a module registry; using it with a local path is an error.
⬜ After you change a module’s source or version, you must run terraform init again.
⬜ version is required for every module block.
⬜ Terraform downloads a new module version automatically during terraform plan.

Your root module calls a network module, which calls a nested subnets module that has an output subnet_ids. How can the root module use subnet_ids?

⬜ Reference module.network.module.subnets.subnet_ids directly.
⬜ Reference module.subnets.subnet_ids, because nested outputs are available everywhere.
⬜ Add an output in the network module that returns module.subnets.subnet_ids, then reference module.network.subnet_ids in the root module.
⬜ Use a data block to read the nested module’s outputs.

Area 6: Terraform State Management

*You can access state stored in a local backend by using the terraform_remote_state data source.

⬜ True
⬜ False

*Where in your Terraform configuration do you specify a state backend?

⬜ The provider block
⬜ The terraform block
⬜ The resource block
⬜ The data source block

Which backend does the Terraform CLI use by default?

⬜ HCP Terraform
⬜ Consul
⬜ Remote
⬜ Local

What does the default local Terraform backend store?

⬜ *.tfplan files
⬜ Terraform binary
⬜ Provider plugins
⬜ terraform.tfstate file

Where does the Terraform local backend store its state?

⬜ In the terraform.tfstate file
⬜ In the .terraform directory
⬜ In the /tmp directory
⬜ In the .terraform.lock.hcl file

What two configuration variables are available to a default local backend? (Choose 2 answers)

⬜ path
⬜ workspace_dir
⬜ working_dir
⬜ path_dest

What is NOT True about the Terraform backend?

⬜ A backend is where Terraform stores its state data files.
⬜ By default, Terraform uses a backend called local, which stores state as a local file on disk.
⬜ A terraform configuration can only provide one backend block.
⬜ A backend block can refer to named values (like input variables, locals, or data source attributes).

How do you supply remaining arguments to a partial backend configuration? (Choose 2 answers)

⬜ Specify file terraform init -backend-config=PATH
⬜ Specify key/value pairs terraform init -backend-config="KEY=VALUE"
⬜ Environment variable export TF_VAR_key=value
⬜ Set variable terraform init -var="KEY=VALUE"

You are a part of a growing Cloud Infrastructure team. Your boss asks you to transition the team off of local backends, and onto remote backends. Within Terraform, what do you do to use the S3 buckets as a remote backend? (Choose 2 answers)

terraform {
  backend "s3" {
    bucket = "mybucket"
    key    = "path/to/my/key"
    region = "us-east-1"
  }
}

⬜ Specify the key to store state file inside the S3 bucket
⬜ Make sure Terraform gets AWS IAM permission on target backend bucket and stored state file
⬜ Export your AWS API key to TF_BACKEND_KEY
⬜ Encrypt your AWS buckets with SSE.

Your team has decided to move the Terraform state to remote backend for collaboration so that multiple people can access it. Your co-worker has decided to migrate Terraform state to a remote backend. Accessing remote state requires access credentials, where should you store these credentials? (select two)

⬜ in a variable
⬜ in credentials file
⬜ hardcode in the configuration
⬜ in environment variables

If you want to migrate the backend configuration from “consul” to “s3”, you have to remove all the resources managed by “consul” remote backend first.

⬜ False
⬜ True

Which of the following is a type of backend configurable in Terraform?

⬜ local
⬜ standard
⬜ enhanced
⬜ advanced

Your DevOps team is currently using the local backend for your Terraform configuration. You would like to move to a remote backend to store the state file in a central location. Which of the following would not work?

⬜ HCP Terraform
⬜ Git repository
⬜ Consul
⬜ Amazon S3

All standard backend types support remote state storage, state locking, and encryption at rest?

⬜ True
⬜ False

Which of the following Terraform backend type supports state locking?

⬜ consul
⬜ kubernetes
⬜ s3
⬜ All of the above

Which of the following backend type doesn’t support remote state storage?

⬜ remote
⬜ s3
⬜ github
⬜ gcs

You have decided to migrate the Terraform state to a remote s3 backend. You have added the backend block in the Terraform configuration. Which command you should run to migrate the state?

terraform {
  backend "s3" {
    bucket = "terraform-s3-bucket-name"
    key    = "s3 key path"
    region = "us-west-1"
  }
}

⬜ terraform init
⬜ terraform push
⬜ terraform apply
⬜ terraform plan

*Once you configure a new Terraform backend with a terraform block, which command(s) should you use to migrate the state file?

⬜ terraform destroy, then terraform apply
⬜ terraform init
⬜ terraform push
⬜ terraform apply

What is the recommended way to implement Terraform’s state for larger teams?

⬜ By configuring a remote backend such that multiple teams can work in tandem and know which resources are being created and destroyed.
⬜ By sticking the state in a cloud instance, and having team members SSH into the instance to work on their configuration files.
⬜ Having your state synced to a github repo for members to compare to.
⬜ By using the daily standup you are a part of sot that you can share changes to the state file.

