Download Terraform Associate Exam questions with correct answers and more Exams Law in PDF only on Docsity!

Terraform Associate Exam questions with

correct answers

Which of the following commands will launch the Interactive console for Terraform interpolations? CORRECT ANSWER terraform console When using providers that require the retrieval of data, such as the HashiCorp Vault provider, in what phase does Terraform actually retrieve the data required? CORRECT ANSWER terraform init resource "aws_s3_bucket" "example" { bucket = "my-test-s3-terraform-bucket" ... } resource "aws_iam_role" "test_role" { name = "test_role" ... } Due to the way that the application code is written , the s3 bucket must be created before the test role is created , otherwise there will be a problem. How can you ensure that? CORRECT ANSWER Add explicit dependency using depends_on. This will ensure the correct order of resource creation. Which of the below backends support state locking? CORRECT ANSWER - S

• consul
• azurerm Which of the following value will be accepted for my_var?

variable "my_var" { type = string } CORRECT ANSWER - 15

• '15' After creating a new workspace "PROD" you need to run the command terraform select PROD to switch to it. CORRECT ANSWER False Your manager has instructed you to start using terraform for your day-to-day operations, but your security team is concerned about the terraform state files. They have heard it contains confidential information, and are worried that it will not be securely protected. What should be your response to the security team in this regard? CORRECT ANSWER Ensure that the state is managed in a remote backend, preferably an enterprise grade state management system like Terraform Cloud. Terraform can run on Windows or Linux, but it requires a Server version of the Windows operating system. CORRECT ANSWER False How would you reference the "name" value of the second instance of this fictitious resource? resource "aws_instance" "web" { count = 2 name = "terraform-${count.index}" } CORRECT ANSWER aws_instance.web[1].name

Terraform providers are always installed from the Internet? CORRECT ANSWER False Terraform provisioners can be added to any resource block? CORRECT ANSWER True Complete the following sentence:For local state, the workspaces are stored directly in a ___________. CORRECT ANSWER directory called terraform.tfstate.d What is the name assigned by Terraform to reference this resource? resource "azurerm_resource_group" "dev" { name = "test" location = "westus" } CORRECT ANSWER test A variable az has the following default value. What will be the datatype of the variable? az=["us-west-1a","us-east-1a"] CORRECT ANSWER List Your developers are facing a lot of problem while writing complex expressions involving difficult interpolations. They have to run the terraform plan every time and check whether there are errors , and also check terraform apply to print the value as a temporary output for debugging purposes. What should be done to avoid this? CORRECT ANSWER Use terraform console command to have an interactive UI with full access to the underlying terraform state to run your interpolations , and debug at real-time.

Provisioners should only be used as a last resort. CORRECT ANSWER True The terraform.tfstate file always matches your currently built infrastructure. CORRECT ANSWER False You have provisioned some aws resources in your test environment through Terraform for a POC work. After the POC, now you want to destroy the resources but before destroying them you want to check what resources will be getting destroyed through terraform. what are the options of doing that? CORRECT ANSWER - Use terraform plan -destroy command.

• Use terraform destroy command You have a simple Terraform configuration containing one virtual machine (VM) in a cloud provider. You run terraform apply and the VM is created successfully. What will happen if you delete the VM using the cloud provider console, and run terraform apply again without changing any Terraform code? CORRECT ANSWER Terraform will not make any changes By default, provisioners that fail will also cause the Terraform apply itself to error. How can you change this default behavior within a provisioner? CORRECT ANSWER provisioner "local-exec" { on_failure = "continue" } You should store secret data in the same version control repository as your Terraform configuration. CORRECT ANSWER False What is the default backend for Terraform? CORRECT ANSWER local Talal is a DevOps engineer and he has deployed the production infrastructure using Terraform. He is using a very large configuration file to maintain and update the actual infrastructure.

As the infrastructure have grown to a very complex and large, he has started experiencing slowness when he run runs terraform plan. What are the options for him to resolve this slowness? CORRECT ANSWER - Use -refresh=false flag as well as the -target flag with terraform plan in order to work around this.

