First

Question 1

Your company is currently running terraform for development of web application using AWS services. One of your teammates wants to modify the type of the instances currently used to “t2.large”and is asked to change the default set values.

What changes does he have to make to get it working?

A. Issue Terraform plan instance.type”.t2.large” and it deploys the instance

B. Modify the tf.variables with the instance type and issue terraform apply

C. Create a new file my.tfvars and add the type of the instance and issue terraform plan and apply

D. Modify the terraform.tfvars with the instance type and issue terraform plan and then terraform
apply to deploy the instances

Answer 1

D. Modify the terraform.tfvars with the instance type and issue terraform plan and then terraform apply to deploy the instances

Option A is incorrect because the syntax is wrong using cli command to change the instance type is terraform plan -var=”instancetype=t2.large” in the above option it is mentioned as “Instance.type”.t2.large and terraform plan doesn’t deploy the instance

Option B is incorrect though recommended practice is to rather than changing the default values terraform.tfvars variables to be modified, there is no tf.variables in terraform. Always it is good practice to check before apply so terraform plan to check the instance type and then terraform apply for changes

Option C is incorrect as terraform recommended type is terraform.tfvars for anyother tf.vars file types use cli terraform plan -var-file=”my.tfvars”

Reference: https://www.terraform.io/docs/commands/environment-variables.html

https://www.terraform.io/docs/commands/plan.html

Question 2

You are part of a security team that noticed current terraform code outputs the password of database after you issue terraform apply. You have been asked to make sure password is not in the output.

How do you approach this?

A. Encrypt the plain text values to show output as random values

B. Password is encrypted in database

C. Use Sensitive Parameter

D. Use terraform plan -var-file= “password=no” to hide output values

Answer 2

C. Use Sensitive Parameter

Use a sensitive parameter it does not show output value at terraform apply, plan however if you have
access the state files password can be seen in plain-text format

Reference: https://www.terraform.io/docs/state/sensitive-data.html

Question 3

One of your colleagues is new to terraform and wants to add a new workspace new-hire.

What command will he execute?

A. terraform workspace –new –new-hire

B. terraform workspace new new-hire

C. terraform workspace init new-hire

D. terraform workspace new-hire

Answer 3

B. terraform workspace new new-hire

Terraform workspace new is the right syntax to be used whenever you want to create a new workspace

Example :
$terraform workspace new new-hire
Created and switched to workspace “new-hire”

Question 4

You are planning to install terraform on client machines and are asked to evaluate which OS versions are supported. Please choose the correct option.

A. Windows

B. Amazon Linux

C. FreeBSD

D. Unix

E. MacOS

F. All the above

Answer 4

F. All the above

All given options are correct. Amazon Linux is just another flavor of Linux. Terraform works perfectly well on it.

Reference: https://www.terraform.io/downloads.html

Question 5

John is a newbie to terraform and he wants to enable details logs.

What variables does he need to define?

A. TF_help

B. TF_LOG

C. TF_Debug

D. TF_var_log

Answer 5

B. TF_LOG

Terraform does provide detailed logging and helps to find the errors in the flow

By using TF_LOG enabled you can set to TRACE, INFO, WARN or ERROR, DEBUG Levels

Question 6

You have made changes to your tfvar files and would like to know contents of the state file.

What command is used to check?

A. Terraform state

B. Terraform current

C. Terraform show

D. Terraform inspect

Answer 6

C. Terraform show

Terraform show command provides output from state or plain file in a readable format

This is used to verify the current state contents and inspect the plan to make sure everything is right.

There is terraform show – json to show outputs in json format

Question 7

Your company uses git and asked you to commit all the terraform code to git and advised you to be careful with sensitive information during commit.

What file should you NOT include in the commit ?

A. Terraform.tfs

B. Variables.tf

C. Terraform.tfdata

D. Terraform.tfstate

Answer 7

D. Terraform.tfstate

Usually terraform.tfvars and terraform.tfstate files contain sensitive data like password, access keys and db password. It is best to avoid these files from committing.

Question 8

Your company currently has infrastructure running in Azure and planning to use terraform.
You have been asked to plan, implement, and make sure existing infrastructure is migrated properly.
You used terraform import but notice that import is not successful.

What are the things to be taken care of before import?