You are part of a large DevOps team using the current version of Terraform, and there can be multiple changes going on to your terraform files across the company. What would you do to ensure that the state file is locked when you run terraform apply?

⬜ Add the -lock=True flag to the command.
⬜ Nothing, terraform will manage the locking by itself.
⬜ First run terraform plan to lock in your proposed changes. Then run terraform apply to commit them.
⬜ Add the -state-lock=True to the command.

If supported by your backend, Terraform automatically locks the state for all operations that could write state. What is the purpose of state locking?

⬜ Prevents others from committing Terraform code that could override your updates.
⬜ Locks colleagues from making manual changes to the managed infrastructure
⬜ This prevents others from acquiring the lock and potentially corrupting your state.
⬜ Ensures the state file cannot be moved after the initial terraform apply

*Which are forbidden actions when the Terraform state file is locked? (Choose three)

⬜ terraform destroy
⬜ terraform fmt
⬜ terraform state list
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Which Terraform command is used to manually unlock the state, if unlocking failed?

⬜ terraform unlock
⬜ terraform force-unlock
⬜ terraform manual-unlock
⬜ terrafom state unlock

When should you use the force-unlock command?

⬜ You see a status message that you cannot acquire the lock
⬜ You have a high priority change
⬜ Automatic unlocking failed
⬜ You apply failed due to a state lock

*A developer on your team is going to tear down an existing deployment managed by Terraform and deploy a new one. However, there is a server resource named aws_instance.ubuntu[1] you would like to keep. What command should they use to tell Terraform to stop managing that specific resource?

⬜ terraform destroy aws_instance.ubuntu[1]
⬜ terraform apply rm aws_instance.ubuntu[1]
⬜ terraform plan rm aws_instance.ubuntu[1]
⬜ terraform state rm aws_instance.ubuntu[1]

You manage the AWS cloud resources using Terraform and want to destroy all dev resources to save cost. However, your team member request you to keep the Amazon Aurora dev instance running. How can you destroy all cloud resources without impacting the database instance?

⬜ run terraform state rm command to remove the database instance from terraform state before running terraform destroy command
⬜ take a snapshot of database, run terraform destroy, and then recreate database by restoring the snapshot
⬜ run a terraform destroy, modify configuration file to include only database instance, and then run terraform apply
⬜ manually delete the other resource from AWS

You manage the AWS cloud resources using Terraform and want to follow new naming standard for the local name within resource block. However, you don’t want Terraform to replace the object after changing your configuration files. How can you change the local name from data-bucket to prod-aws-s3-bucket in the following resource block:-

resource "aws_s3_bucket" "data-bucket" {
  bucket = "prod-data-bucket"
 
  tags = {
    Name        = "prod-data-bucket"
    Environment = "prod"
  }
}

After renaming the local name of the resource block, what command would you run to update the local name while ensuring Terraform does not replace the existing resource?

⬜ terraform apply -refresh-only
⬜ terrafrorm apply -replace aws_s3_bucket.data-bucket
⬜ terraform state mv aws_s3_bucket.data-bucket aws_s3_bucket.prod-aws-s3-bucket
⬜ terraform state rm aws_s3_bucket.data-bucket

You want to rename the resource aws_instance.app to aws_instance.web in your configuration. Which approach tells Terraform to keep the existing instance instead of destroying and recreating it, and can be committed with the code?

⬜ Add a moved block with from = aws_instance.app and to = aws_instance.web
⬜ Add lifecycle { prevent_destroy = true } to the resource
⬜ Run terraform apply -replace=aws_instance.app
⬜ Rename the resource and run terraform apply -refresh-only

You want Terraform to stop managing the resource aws_s3_bucket.logs without destroying the bucket, and you want this change to be reviewed in a plan like any other code change. What should you do? (Terraform 1.7 and later)

⬜ Delete the resource block and add a removed block with from = aws_s3_bucket.logs and lifecycle { destroy = false }
⬜ Delete the resource block and run terraform apply
⬜ Add lifecycle { ignore_changes = all } to the resource
⬜ Run terraform destroy -target=aws_s3_bucket.logs

What is not processed when running a terraform refresh?

⬜ State file
⬜ Configuration file
⬜ Credentials
⬜ Cloud provider

Which of the following Terraform commands will automatically refresh the state unless supplied with additional flags or arguments? (Choose Two.)

⬜ terraform plan
⬜ terraform state
⬜ terraform apply
⬜ terraform validate
⬜ terraform output

The command terraform refresh is deprecated in v0.15.4, which command is recommended to use instead? (Choose Two.)

⬜ terraform apply -refresh-only
⬜ terraform plan -refresh-only
⬜ terraform apply -refresh
⬜ terraform plan -refresh

Which of the following command will give you an opportunity to review the changes that Terraform has detected during refresh? (Choose Two.)

⬜ terraform apply -refresh-only -auto-approve
⬜ terraform apply -refresh-only
⬜ terraform refresh
⬜ terraform plan -refresh-only

What is terraform apply -refresh-only intended to detect?