• Break large configurations into several smaller configurations that can each be independently applied. Which of the following represents a feature of Terraform Cloud that is NOT free to customers? CORRECT ANSWER Roles and Team Management Your team has started using terraform OSS in a big way, and now wants to deploy multi region deployments (DR) in aws using the same terraform files. You want to deploy the same infra (VPC,EC2 ...) in both us-east-1 ,and us-west- using the same script , and then peer the VPCs across both the regions to enable DR traffic. But , when you run your script , all resources are getting created in only the default provider region. What should you do? Your provider setting is as below

The default pr CORRECT ANSWER Use provider alias functionality , and add

another provider for us-west region. While creating the resources using the tf script , reference the appropriate provider (using the alias). John is writing a module and within the module, there are multiple places where he has to use the same conditional expression but he wants to avoid repeating the same values or expressions multiple times in a configuration,. What is a better approach to dealing with this? CORRECT ANSWER Local Values Terraform provisioner must be nested inside a resource configuration block. CORRECT ANSWER True ABC Enterprise has recently tied up with multiple small organizations for exchanging database information. Due to this, the firewall rules are increasing and

are more than 100 rules. This is leading firewall configuration file that is difficult to manage. What is the way this type of configuration can be managed easily? CORRECT ANSWER Dynamic Blocks What are some of the problems of how infrastructure was traditionally managed before Infrastructure as Code? CORRECT ANSWER - Traditional deployment methods are not able to meet the demands of the modern business where resources tend to live days to weeks, rather than months to years

• Traditionally managed infrastructure can't keep up with cyclic or elastic applications
• Requests for infrastructure or hardware required a ticket, increasing the time required to deploy applications You have configured an Auto Scaling group in AWS to automatically scale the number of instances behind a load balancer based on the instances CPU utilization. The instances are configured using a Launch Configuration. You have observed that the Auto Scaling group doesn't successfully scale when you apply changes that require replacing the Launch Configuration. Why is this happening? CORRECT ANSWER You need to configure the Launch Configuration's create_before_destroy meta-parameter. The terraform init command is always safe to run multiple times, to bring the working directory up to date with changes in the configuration. Though subsequent runs may give errors, this command will never delete your existing configuration or state. CORRECT ANSWER True Terraform Enterprise currently supports running under which the following operating systems? CORRECT ANSWER - Ubuntu
• Amazon Linux
• Debian
• CentOS

• Red Hat Enterprise Linux
• Oracle Linux You need to deploy resources into two different cloud regions in the same Terraform configuration. To do that, you declare multiple provider configurations as follows: provider "aws" { region = "us-east-1" } provider "aws" { alias = "west" region = "us-west-2" } What meta-argument do you need to configure in a resource block to deploy the resource to the "us-west-2" AWS region? CORRECT ANSWER alias = west Which of the following clouds does not have a provider maintained by Hashicorp CORRECT ANSWER IBM Cloud Which of the below terraform commands do not run terraform refresh before taking actual action of the command CORRECT ANSWER - terraform init
• terraform import Which of the below options is a valid interpolation syntax for retrieving a data source? CORRECT ANSWER $ {data.google_dns_keys.foo_dns_keys.key_signing_keys[0].ds_record}

A user has created three workspaces using the command line - prod, dev, and test. The user wants to create a fourth workspace named stage. Which command will the user execute to accomplish this? CORRECT ANSWER terraform workspace new stage The Terraform language does not support user-defined functions, and so only the functions built in to the language are available for use. CORRECT ANSWER False If you enable TF_LOG = DEBUG, the log will be stored in syslog.log file in the currect directory? CORRECT ANSWER False Ric wants to enable detail logging and he wants highest verbosity of logs. Which of the following environment variable settings is correct option for him to select. CORRECT ANSWER Set TF_LOG = TRACE Your team lead does not trust the junior terraform engineers who now have access to the git repo. So , he wants you to have some sort of a checking layer , whereby , you can ensure that the juniors will not create any non-compliant resources that might lead to a security audit failure in future. What can you do to efficiently enforce this? CORRECT ANSWER Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them. Command terraform refresh will update state file? CORRECT ANSWER True After running into issues with Terraform, you need to enable verbose logging to assist with troubleshooting the error. Which of the following values provides the MOST verbose logging? CORRECT ANSWER TRACE

