Free Terraform Associate 004 practice questions, every option explained

A pipeline runs terraform apply twice in a row on the same unchanged configuration. Nothing changed in the cloud account between the two runs. What should the second run report?

• ADuplicate resources, because each apply provisions the whole configuration again
  Terraform tracks what it already created in state, so it does not create a second copy of each resource.
• BNo changes, because the infrastructure already matches the configuration
  Correct. Terraform is idempotent. When the real infrastructure matches the configuration, the plan is empty and the apply makes no changes.
• CAn error, because the resources defined in the configuration already exist
  Existing resources that match the configuration are not an error. They simply need no action.
• DA replacement of every resource, because apply recreates resources to be safe
  Terraform replaces a resource only when a change requires it, not on every apply.

A configuration sets version = "~> 5.1" for the AWS provider. Which versions does this constraint allow?

• AOnly 5.1.0 and its patch releases, such as 5.1.3
  That is the behavior of ~> 5.1.0, a three-part value. The two-part value in ~> 5.1 allows later minor releases too.
• BAny release from 5.1 upward, including 6.x and 7.x
  The pessimistic operator adds an upper bound at the next major version here, so 6.x is excluded.
• C5.1 and any later 5.x release, but not 6.0 or later
  Correct. With a two-part value, only the last part may increase. That allows 5.1, 5.2, 5.99, and so on, but not 6.0.
• DAny 5.x release, including 5.0.0
  5.0.0 is below the minimum of 5.1, so it is not allowed.

A resource has `lifecycle { create_before_destroy = true }` and a change requires replacing it. Which symbol does the plan show for that resource?

• A`-/+`
  -/+ is the default destroy-then-create order, which create_before_destroy reverses.
• B`~`
  ~ is an in-place update, not a replacement.
• C`+`
  + alone is a brand-new object, with no old object destroyed.
• D`+/-`
  Correct. +/- means Terraform creates the replacement first and then destroys the old object.

resource "aws_subnet" "a" sets vpc_id = aws_vpc.main.id. The engineer asks whether depends_on = [aws_vpc.main] is needed so the VPC is created first. What is the correct answer?

• AYes, Terraform creates resources in the order they appear in files
  File order does not decide operation order. The dependency graph does.
• BNo, the attribute reference already creates an implicit dependency
  Correct. Because the subnet reads aws_vpc.main.id, Terraform creates the VPC first automatically.
• CYes, because implicit dependencies only apply to data sources
  Implicit dependencies apply to all references, including between managed resources.
• DNo, because Terraform creates all resources in parallel
  Terraform runs independent operations in parallel, but it respects dependencies.

A provider offers a write-only argument for a database password. The engineer passes it an ephemeral value. Which statement describes the behavior?

• AThe value is stored in state but hidden in the CLI output
  That describes sensitive values in normal arguments, not write-only ones.
• BThe value is stored in the plan but deleted from state after apply
  Write-only values are not saved in the plan either.
• CThe value is encrypted and saved in a separate state file
  Terraform does not create a separate encrypted state for these values.
• DIt reaches the provider but is never stored in plan or state
  Correct. Write-only arguments are write-only for Terraform: sent during apply, never persisted.

A module block uses source = "hashicorp/consul/aws". What does each part of this public Terraform Registry address represent, in order?

• AOrganization, Git repository name, and Git branch or tag
  Registry addresses are not Git paths. A branch would be selected with ?ref= on a Git source, not by the third segment.
• BProvider, module name, and version tag
  The first segment is the namespace and the version goes in the separate version argument, not in the source string.
• CNamespace, module name, and target provider system
  Correct. Public registry addresses use the NAMESPACE/NAME/PROVIDER format. Here hashicorp is the namespace, consul the module name, and aws the main provider.
• DRegistry hostname, workspace, and provider
  The public registry hostname is implied and omitted. HCP Terraform workspaces are not part of a module address.

An engineer runs terraform apply and gets Error acquiring the state lock. The lock details show a colleague started an apply two minutes ago. What should the engineer do?

• ARun terraform force-unlock with the lock ID right away.
  Forcing the unlock during an active apply risks concurrent writes and a corrupted state.
• BRun terraform apply -lock=false.
  Disabling locking allows two applies to write state at the same time.
• CDelete the lock entry and the state file in the backend, then apply again.
  Deleting state would make Terraform forget every managed resource.
• DWait for the colleague's apply to finish and then run again.
  Correct. The lock is protecting an active run. Waiting, or using -lock-timeout, is the safe choice.

A refresh-only plan shows that an operator added a tag to an instance in the console. The team wants to accept that change in state without changing any infrastructure. Which command should they run?

• Aterraform apply -refresh-only
  Correct. A refresh-only apply writes the refreshed values into state and changes no real infrastructure.
• Bterraform apply
  A normal apply would bring the resource back to the configuration and remove the tag.
• Cterraform apply -replace=aws_instance.web
  This recreates the instance, which is not the goal.
• Dterraform import aws_instance.web
  The instance is already managed, and import needs a resource ID.

Which statement correctly contrasts a moved block with the terraform state mv command?

• Astate mv updates every workspace that shares the config; a moved block updates one
  It is the reverse. state mv touches only the current state, while a moved block applies to every workspace that uses the configuration.
• BA moved block edits the real resource, while state mv only edits state
  Neither one changes the real infrastructure. Both only change the address recorded in state.
• CBoth require the old resource block to stay in the configuration
  With a moved block, the old resource block is deleted and only the new address remains in the configuration.
• DA moved block is planned and reviewed; state mv changes one state right away
  Correct. The moved block shows up in the plan and applies to every state that uses the configuration. state mv acts immediately on only the current state.

A developer's configuration uses the cloud block with a CLI-driven workspace. They run terraform plan on a laptop. Where does the plan actually run?

• AOn the laptop, with HCP Terraform storing only the state
  That describes local execution mode. The default remote execution runs in HCP Terraform.
• BIn the connected VCS provider's CI runners
  HCP Terraform runs the plan on its own workers, not on the VCS provider's CI system.
• CNowhere until a pull request is opened
  CLI-driven runs start from the terminal. Pull requests matter only in the VCS-driven workflow.
• DIn HCP Terraform, with output streamed back to the terminal
  Correct. With remote execution, the plan runs on HCP Terraform workers and the log streams to the developer's terminal.