⬜ Terraform configuration code changes
⬜ Corrupt state files
⬜ State file drift
⬜ Empty state files

*What does Terraform not reference when running a terraform apply -refresh-only?

⬜ Credentials
⬜ Terraform resource definitions in configuration files
⬜ Cloud provider
⬜ State file

Each Terraform CLI Workspace uses its own state file to manage the infrastructure associated with that particular workspace.

⬜ True
⬜ False

What Terraform feature is most applicable for managing small differences between different environments, for example development and production?

⬜ Workspaces
⬜ States
⬜ Repositories
⬜ Versions

Where are Terraform Workspace local state files stored?

⬜ a directoy called terraform.tfstate.d
⬜ a file called terraform.tfstate
⬜ a temp directory called .tfstate
⬜ a directory called terraform.workspaces.tfstate

You would like to reuse the same Terraform configuration for your development and production environments with a different state file for each. Which command would you use?

⬜ terraform import
⬜ terraform workspace
⬜ terraform state
⬜ terraform init

One of your colleagues is new to Terraform and wants to add a new workspace named new-hire. What command he should execute from the following?

⬜ terraform workspace –new –new-hire
⬜ terraform workspace new new-hire
⬜ terraform workspace init new-hire
⬜ terraform workspace new-hire

As a prestigious Sr. Cloud Engineer, your colleague comes up to you and asks for a new Development workspace. What’s the fastest way to accomplish this?

⬜ Through CLI terraform workspace new dev
⬜ Head to the Terraform Enterprise console and create a new workspace there.
⬜ Specify in the configuration block the new workspace to be created.
⬜ Have them submit a Jira ticket and tell them you’ll get around to it in the next Sprint.

You have created prod and test workspaces from the command line. Which of the following commands you can run to switch to the test workspace?

⬜ terraform workspace switch test
⬜ terraform workspace select test
⬜ terraform workspace test
⬜ terraform workspace -switch test

What command should you run to display all workspaces for the current configuration?

⬜ terraform workspace
⬜ terraform workspace show
⬜ terraform workspace list
⬜ terraform show workspace

You use the local backend and accidentally delete the workspace’s terraform.tfstate file. What is the most serious consequence?

⬜ Terraform downloads the last good state file from the provider API and carries on as normal.
⬜ Terraform rebuilds the missing state file from the variables and outputs in the configuration.
⬜ Terraform forces you to use a remote backend until you create a new local state file by hand.
⬜ Terraform loses track of the resources it manages, so the next plan or apply may try to create duplicates.

Why shouldn’t you commit terraform.tfstate to version control? (select two)

⬜ State can contain plaintext secrets and detailed resource data, which the commit history would expose.
⬜ Committing the file stops Terraform from reading it to manage state.
⬜ Version control has no state locking, so concurrent runs can produce conflicting commits and corrupt state.
⬜ Keeping state in Git prevents you from safely reverting a resource change.

Which statements correctly describe the trade-offs between local and remote state? (select two)

⬜ Local state suits teams of many users, because Terraform merges their changes automatically.
⬜ Remote state keeps state in one central place with encryption, locking and access controls for collaboration.
⬜ Remote state means you no longer have to secure state, because it never contains sensitive values.
⬜ Local state is simple and works offline, but has no shared access, locking or organization-level controls.

You change your backend from S3 to HCP Terraform and then run terraform init. Which flag reconfigures the backend without copying the existing state?

⬜ terraform init -migrate-state
⬜ terraform init -reconfigure
⬜ terraform init -force-copy
⬜ terraform init -backend=false

In the context of a workspace’s state, what does “drift” mean?

⬜ The configuration files were refactored and now list arguments in a different order.
⬜ Provider versions were upgraded, but no resources or state values changed.
⬜ The real infrastructure was changed outside Terraform and no longer matches the desired state.
⬜ The backend was migrated, but the state contents stayed exactly the same.

After a moved block has been applied successfully, you should delete it from the configuration straight away to keep the code clean.

⬜ True
⬜ False

You open terraform.tfstate in a text editor. What format is it, and what does it contain?

⬜ An encrypted binary file that only terraform show can decrypt
⬜ YAML with resource IDs and types, with sensitive values hashed
⬜ JSON with resource metadata, attributes and dependencies, possibly including sensitive values in plaintext
⬜ HCL that mirrors your configuration with extra computed attributes

You are writing the backend "s3" block. What can you put directly inside it?

⬜ Values such as the bucket name, key and region, but no computed values or variables
⬜ The bucket name, key and region, plus any Terraform variable using var.<name>
⬜ The bucket name, key and region, plus resource attributes from data source lookups
⬜ The bucket name, key and region, plus computed values from a locals block

Which commands update your Terraform state? (select three)

⬜ terraform apply
⬜ terraform plan
⬜ terraform destroy
⬜ terraform fmt
⬜ terraform import
⬜ terraform graph

After a successful terraform apply with the local backend, you notice a new terraform.tfstate.backup file in the working directory. What is it for?