Terraform works well in Windows but a Windows server is required? CORRECT ANSWER False terraform state subcommands such as list are read-only commands, do read-only commands create state backup files? CORRECT ANSWER False Where in your Terraform configuration do you specify a state backend? CORRECT ANSWER The terraform block By default, where does Terraform store its state file? CORRECT ANSWER current working directory A single terraform resource file that defines an aws_instance resource can simply be renamed to vsphere_virtual_machine in order to switch cloud providers. CORRECT ANSWER False Your organization has moved to AWS and has manually deployed infrastructure using the console. Recently, a decision has been made to standardize on Terraform for all deployments moving forward. What can you do to ensure that all existing is managed by Terraform moving forward without interruption to existing services? CORRECT ANSWER Using terraform import, import the existing infrastructure into your Terraform state. Matt wants to import a manually created EC2 instance into terraform so that he can manage the EC2 instance through terraform going forward. He has written the configuration file of the EC2 instance before importing it to Terraform. Following is the code:

resource "aws_instance" "matt_ec2" { ami = "ami-bg2640de" instance_type = "t2.micro" vpc_security_group_ids = ["sg-6ae7d613", "sg-53370035"] key_name = "mysecret" subnet_id ="subnet-9e3cfbc5" } The instance id of that EC2 instance i CORRECT ANSWER terraform import aws_instance.matt_ec2 i-0260835eb7e9bd You run a local-exec provisioner in a null resource called null_resource.run_script and realize that you need to rerun the script. Which of the following commands would you use first? CORRECT ANSWER terraform taint null_resource.run_script Which of the following Terraform files should be ignored by Git when committing code to a repo? CORRECT ANSWER - Files named exactly terraform.tfvars or terraform.tfvars.json.

• Any files with names ending in .auto.tfvars or .auto.tfvars.json.
• terraform.tfstate You have recently started a new job at a retailer as an engineer. As part of this new role, you have been tasked with evaluating multiple outages that occurred during peak shopping time during the holiday season. Your investigation found that the team is manually deploying new compute instances and configuring each compute instance manually. This has led to inconsistent configuration between each compute instance.

How would you solve this using infrastructure as code? CORRECT ANSWER Implement a provisioning pipeline that deploys infrastructure configurations committed to your version control system following code reviews Which of the following is the correct way to pass the value in the variable num_servers into a module with the input servers? CORRECT ANSWER servers = num_servers In Terraform Enterprise, a workspace can be mapped to how many VCS repos? CORRECT ANSWER 1 State is a requirement for Terraform to function? CORRECT ANSWER True Valarie has created a database instance in AWS and for ease of use is outputting the value of the database password with the following code. Valarie wants to hide the output value in the CLI after terraform apply that's why she has used sensitive parameter.

1. output "db_password" {
2. value = local.db_password
3. sensitive = true
4. } Since sensitive is set to true, will the value associated with db password be available in plain-text in the state file for everyone to read? CORRECT ANSWER True Select two answers to complete the following sentence: Before a new provider can be used, it must be ______ and _______. CORRECT ANSWER - initialized

• declared in the configuration

What information does the public Terraform Module Registry automatically expose about published modules? CORRECT ANSWER None of the above A "backend" in Terraform determines how state is loaded and how an operation such as apply is executed. Which of the following is not a supported backend type? CORRECT ANSWER Github What is a downside to using the Vault provider to read secrets from Vault? CORRECT ANSWER Secrets are persisted to the state file and plans. What is the provider for this fictitious resource? resource "aws_pvc" "main" { name = "test" } CORRECT ANSWER aws Your manager has instructed you to start using terraform for the entire infra provisioning of the application stack. There are 4 environments - DEV , QA , UAT , and PROD. The application team has asked for complete segregation between these environments including the backend , state , and also configurations ,since there will be unique resources in different environments. What is the possible way to structure the terraform code to facilitate that. CORRECT ANSWER Completely separate the working directories , keep one for each environment. For each working directory , maintain a separate configuration file , variables file , and map to a different backend. Terraform variables and outputs that set the "description" argument will store that description in the state file? CORRECT ANSWER False

Provider dependencies are created in several different ways. Select the valid provider dependencies CORRECT ANSWER - Explicit use of a provider block in configuration, optionally including a version constraint.