A. Make sure existing resources are in shutdown state so that during import there are no issues

B. Make sure resources of the existing infrastructure are updated in the configuration file right

C. Add all the resource details to state files

D. Run terraform show and refresh to see updated state files and then terraform import

Answer 8

B. Make sure resources of the existing infrastructure are updated in the configuration file right

Terraform currently supports imports of a resource into state file but not with configuration file. It is recommended to manually add the resource configuration before terraform import.

Question 9

You have been asked to make terraform code more dynamic with minimum use of static values.

What options from below you will use?

A. Variables

B. Local values

C. input variable

D. Modules

Answer 9

C. input variable

Input variables serve as parameters for a Terraform module, allowing aspects of the module to be customized without altering the module’s own source code, and allowing modules to be shared between different configurations.

When you declare variables in the root module of your configuration, you can set their values using CLI options and environment variables. When you declare them in child modules, the calling module should pass values in the module block.

If you’re familiar with traditional programming languages, it can be useful to compare Terraform modules to function definitions:

Input variables are like function arguments

Output values are like function return values.

Local values are like a function’s temporary local variables.

Reference: https://www.terraform.io/docs/language/values/variables.html

Question 10

Which is not a variable defined in terraform?

A. tfvar

B. depends_on

C. instance_aws

D. var1

Answer 10

B. depends_on

Use the depends_on meta-argument to handle hidden resource or module dependencies that Terraform can’t automatically infer.

Question 11

You have accidentally put lock on a configuration file - what command would you use to remove the lock and make it available?

A. terraform filename-unlock

B. delete the file and create a new state file

C. terraform force-unlock

D. state.tf -unlock

Answer 11

C. terraform force-unlock

force unlock command helps to manually unlock the state configuration. It doesn’t change the infrastructure.

Question 12

Whenever you issue “terraform init” where are all the configurations saved?

A. terraform. tfstate stores all the current configuration

B. .terraform/home is the home directory for terraform.init

C. .terraform/plugins directory for terraform.init

D. Config.tf where all the init configurations are saved to

Answer 12

C. .terraform/plugins directory for terraform.init

.terraform/plugins

Whenever terraform is initialized all the plugin related files are stored and downloaded under .terraform/plugins

Question 13

Your colleague is running into issues with terraform and when looking at errors it looks like he incorrectly set the environment variables.

What will you look into for debugging?

A. TF_set

B. TF_VAR

C. TF_.var

D. TF_var_Filename

Answer 13

B. TF_VAR

All the environment variables to configured must be in the format of TF_VAR_name

Examples are TF_VAR_region=us-east-1

Question 14

You want to evaluate an expression in terraform before applying it.

Which command will you use from below?

A. Graph

B. Validate

C. Console

D. Push

Answer 14

C. Console

Terraform console command is used to evaluate expressions in terraform

Issue terraform console and try to execute the supported expressions

Question 15

Which database has its own provider?

A. MySQL

B. Mongo

C. Dynamo

D. influx

Answer 15

A. MySQL

https://www.terraform.io/docs/providers/index.html

Question 16

Which option will you use to run a provisioners which are not associated with any resources?

A. local-exec

B. “_”:null-resource right

C. salt-masterless

D. remote-exec

Answer 16

B. “_”:null-resource right

To run provisioners which are not associated with any resources you would need to use null_resource . like other resources using null_resource configurations can be added

Question 17

Which language is supported by terraform configuration?

A. xml

B. javascript

C. JSON

D. Plaintext

Answer 17

C. JSON

Terraform usually supports files ending in .tf format but they also support files in tf.json format

Reference: https://www.terraform.io/docs/configuration/syntax-json.html

Question 18

You have the following configuration, but notice an error saying duplicate provider configuration.
What command from below you will use to make sure multiple configurations are allowed?