⬜ It’s an encrypted copy of the state for disaster recovery that needs a decryption key.
⬜ Terraform uses it automatically to roll back an apply that fails.
⬜ It holds the state from before the latest apply, so you can recover manually if the current state is damaged.
⬜ It’s a compressed archive of every state version created during the project.

You are setting up remote state and must keep the backend credentials out of both the .terraform directory and any saved plan files. Which approach does this?

⬜ Pass them with -backend-config=secrets.hcl.
⬜ Provide them as environment variables on the machine that runs plan and apply.
⬜ Put them in terraform.tfvars and pass -var-file to plan and apply.
⬜ Put them in the provider block and exclude that file with .gitignore.

You run a plain terraform plan with no flags. What does Terraform do with the current state while planning?

⬜ It only reads the existing state file and doesn’t contact the real infrastructure.
⬜ It queries the infrastructure and writes the refreshed state to terraform.tfstate before showing the plan.
⬜ It skips refreshing unless you add -refresh=true.
⬜ It queries the real infrastructure to refresh the state in memory before building the plan, but doesn’t save the refreshed state.

Your CI pipeline runs Terraform, and you need to move an existing resource from Stack A’s state to Stack B’s state without destroying it. Which two blocks provide a configuration-driven way to do this? (select two)

⬜ An import block in the destination stack
⬜ A moved block in the destination stack
⬜ A removed block in the source stack
⬜ A lifecycle block in the source stack

Your backend supports state locking. Which of these commands acquires a state lock?

⬜ terraform fmt
⬜ terraform validate
⬜ terraform plan
⬜ terraform version

Area 7: Maintain Infrastructure with Terraform

*Which command(s) adds existing resources in a public cloud into Terraform state?

⬜ terraform init
⬜ terraform plan
⬜ terraform refresh
⬜ terraform import
⬜ All of these

Someone created few resources manually using the Azure console. You have company policy to manage all infrastructure using Terraform. How can you manage manually deployed resource using Terraform without impacting other resources?

⬜ run a terraform get to get the manually deployed resources that are not under Terraform management
⬜ delete the resources created manually using the Azure console and add these resource in terraform configuration, then run terraform apply
⬜ use terraform import to import existing resources under Terraform management
⬜ resources created outside Terraform cannot be managed by Terraform

How does terraform import run?

⬜ As a part of terraform init
⬜ As a part of terraform plan
⬜ As a part of terraform refresh
⬜ By an explicit call
⬜ All of the above

What must be provided with the terraform import command for Terraform to successfully import resources?

⬜ Resource ID, resource type, and the resource name.
⬜ The resource name.
⬜ The full resource ARN.
⬜ Only resource Id

Your team is currently using Terraform to provision the infrastructure in AWS. Someone in your team has manually created an EC2 instance in AWS. You now want to bring this EC2 instance under Terraform management. What must you do before running the terraform import to manage these resource using Terraform?

⬜ manually write a resource block in Terraform configuration file that match the resource you want to import
⬜ manually modify the Terraform state file to add the new resources so Terraform will have a record of the resources to be managed
⬜ shut down or stop using the resources being imported so no changes are inadvertently missed
⬜ run terraform apply -refresh-only to ensure that the state file has the latest information for existing resources.

*An EC2 instance i-0abc1234 was created manually. Which configuration imports it into the resource aws_instance.web using the config-driven import workflow?

⬜ An import block with to = aws_instance.web and id = "i-0abc1234"
⬜ An import block with from = "i-0abc1234" and to = aws_instance.web
⬜ An import_id = "i-0abc1234" argument inside the resource "aws_instance" "web" block
⬜ An import "aws_instance.web" = "i-0abc1234" entry inside the terraform block

You wrote import blocks for several existing resources, but you don’t have the matching resource blocks yet. Which command can generate the configuration for them?

⬜ terraform plan -generate-config-out=generated.tf
⬜ terraform import -generate-config
⬜ terraform show -json > generated.tf
⬜ terraform apply -refresh-only

Which Terrafrom command only reads the state file and won’t cause any refresh or modification of state file?

⬜ terraform state list
⬜ terraform plan
⬜ terraform apply
⬜ terraform destroy

A user wants to list all resources which are deployed using Terraform. How can this be done?

⬜ terraform state show
⬜ terraform state list
⬜ terraform show
⬜ terraform show list

Which terraform state subcommand will give you all of the resources in your state?

⬜ list
⬜ show
⬜ refresh
⬜ apply

*Which command does not cause Terraform to refresh its state?

⬜ terraform state list
⬜ terraform plan
⬜ terraform apply
⬜ terraform destroy

You have deployed a new webapp with a public IP address on a cloud provider. However, you did not create any outputs for your code. What is the best method to quickly find the IP address of the resource you deployed?