• Use of any resource belonging to a particular provider in a resource or data block in configuration.
• Existence of any resource instance belonging to a particular provider in the current state. Consider the following Terraform 0.12 configuration snippet:

1. variable "vpc_cidrs" {
2. type = map
3. default = {
4. us-east-1 = "10.0.0.0/16"
5. us-east-2 = "10.1.0.0/16"
6. us-west-1 = "10.2.0.0/16"
7. us-west-2 = "10.3.0.0/16"
8. }
9. }
11. resource "aws_vpc" "shared" {
12. cidr_block = _____________
13. } How would you define the cidr_block for us-east-1 in the aws_vpc resource using a variable? CORRECT ANSWER var.vpc_cidrs["us-east-1"]

Which of the following challenges would Terraform be a candidate for solving? CORRECT ANSWER - Have a single interoperable tool to manage the variety of services including GitHub repositories, MySQL database, and Kubernetes clusters.

• Reduce the number of workflows needed for managing infrastructure across each of the companies public and private clouds.
• Enable self-service infrastructure to allocate resources on your proprietary private cloud. lookup retrieves the value of a single element from which of the below data type? CORRECT ANSWER map Select the feature below that best completes the sentence:The following list represents the different types of __________ available in Terraform.

1. max
2. min
3. join
4. replace
5. list
6. length
7. range CORRECT ANSWER Functions Which of the following are string functions? CORRECT ANSWER - Chomp

• format
• join Which of the following is available only in Terraform Enterprise or Cloud workspaces and not in Terraform CLI? CORRECT ANSWER Support for multiple cloud providers

When should you use the force-unlock command? CORRECT ANSWER Automatic unlocking failed A user creates three workspaces from the command line - prod, dev, and test. Which of the following commands will the user run to switch to the dev workspace? CORRECT ANSWER terraform workspace select dev Your company has been using Terraform Cloud for a some time now. But every team is creating their own modules , and there is no standardization of the modules , with each team creating the resources in their own unique way. You want to enforce a standardization of the modules across the enterprise. What should be your approach. CORRECT ANSWER Implement a Private module registry in Terraform cloud, and ask teams to reference them. During a terraform plan, a resource is successfully created but eventually fails during provisioning. What happens to the resource? CORRECT ANSWER the resource is marked as tainted Which of the following is considered a Terraform plugin? CORRECT ANSWER Terraform provider Only the user that generated a plan may apply it. CORRECT ANSWER True Which of the following statements best describes the Terraform list(...) type? CORRECT ANSWER a sequence of values identified by consecutive whole numbers starting with zero. What kind of resource dependency is stored in terraform.tfstate file? CORRECT ANSWER Both implicit and explicit dependencies are stored in state file.

In the example below, where is the value of the DNS record's IP address originating from?

1. resource "aws_route53_record" "www"
2. {
3. zone_id = aws_route53_zone.primary.zone_id
4. name = "www.example.com"
5. type = "A"
6. ttl = "300"
7. records = [module.web_server.instance_ip_address]
8. } CORRECT ANSWER The output of a module named web_server HashiCorp offers multiple versions of Terraform, including Terraform open- source, Terraform Cloud, and Terraform Enterprise. Which of the following Terraform features are only available in the Enterprise edition? CORRECT ANSWER - Audit Logs

• Private Network Connectivity
• Clustering
• SAML/SSO True or False? Each Terraform workspace uses its own state file to manage the infrastructure associated with that particular workspace. CORRECT ANSWER True What command should you run to display all workspaces for the current configuration? CORRECT ANSWER terraform workspace list

Select all features which are exclusive to Terraform Enterprise. CORRECT ANSWER - Audit Logs

• Clustering
• SAML/SSO Which of the following is not a valid string function in Terraform? CORRECT ANSWER slice What does the command terraform fmt do? CORRECT ANSWER Rewrite Terraform configuration files to a canonical format and style. During a terraform apply, a resource is successfully created but eventually fails during provisioning. What happens to the resource? CORRECT ANSWER The resource will be planned for destruction and recreation upon the next terraform apply When configuring a remote backend in Terraform, it might be a good idea to purposely omit some of the required arguments to ensure secrets and other important data aren't inadvertently shared with others. What are the ways the remaining configuration can be added to Terraform so it can initialize and communicate with the backend? CORRECT ANSWER - command-line key/value pairs
• use the -backend-config=PATH to specify a separate config file
• interactively on the command line Where does the Terraform local backend store its state? CORRECT ANSWER In the terraform.tfstate file What does terraform refresh command do? CORRECT ANSWER terraform refresh syncs the state file with the real world infrastructure.