Provider “aws” {
Region = us-west-2”
}
Provider “aws” {
Region = “eu-central-1”
}
Provider “aws” {
Region = ap-north-2”
}

A. Alias

B. Label

C. Module

D. Resource for each provider

Answer 18

A. Alias

By using alias command we can configure different configurations to same provider pointing to different resources

Reference: https://www.terraform.io/docs/configuration/providers.html

Question 19

What is the provider version of Google Cloud being used in Terraform? (select two)

Google = “~> 1.9.0”

A. 1.9.1

B. 1.0.0

C. 1.8.0

D. 1.9.2

Answer 19

A. 1.9.1
D. 1.9.2

Terraform is looking for any update above 1.9.0, which can 1.9.1 and 1.9.2

According to the Terraform doc, the operator ~> means only the minor (rightmost version increase) updates are accepted. Therefore, ~> 1.9.0 means the related module / provider requirement accepts 1.9.1 or 1.9.2, but not 1.10.0, and absolutely not 1.0.0 or 1.8.0

Reference: https://www.terraform.io/docs/language/expressions/version-constraints.html

Question 20

Which of the below are supported backend types in terraform? (select three)

A. consul

B. gcs

C. manta

D. bitbucket

Answer 20

A. consul
B. gcs
C. manta

Enhanced backends:

• local
• remote

Standard backends:

• artifactory
• azurerm
• consul
• cos
• etcd
• etcdv3
• gcs
• kubernetes
• manta
• oss
• pg
• s3
• swift

https://www.terraform.io/docs/backends/types/index.html

Question 21

Terraform plan looks at the code and modifies if there are any missing arguments etc before apply

A. True

B. False

Answer 21

B. False

Terraform plan looks at code and identifies if there are any syntax errors or missing arguments and errors and user has to fix these before issuing next terraform plan

Question 22

Do terraform workspaces help in adding/allowing multiple state files for a single configuration?

A. Yes

B. No

Answer 22

A. Yes

Terraform workspaces allows configuring multiple state files and associating with a single configuration file

https://www.terraform.io/docs/state/workspaces.html

Question 23

Resources in terraform can have same names and terraform automatically assigns them in order of precedence.

A. True

B. False

Answer 23

B. False

Terraform resources should have unique names you cannot have same name for resources

Question 24

You have created a virtual machine manually on azure and would like to use terraform import to import it.

Does terraform import work in this scenario?

A. Yes

B. No

Answer 24

A. Yes

Import :
terraform import azurerm_virtual_machine.example /subscriptions/00000000-0000-0000-0000-
000000000000/resourceGroups/mygroup1/providers/microsoft.compute/virtualMachines/machine1

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_machine

Question 25

If you apply sensitive flag for database password upon terraform apply and plan, will the password be shown in plain text in logs?

A. Yes

B. No

Answer 25

B. No

If sensitive flag is applied with terraform apply and plan then output are not shown.

However if you have access to state files output still shows as plaintext.

Question 26

Is terraform state rm the only way to delete all the resources in terraform?

A. Yes

B. No

Answer 26

B. No

1. There is no “terraform rm” only “terraform state rm”
2. The documentation for “terraform state rm” shows that it does not delete resources. It deletes resources in the terraform state. Those are two different things.
   The documentation even explicitly says “For example, if you remove an AWS instance from the state, the instance will continue running”
3. Terraform state rm is used for individual resources so while it might be possible to use it to delete every individual resource, it is not meant to.

Terraform destroy is the only one that deletes resources.

https://www.terraform.io/docs/cli/commands/state/rm.html

Question 27

Will your team be able to make changes to the statefile once you’ve run ‘terraform plan’?

A. Yes

B. No

Answer 27

B. No

Terraform doesn’t restricts only one user to perform apply, plan at the same time.

Question 28

Should current state and desired state should be in same state all the time?

A. Yes

B. No

Answer 28

B. No

It is not mandatory for both states to be in same however best practices recommend they should be in sync to avoid infrastructure issues in production

Question 29

Will the auto-approve option with terraform destroy require confirmation from user before destroying the resources?

A. Yes

B. No

Answer 29

B. No

Destroying your infrastructure is a rare event in production environments. But if you’re using Terraform to spin up multiple environments such as development, testing, and staging, then destroying is often a useful action.

»Destroy
Resources can be destroyed using the terraform destroy command, which is similar to terraform apply but it behaves as if all of the resources have been removed from the configuration.

https://learn.hashicorp.com/tutorials/terraform/google-cloud-platform-destroy?in=terraform/gcp-getstarted

Question 30

When you add a new provider, do you always need to issue terraform init?

A. Yes

B. No

Answer 30

A. Yes

Whenever you add a new provider it is always required to issue a terraform init so that it will download the latest provider or specified version and initialization files to .terraform folder.