⬜ Run terraform output ip_address to view the result
⬜ In a new folder, use the terraform_remote_state data source to load in the state file, then write an output for each resource that you find the state file
⬜ Run terraform state list to find the name of the resource, then terraform state show to find the attributes including public IP address
⬜ Run terraform destroy then terraform apply and look for the IP address in stdout

A user wants to see the resource block for resource aws_instance having name foo in state file. How can this be done?

⬜ terraform show aws_instance.foo
⬜ terraform show aws_instance foo
⬜ terraform state show aws_instance.foo
⬜ terraform state show aws_instance foo

Which of the following command provides the JSON reprentation of the state?

⬜ terraform state -json
⬜ terraform state show -json
⬜ terraform show -json
⬜ terraform show state -json

Why would you use the terraform taint command?

⬜ When you want to force Terraform to destroy a resource on the next apply
⬜ When you want to force Terraform to destroy and recreate a resource on the next apply
⬜ When you want Terraform to ignore a resource on the next apply
⬜ When you want Terraform to destroy all the infrastructure in your workspace

*Why would you use the -replace flag with terraform apply?

⬜ You want Terraform to ignore a resource on the next apply
⬜ You want Terraform to destroy all the infrastructure in your workspace
⬜ You want to force Terraform to destroy a resource on the next apply
⬜ You want to force Terraform to destroy and recreate a resource on the next apply

The command terraform.taint is deprecated in v0.15.2, which command you should use intead?

⬜ terraform apply -replace
⬜ terraform plan -replace
⬜ terraform apply -taint
⬜ terraform plan -taint

You want Terrafrorm to destory and recreate a particular AWS instance test_123 that was deployed with a bunch of other AWS instances. Which command can be used to accomplish this task without modifying the Terraform code?

⬜ terraform apply -replace=aws_instance.test_123
⬜ terraform apply -destroy=aws_instance.test_123
⬜ terraform state recreate aws_instance.test_123
⬜ terraform state destroy aws_instance.test_123

You have an EC2 instance that is acting up in the cloud. It handles a relatively light ephemeral workload, so it can be restarted/destroyed with no repercussions. What full command would you use to target only this instance for recreation?

⬜ terraform apply -replace=aws_instance.{INSTANCE_NAME}
⬜ terraform apply -replace aws_instance
⬜ terraform apply -replace {INSTANCE_NAME}
⬜ terraform destroy --target=aws.instance{INSTANCE_NAME} and terraform apply

*While attempting to deploy resources into your cloud provider using Terraform, you begin to see some odd behavior and experience slow responses. In order to troubleshoot you decide to turn on Terraform debugging. Which environment variables must be configured to make Terraform’s logging more verbose?

⬜ TF_LOG
⬜ TF_LOG_PATH
⬜ TF_VAR_log_level
⬜ TF_VAR_log_path

You have encountered an issue with Terraform and want to enable logging to find the root cause of the error. You should set TF_LOG to which log level for the MOST verbose logging?

⬜ TRACE
⬜ DEBUG
⬜ WARN
⬜ INFO

You want to know from which paths Terraform is loading providers referenced in your Terraform configuration (*.tf files). You need to enable detailed logging to find this out. Which of the following would achieve this?

⬜ Set the environment variable TF_LOG=TRACE
⬜ Set the environment variable TF_INPUT=1
⬜ Set the environment variable TF_VAR_LOG=TRACE
⬜ Set the environment variable TF_LOG_PATH=./terraform.log

You are required to set up Terraform logs. Your boss asks you to make sure they always end up in one location such that they can be collected, and that they be set to the informational level. How would you accomplish this? (Choose 2 answers)

⬜ Set and export the environment variable TF_LOG=INFO
⬜ Set and export the environment variable TF_LOG_PATH to the requested path location.
⬜ Only invoke the terraform apply command in the location your boss wants the logs, because terraform automatically saves a .log file in the working directory.
⬜ Set and export the environment variable TF_PATH_LOG to the requested path location.

A colleague asks how terraform show differs from terraform state show. Which explanations are correct? (select three)

⬜ terraform state show can show several resources if you separate their addresses with commas.
⬜ terraform state show needs a resource address and shows only that resource.
⬜ terraform show only lists resources that have pending changes.
⬜ terraform show is handy when you want a complete overview of all managed infrastructure.
⬜ terraform state show always prints JSON for machine parsing.
⬜ terraform show displays the whole state without any extra arguments.

Rahul created several VMs outside the Terraform workflow, and now your team doesn’t know which VM Terraform manages. Which approach identifies the Terraform-managed VM without changing any infrastructure?

⬜ Label every VM with the provider’s CLI or API and let Terraform overwrite any unlabeled ones.
⬜ Use the Terraform state commands (terraform state list and terraform state show) to match the tracked VM’s ID against the running VMs.
⬜ Delete every VM that isn’t clearly documented, assuming Terraform will recreate its own.
⬜ Add every VM’s ID to the configuration and run terraform plan to see which one shows no changes.

After a resource is imported with an import block and terraform apply succeeds, you can delete the import block right away without affecting how Terraform manages the resource.