True or False? By default, Terraform destroy will prompt for confirmation before proceeding. CORRECT ANSWER True Once a resource is marked as tainted, the next plan will show that the resource will be _________ and___________ and the next apply will implement this change. CORRECT ANSWER destroyed and recreated Refer to the following terraform variable definition variable "track_tag" { type = list default = ["data_ec2","integration_ec2","digital_ec2"] } track_tag = { Name = element(var.track_tag,count.index)} If count.index is set to 2, which of the following values will be assigned to the name attribute of track_tag variable? CORRECT ANSWER digital_ec You want to get involved in the development of Terraform. As this is an open source project, you would like to contribute a fix for an open issue of Terraform. What programming language will need to use to write the fix? CORRECT ANSWER Go What is not processed when running a terraform refresh? CORRECT ANSWER - Credentials

• Cloud provider

What does terrafom plan do? CORRECT ANSWER Create an execution plan by evaluating the difference between configuration file and state file. Which of the following Terraform commands will automatically refresh the state unless supplied with additional flags or arguments? CORRECT ANSWER - terraform plan

• terraform apply You have created two workspaces PROD and DEV. You have switched to DEV and provisioned DEV infrastructure from this workspace. Where is your state file stored? CORRECT ANSWER terraform.tfstate.d Which task does terraform init not perform? CORRECT ANSWER Validates all required variables are present When Terraform needs to be installed in a location where it does not have internet access to download the installer and upgrades, the installation is generally known as to be __________. CORRECT ANSWER non-traditional Which of the below features of Terraform can be used for managing small differences between different environments which can act more like completely separate working directories. CORRECT ANSWER Workspaces Which of the following best describes the default local backend? CORRECT ANSWER The local backend stores state on the local filesystem, locks the state using system APIs, and performs operations locally. Terraform has detailed logs which can be enabled by setting the _________ environmental variable. CORRECT ANSWER TF_LOG

Select the operating systems which are supported for a clustered Terraform Enterprise CORRECT ANSWER -Red Hat

• CentOS
• Amazon Linux
• Ubuntu Given the below resource configuration - resource "aws_instance" "web" { # ... count = 4 } What does the terraform resource address aws_instance.web refer to? CORRECT ANSWER It refers to all 4 web instances , together , for further individual segregation , indexing is required , with a 0 based index. You have declared a variable called var.list which is a list of objects that all have an attribute id. Which options will produce a list of the IDs? CORRECT ANSWER - var.list[*].id
• { for o in var.list : o => o.id } Which of the following variable definition files will terraform load automatically? CORRECT ANSWER - Any files with names ending in .auto.tfvars.json
• terraform.tfvars
• terraform.tfvars.json What is the standard workflow that a developer follows while working with terraform open source version? CORRECT ANSWER Write the terraform code on the developer machine , run terraform plan to check the changes , and run terraform apply to provision the infra.

Which two steps are required to provision new infrastructure in the Terraform workflow? CORRECT ANSWER - init

• apply Which feature of Terraform allows multiple state files for a single configuration file depending upon the environment? CORRECT ANSWER Terraform Workspaces You have created a custom variable definition file testing.tfvars. How will you use it for provisioning infrastructure? CORRECT ANSWER terraform apply -var- file="testing.tfvars" Which of the below configuration file formats are supported by Terraform? CORRECT ANSWER - JSON
• HCL Terraform Enterprise (also referred to as pTFE) requires what type of backend database for a clustered deployment? CORRECT ANSWER PostgreSQL While Terraform is generally written using the HashiCorp Configuration Language (HCL), what other syntax can Terraform are expressed in? CORRECT ANSWER JSON A variable az has the following default value. What will be the datatype of the variable? az=["us-west-1a","us-east-1a"] CORRECT ANSWER List