Question 31

You have an AWS provider and are planning to add multiple resource blocks. You have added ec2 and lb in one resource, GCP values in another resource.

Will this configuration work?

A. Yes

B. No

Answer 31

B. No

Though you can have multiple resources under a provider, they have to be related to provider. You cannot add other resources belonging to different provider.

Question 32

Do Terraform dynamic blocks allow you to have multiple nested blocks inside a resource, data, etc.?

A. Yes

B. No

Answer 32

A. Yes

Using dynamic blocks we can have multiple nested blocks defined and it helps preventing long code and helps to manage easily

A dynamic block acts much like a for expression, but produces nested blocks instead of a complex typed value. It iterates over a given complex value, and generates a nested block for each element of that complex value.

https://www.terraform.io/docs/language/expressions/dynamic-blocks.html

Question 33

Using terraform iterator, we can set name to a temporary variable that matches to an element

A. True

B. False

Answer 33

A. True

According to the documentation:
If omitted, the name of the variable defaults to the label of the dynamic block and the name above is ingress (notice it is the label specified adjacent to the dynamic block).

Sure enough, we see the name of the temporary variable above is ingress and it is being accessed via ingress.value. To utilize the functionality of iterator to rename this temporary variable, we can do something like the below.

resource "aws_security_group" "example" {
  name = "example" # can use expressions here
dynamic "ingress" {
  for_each = var.service_ports
  iterator = "service_port"
  content {
    from_port = service_port.value
    to_port = service_port.value
    protocol = "tcp"
    }
  }
}
thus renaming the temporary variable storing the element of var.service_ports in each iteration within the lambda from default name ingress to service_port. 

https://www.terraform.io/docs/language/expressions/dynamic-blocks.html

Question 34

In Production Environment, is it always recommended to hardcode the provider version?

A. Yes

B. No

Answer 34

A. Yes

Though it is good option to have latest version running but in production it is best to run on known version rather than using latest version with issues which can cause breakage.

Question 35

Does terraform standard backend type support remote management system?

A. Yes

B. No

Answer 35

B. No

The docs outline two types of backends: enhanced and standard.

Enhanced backends are local, which is the default, and remote, which generally refers to Terraform Cloud. The one major feature of an enhanced backend is the support for remote operations

https://www.terraform.io/docs/language/settings/backends/remote.html

Question 36

Can we switch between terraform workspaces? Suppose we have a workspace A and default, can we switch the workspace while working with default workspace to Workspace A and vice versa?

A. Yes

B. No

Answer 36

A. Yes

Using terraform workspace switch - it will select the workspace otherwise will pick the default one.

The terraform workspace select command is used to choose a different workspace to use for further operations.

Usage: terraform workspace select [NAME]

This command will select another workspace. The named workspace must already exist.

»Example
$ terraform workspace list
    default
* development
    jsmith-test

$ terraform workspace select default
Switched to workspace “default”.

https://www.terraform.io/docs/language/state/workspaces.html

Question 37

Does S3 supports terraform remote backend?

A. Yes

B. No

Answer 37

A. Yes

To make use of the S3 remote state in another configuration, use the terraform_remote_state data source.

https://www.terraform.io/docs/backends/types/s3.html

Question 38

Does terraform refresh command updates the state files?

A. Yes

B. No

Answer 38

A. Yes

Yes terraform refresh updates the state files to latest unless there are any manual changes.

Question 39

Does terraform state mv create a backup copy by default?

A. Yes

B. No

Answer 39

A. Yes

Terraform state mv creates a backup copy by default

https://www.terraform.io/docs/commands/state/mv.html

Question 40

Is Mongodb Atlas a supported database provider approved by hashicorp?

A. Yes

B. No

Answer 40

A. Yes

https://www.terraform.io/docs/providers/type/database-index.html

Question 41

You are an admin as you have performed terraform init. A developer from your team also working on terraform initiated terraform init again, four times.

Does that mean providers configuration are downloaded four times?

A. Yes

B. No

Answer 41

B. No

The first time terraform init will check for the provider and download the contents and store them in terraform folder. With subsequent downloads, it looks at local file and doesn’t go to fetch from provider unless there is any version check mentioned

Question 42

You have configured a variable and didn’t set any value.

Does it ask for input value when you run terraform plan?