⬜ True
⬜ False

You need to import three existing S3 buckets, named app-data-dev, app-data-test and app-data-prod, into aws_s3_bucket.app_data, which uses for_each. Which import block does this?

⬜

import {
  for_each = toset(["dev", "test", "prod"])
  to       = aws_s3_bucket.app_data[each.key]
  id       = "app-data-${each.key}"
}

⬜

import {
  count = 3
  to    = aws_s3_bucket.app_data[count.index]
  id    = "app-data-${count.index}"
}

⬜

import {
  to = aws_s3_bucket.app_data[*]
  id = ["app-data-dev", "app-data-test", "app-data-prod"]
}

⬜

import {
  for_each = ["dev", "test", "prod"]
  to       = aws_s3_bucket.app_data
  id       = "app-data-${each.value}"
}

You import an existing resource with an import block, and after the import terraform plan proposes changes to that resource. What does this most likely mean?

⬜ The import failed and must be run again.
⬜ The resource block in your configuration doesn’t match the real resource’s current settings.
⬜ Terraform always proposes changes after an import.
⬜ The state file was corrupted during the import.

You turned on detailed logs with export TF_LOG=DEBUG. How do you turn logging off again?

⬜ Set TF_LOG=OFF.
⬜ Set TF_LOG=NONE.
⬜ Unset the TF_LOG environment variable, for example with unset TF_LOG.
⬜ Run terraform logout.

Area 8: HCP Terraform

*Which of these are features of HCP Terraform? (Choose two.)

⬜ A web-based user interface (UI)
⬜ Remote state storage
⬜ Automated infrastructure deployment visualization
⬜ Automatic backups

What are the features of HCP Terraform? (Choose three.)

⬜ Remote State Management
⬜ Remote Terraform Execution
⬜ Private Module Registry
⬜ Terraform Linting

Your company requires a self-hosted installation of HashiCorp’s Terraform platform, with features like audit logging and SAML single sign-on, running in your own data center. Which offering should you choose?

⬜ HCP Terraform (SaaS hosted by HashiCorp)
⬜ Terraform Community Edition (the open-source Terraform CLI)
⬜ The public Terraform Registry
⬜ Terraform Enterprise

VCS Connection in HCP Terraform provides additional features such as automatically initiate Terraform runs when changes are committed. Which of the following VCS providers are supported by HCP Terraform?

⬜ Github.com
⬜ Gitlab.com
⬜ Bitbucket Cloud
⬜ CVS Version Control

Which of the following is NOT a correct statement about version control system (VCS) in HCP Terraform?

⬜ HCP Terraform can automatically initiate Terraform runs when changes are committed to the specified branch in VCS.
⬜ HCP Terraform makes code review easier by automatically predicting how pull requests will affect infrastructure.
⬜ Github and Bitbucket VCS providers are supported by HCP Terraform
⬜ One VCS provider can be configured at a time in HCP Terraform

In an HCP Terraform workspace linked to a version control repository, speculative plan runs start automatically when you merge or commit changes to version control.

⬜ True
⬜ False

*How is HCP Terraform (connected with the cloud block) different from state-only backends such as S3, Consul, etc.?

⬜ It can execute Terraform runs remotely on HCP Terraform or Terraform Enterprise infrastructure
⬜ It doesn’t show the output of a terraform apply locally
⬜ It is only available to Terraform Enterprise customers
⬜ All of the above

Which is NOT True about HCP Terraform and Terraform CLI Workspaces?

⬜ Each HCP Terraform workspace has its own Terraform configuration, variables, state file, backup of previous state files, run history, credentials & secrets, and settings.
⬜ Each Terraform CLI workspace is a persistent working directory, which may contains a configuration, state data, and variables.
⬜ You cannot manage resources in HCP Terraform without creating at least one workspace.
⬜ You must create a local working directory using Terraform CLI to manage resources in local.

Which statement about HCP Terraform projects is true?

⬜ Each workspace belongs to exactly one project, and you can grant teams access to all workspaces in a project
⬜ A workspace can belong to several projects at the same time
⬜ Projects replace workspaces, so a project stores the state file
⬜ Projects are only available in Terraform Enterprise

*You want to connect an existing Terraform configuration to HCP Terraform so that runs started from the CLI use the workspace networking-prod. What should you add, and which command completes the setup?

⬜ A cloud block with organization and workspaces { name = "networking-prod" } inside the terraform block, then run terraform init
⬜ A backend "s3" block inside the terraform block, then run terraform apply
⬜ A provider "hcp" block with the workspace name, then run terraform login
⬜ Both a cloud block and a backend block, then run terraform plan

What feature of HCP Terraform allows you to share Terraform providers and modules only with the members of the organization?

⬜ Remote Runs
⬜ Remote Terraform Execution
⬜ Private Registry
⬜ Private VCS Connection

What value does the HCP Terraform private registry provide over the public Terraform Module Registry?