What is the workflow for deploying new infrastructure with Terraform? CORRECT ANSWER terraform plan to import the current infrastructure to the state file, make code changes, and terraform apply to update the infrastructure When writing Terraform code, HashiCorp recommends that you use how many spaces between each nesting level? CORRECT ANSWER 2 In terraform, most resource dependencies are handled automatically. Which of the following statements describes best how terraform resource dependencies are handled? CORRECT ANSWER Terraform analyses any expressions within a resource block to find references to other objects, and treats those references as implicit ordering requirements when creating, updating, or destroying resources. Which option can not be used to keep secrets out of Terraform configuration files? CORRECT ANSWER A -var flag In regards to Terraform state file, select all the statements below which are correct? CORRECT ANSWER - Terraform Cloud always encrypts state at rest.

• Storing state remotely can provide better security
• When using local state, the state file is stored in plain-text.
• The Terraform state can contain sensitive data, therefore the state file should be protected fromunauthorized access Select the most accurate statement to describe the Terraform language from the following list CORRECT ANSWER Terraform is an immutable, declarative, Infrastructure as Code provisioning language based onHashicorp Configuration Language, or optionally JSON If a module declares a variable with a default, that variable must also be defined within the module. CORRECT ANSWER False

Which of the following allows Terraform users to apply policy as code to enforce standardized configurations for resources being deployed via infrastructure as code? CORRECT ANSWER Sentinel Which argument(s) is (are) required when declaring a Terraform variable? CORRECT ANSWER default Which of the following state management command allow you to retrieve a list of resources that are part of the state file? CORRECT ANSWER terraform state list Select the answer below that completes the following statement: Terraform Cloud can be managed from the CLI but requires __________? CORRECT ANSWER an API token Which provisioner invokes a process on the resource created by Terraform? CORRECT ANSWER remote-exec Where are providers downloaded by terraform init stored? CORRECT ANSWER Providers downloaded by terraform init are only installed for the current working directory; other working directories can have their own installed provider versions. Can terraform init download third party providers that are not distributed by HashiCorp CORRECT ANSWER False How do you constrain the provider version? CORRECT ANSWER add a required_providers block

How do you upgrade the terraform provider? CORRECT ANSWER terraform init -upgrade How can you optionally define multiple configurations for the same provider, and select which one to use on a per-resource or per-module basis. CORRECT ANSWER use alias Where are providers downloaded to? CORRECT ANSWER locally If multiple versions of a plugin are installed, Terraform will use? CORRECT ANSWER If multiple versions of a plugin are installed, Terraform will use the newest version that meets the configuration's version constraints. The name of a variable can be any valid identifier except the following CORRECT ANSWER source version providers count for_each lifecycle depends_on locals How can an input variable be accessed? CORRECT ANSWER its value can be accessed from within expressions as var., where matches the label given in the declaration block What is a type constraint? CORRECT ANSWER The type argument in a variable block allows you to restrict the type of value that will be accepted as the value for a variable. If no type constraint is set then a value of any type is accepted. What are the three type constraints? CORRECT ANSWER - string

• number
• bool What are the 5 complex types? CORRECT ANSWER - list()

• set()
• map()
• object({ = , ... })
• tuple([, ...]) How can you set variables? CORRECT ANSWER - In a Terraform Cloud workspace.
• Individually, with the -var command line option.
• In variable definitions (.tfvars) files, either specified on the command line or automatically loaded.
• As environment variables. How do you specify a variable on the command line? CORRECT ANSWER terraform apply -var="image_id=ami-abc123" How to set lots of variables in a file? CORRECT ANSWER To set lots of variables, it is more convenient to specify their values in a variable definitions file (with a filename ending in either .tfvars or .tfvars.json)terraform apply -var- file="testing.tfvars" What does a variable definition in .tfvars file look like? CORRECT ANSWER image_id = "ami-abc123" availability_zone_names = [ "us-east-1a", "us-west-1c", ] Which vars files will terraform automatically load if available? CORRECT ANSWER - Files named exactly terraform.tfvars or terraform.tfvars.json.
• Any files with names ending in .auto.tfvars or .auto.tfvars.json.