A. Yes

B. No

Answer 42

A. Yes

Whenever there is variable set and no value configured upon terraform plan it will give an option to enter the value

Question 43

You are network admin managing terraform deployments on both terraform cloud and local. You perform terraform refresh.

Does that modify all the contents on cloud and local?

A. Yes

B. No

Answer 43

B. No

Terraform refresh is good on local environment but doesn’t account the terraform cloud.

The terraform refresh command reads the current settings from all managed remote objects and updates the Terraform state to match.

Question 44

Does terraform apply validate the terraform syntax like missing arguments, etc.?

A. Yes

B. No

Answer 44

B. No

The terraform validate command validates the configuration files in a directory, referring only to the configuration and not accessing any remote services such as remote state, provider APIs, etc

https://www.terraform.io/docs/cli/commands/validate.html

Question 45

Using remote provisioner changes can be made to existing instances like installing tools and configs.

A. True

B. False

Answer 45

A. True

Using remote provisioner changes can be made for example you want to add contents to EC2 instances which are already deployed use remote provisioner to make changes

Question 46

Is terraform init -upgrade the right option to upgrade/download to the latest providers?

A. Yes

B. No

Answer 46

A. Yes

Using terraform init-upgrade one can upgrade to the latest terraform providers

Question 47

Your team works on terraform heavily and noticed that terraform fmt is failing - can this be due to state lock?

A. Yes

B. No

Answer 47

B. No

Whenever state file is locked there won’t be changes made to it, but it doesn’t stop from using terraform fmt but fails when issued terraform apply

Question 48

Whenever you issue terraform destroy command, it removes the state files and moves to infrastructure to cold state.

A. True

B. False

Answer 48

B. False

Whenever terraform destroy command is issued it will destroy the state files and infrastructure as well

Question 49

You have accidentally deleted a resource on the cloud instance (for example, an AWS ec2 instance). You have manually added it in terraform configuration.

When you issue terraform apply does the resource gets created and show up?

A. Yes

B. No

Answer 49

A. Yes

Yes, the resource will be updated in the terraform state file and be created.

Question 50

Dynamic blocks help to manage the complex configurations

A. True

B. False

Answer 50

A. True

Using dynamic blocks complex configuration with 100 of lines can be easily managed

Question 51

Terraform fmt is to be used whenever you want to destroy and create a new instance

A. True

B. False

Answer 51

B. False

Terraform Taint is the correct command to be used whenever anyone wants to delete and recreate the resources

Question 52

Does Consul help in locking the state file for remote backend?

A. Yes

B. No

Answer 52

A. Yes

Yes, by using terraform consul we can lock the state files for remote backend

Question 53

Is Sentinel usually applied before terraform plan?

A. Yes

B. No

Answer 53

B. No

Sentinel is applied before terraform apply and after terraform plan

Question 54

Is Terraform graphviz is used to create terraform dot files?

A. Yes

B. No

Answer 54

B. No

Terraform graph is used to create the dot files and graphviz is used to create graphical representation of it.

Question 55

You have been asked to save the contents of terraform to a test.file. You used terraform plan -out=’test.file’

Is this the correct syntax?

A. Yes

B. No

Answer 55

A. Yes

You can save the contents of the file by using terraform plan and the flag
-out=’test.File’

Question 56

Terraform state file is locked. If you issue a terraform destroy command does that delete all the contents?

A. Yes

B. No

Answer 56

B. No

Using terraform state file locked terraform fmt works but apply and plan and destroy whichever makes changes to state file are blocked.

Question 57

You have locked your state file and one of your colleague issues a terraform apply.

Does all the content get created?

A. Yes

B. No

Answer 57

B. No

Whenever state file is locked terraform apply will not get into effect

Question 58

You are the terraform lead and you created all the terraform code. Whenever your team member wants to apply, do they have to approach you to click apply since it is created by you?

A. Yes

B. No

Answer 58

B. No

Though you created terraform plan it doesn’t stop others from applying to it

Question 59

Is null-exec the provisioner that is applied on machine where terraform is running locally with variable null?

A. Yes

B. No

Answer 59

B. No

Local-exec is the right provisioner to be used whenever you want to run locally

Question 60

There are some duplicate resources that are being created- after terraform apply will the duplicate resources be created?

A. Yes

B. No

Answer 60

A. Yes

After running the apply the state file will be updated and according tot hat the infrastructure will also be updated