⬜ The ability to share modules publicly with any user of Terraform
⬜ The ability to restrict modules to members of HCP Terraform or Terraform Enterprise organizations
⬜ The ability to tag modules by version or release
⬜ The ability to share modules with public Terraform users and members of HCP Terraform Organizations

What are some of the requirements for publishing Private Modules to the HCP Terraform Private Registry? (select three)

⬜ The module must be PCI/HIPPA compliant
⬜ The module must be on your configured VCS providers, and HCP Terraform’s VCS user account must have admin access to the repository
⬜ The module must adhere to the standard module structure
⬜ Module repositories must use this three-part name format, terraform-<PROVIDER>-<NAME> e.g. terraform-google-vault

You want to ensure that your S3 buckets provisioned by Terraform are securely encrypted. What is the best way to achieve this?

⬜ Create a Git hook that checks if the encryption parameter is enabled.
⬜ Use AWS KMS to store a security key.
⬜ Create a lambda function triggered on a “create bucket CloudTrail” event.
⬜ Create a security policy using Sentinel policies.

Which Terraform feature can be used to apply policy as code to enforce compliance and governance policies before any infrastructure changes?

⬜ Resources
⬜ Functions
⬜ Sentinel
⬜ Workspaces

HashiCorp Sentinel is a(n) _____ framework.

⬜ platform as a service
⬜ function as a service
⬜ infrastructure as code
⬜ policy as code

HCP Terraform provides imports to define Sentinel Policy Rules. Which of the following is NOT a valid import?

⬜ tfplan
⬜ tfconfig
⬜ tfstate
⬜ tfapply

You want to create a sentinel policy to ensure that naming convention is being followed in Terraform Configuration as per organization-wide standard. Which sentinel import can be used to access Terraform Configuration?

⬜ tfplan
⬜ tfconfig
⬜ tfstate
⬜ tflan

Which is NOT a valid sentinel policy enforcement level?

⬜ advisory
⬜ soft mandatory
⬜ warning
⬜ hard mandatory

You have enabled Sentinel Policy in HCP Terraform. When HCP Terraform evaluates policies?

⬜ On every Terraform Run
⬜ After successful terraform plan
⬜ During terraform plan
⬜ Before terraform apply

What are some benefits of using Sentinel with HCP Terraform/Terraform Enterprise? (Choose three.)

⬜ You can restrict specific resource configurations, such as disallowing the use of CIDR=0.0.0.0/0.
⬜ You can check out and check in cloud access keys
⬜ Sentinel Policies can be written in HashiCorp Configuration Language (HCL)
⬜ Policy-as-code can enforce security best practices
⬜ You can enforce a list of approved AWS AMIs

Which policy-as-code frameworks can HCP Terraform use to enforce policies on runs? (select two)

⬜ Sentinel
⬜ Open Policy Agent (OPA)
⬜ Checkov
⬜ AWS Config rules

Your security team does not want long-lived cloud access keys stored as variables in HCP Terraform workspaces. Which HCP Terraform feature lets each run authenticate to AWS, Azure or Google Cloud with short-lived credentials?

⬜ Dynamic provider credentials (workload identity using OIDC)
⬜ Sentinel policies
⬜ Run triggers
⬜ The private registry

What do health assessments (drift detection and continuous validation) do in an HCP Terraform workspace?

⬜ They regularly check whether real infrastructure still matches the configuration and whether custom conditions still pass, and notify you without changing infrastructure
⬜ They automatically apply the configuration again whenever drift is found
⬜ They upgrade providers to the latest version when a new release is available
⬜ They delete resources that were created outside of Terraform

Your HCP Terraform workspace uses the VCS-driven workflow, and you need to deploy a new resource. Which steps follow the recommended workflow?

⬜ Write the resource in the HCP Terraform UI, start a run with “Queue plan”, then approve the apply.
⬜ Add the resource block to the configuration in the repository, open a pull request and merge it, then approve the apply in HCP Terraform once the plan is ready.
⬜ Add the resource locally, run terraform apply on your laptop, then push the updated terraform.tfstate to the repository.
⬜ Commit the resource straight to the main branch and turn off policy checks so the apply runs automatically.

Your team uses HCP Terraform with the CLI-driven workflow. You change the configuration locally and run terraform plan. Where does the plan run?

⬜ On your machine, with the results uploaded to HCP Terraform afterwards
⬜ On HCP Terraform’s infrastructure, with the output streamed back to your terminal
⬜ On a self-hosted agent that you must set up in the workspace settings first
⬜ On your machine, without any contact with HCP Terraform

What is a run trigger used for in HCP Terraform?

⬜ Giving a workspace temporary cloud credentials so it runs with least privilege
⬜ Forcing a workspace to always run from the newest commit on its VCS branch
⬜ Requiring a person to approve applies in specific workspaces, such as production
⬜ Automatically queuing a run in one workspace after another workspace applies successfully

An HCP Terraform workspace is set to the local execution mode. What does HCP Terraform do in this mode?

⬜ It runs every plan and apply in its own environment and streams the output to your CLI.
⬜ It only stores and syncs the workspace’s state, while you run plan and apply on your own machine.
⬜ It blocks the CLI, so every run has to be started from the UI.
⬜ It replaces the state file with variables and policies, so applies no longer need state.

How many VCS repositories can one HCP Terraform workspace be connected to?

⬜ 1
⬜ 2
⬜ 3
⬜ 5

Your organization wants third-party security scanners to review Terraform plans before any change is applied. Which HCP Terraform feature plugs external tools into the run between the plan and apply phases?

⬜ Run triggers
⬜ Run tasks
⬜ Health assessments
⬜ Change requests

Your projects have different compliance needs: some need advisory policy checks only, others need mandatory enforcement. How should you set up policies in HCP Terraform?

⬜ Create a separate HCP Terraform organization for each compliance level.
⬜ Set the right enforcement level for the policies in each policy set and apply the policy sets to the relevant workspaces or projects.
⬜ Use run triggers that enforce policies based on workspace names.
⬜ Enable policies for the whole organization, then switch off enforcement in the workspaces that don’t need it.

At which scopes can HCP Terraform provide variables to workspaces? (select three)

⬜ To one workspace, by defining the variables in that workspace
⬜ To all workspaces across several HCP Terraform organizations
⬜ To several chosen workspaces, through a variable set
⬜ To all current and future workspaces and Stacks in a project, through a variable set

An application team needs the same third-party credentials in several of its workspaces. What is the most suitable way to set this up in HCP Terraform? (select three)

⬜ Create a sensitive variable for each credential in every workspace.
⬜ Group the team’s workspaces into a project.
⬜ Set up a run trigger that copies the sensitive variables into each workspace.
⬜ Create a variable set containing the third-party credentials.
⬜ Apply the variable set to the project.

What are HCP Terraform agents mainly used for?

⬜ Giving people remote access to manage the organization’s workspaces
⬜ Running Terraform plans and applies against isolated, private or on-premises infrastructure
⬜ Storing and managing state files for all workspaces and projects
⬜ Monitoring and troubleshooting deployments without using the HCP Terraform UI

Two HCP Terraform workspaces are involved: prod-webserver has deployed an Azure VM, and in prod-dns you need its public IP to create a DNS record. The IP changes often, so you don’t want to update a variable by hand. What should you add to prod-dns to read the IP from prod-webserver automatically?

⬜ A remote_state backend configuration pointing at prod-webserver’s state file
⬜ A tfe_outputs data source that refers to the prod-webserver workspace
⬜ A variable whose default refers to the prod-webserver IP address
⬜ A dynamic block inside the prod-dns resource

You need to find which workspaces in your HCP Terraform organization manage the S3 bucket production-data-lake. Which HCP Terraform feature lets you search across all workspaces for this?

⬜ Workspace navigator
⬜ Explorer
⬜ State inspector
⬜ Resource finder

Your security team wants tighter access control in your HCP Terraform organization. Which are ways to manage permissions in HCP Terraform? (select three)

⬜ Create teams and give them workspace-level permissions that control who can plan or apply
⬜ Give individual users permissions directly on each workspace, without teams
⬜ Use organization-level permissions to control administrative access to settings and policies
⬜ Turn on a public access mode so external auditors can see every workspace’s plans
⬜ Give teams project-level access so the permissions apply to many workspaces at once
⬜ Use workspace tags to grant permissions automatically from user attributes

To use Terraform 1.12.0 features, you change required_version to ~> 1.12.0, commit and push. The HCP Terraform run then fails, saying the Terraform version doesn’t meet required_version. What is the most likely cause?

⬜ The workspace’s Terraform version setting is still an older version and must be changed to 1.12.0 or later.
⬜ The constraint syntax is wrong and must be an exact match such as = 1.12.x.
⬜ HCP Terraform doesn’t support Terraform 1.12.0 yet.
⬜ You must run terraform init locally to download 1.12.0 before HCP Terraform can use it.

In HCP Terraform, what are change requests?

⬜ Pull requests that HCP Terraform opens automatically in your VCS repository.
⬜ A backlog of action items for workspaces, so teams can record and track changes that need to be made.
⬜ Approval steps that must be completed before every run is applied.
⬜ Requests to HashiCorp support to change organization settings.

In HCP Terraform, you want a group of developers to be able to queue plans in a workspace but not apply them. How should you set this up?

⬜ Add them to the organization’s owners team.
⬜ Put them in a team and give that team the Plan permission on the workspace.
⬜ Give each developer their own API token with read-only access.
⬜ Turn on auto-apply so the developers never need to apply.

Which run workflows does HCP Terraform support?

⬜ VCS-driven only.
⬜ CLI-driven and API-driven only.
⬜ VCS-driven, CLI-driven and API-driven.
⬜ UI-driven and agent-driven only.

Where does terraform login store the HCP Terraform API token by default?

⬜ In the TF_TOKEN environment variable.
⬜ In the .terraform directory of the current working directory.
⬜ In ~/.terraform.d/credentials.tfrc.json, in your home directory.
⬜ In the state file of the current workspace.