HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 41:

  You decide to move a Terraform state file to Amazon S3 from another location. You write the code below into a file called\

  

  You immediately run terraform apply but don't see any changes. Your state file didn't move. Which command will migrate your current state file to the new S3 remote backend?

  A. terraform push

  B. terraform init

  C. terraform refresh

  D. terraform state

  Correct Answer: B

• Question 42:

  State is a requirement for Terraform to function

  A. True

  B. False

  Correct Answer: A

  State is a necessary requirement for Terraform to function. It is often asked if it is possible for Terraform to work without state, or for Terraform to not use state and just inspect cloud resources on every run. Purpose of Terraform State State is a necessary requirement for Terraform to function. It is often asked if it is possible for Terraform to work without state, or for Terraform to not use state and just inspect cloud resources on every run. This page will help explain why Terraform state is required. As you'll see from the reasons below, state is required. And in the scenarios where Terraform may be able to get away without state, doing so would require shifting massive amounts of complexity from one place (state) to another place (the replacement concept).

  1.

  Mapping to the Real World Terraform requires some sort of database to map Terraform config to the real world. When you have a resource resource "aws_instance" "foo" in your configuration, Terraform uses this map to know that instance i-abcd1234 is represented by that resource. For some providers like AWS, Terraform could theoretically use something like AWS tags. Early prototypes of Terraform actually had no state files and used this method. However, we quickly ran into problems. The first major issue was a simple one: not all resources support tags, and not all cloud providers support tags. Therefore, for mapping configuration to resources in the real world, Terraform uses its own state structure.

  2.

  Metadata Alongside the mappings between resources and remote objects, Terraform must also track metadata such as resource dependencies. Terraform typically uses the configuration to determine dependency order. However, when you delete a resource from a Terraform configuration, Terraform must know how to delete that resource. Terraform can see that a mapping exists for a resource not in your configuration and plan to destroy. However, since the configuration no longer exists, the order cannot be determined from the configuration alone. To ensure correct operation, Terraform retains a copy of the most recent set of dependencies within the state. Now Terraform can still determine the correct order for destruction from the state when you delete one or more items from the configuration. One way to avoid this would be for Terraform to know a required ordering between resource types. For example, Terraform could know that servers must be deleted before the subnets they are a part of. The complexity for this approach quickly explodes, however: in addition to Terraform having to understand the ordering semantics of every resource for every cloud, Terraform must also understand the ordering across providers. Terraform also stores other metadata for similar reasons, such as a pointer to the provider configuration that was most recently used with the resource in situations where multiple aliased providers are present.

  3.

  Performance In addition to basic mapping, Terraform stores a cache of the attribute values for all resources in the state. This is the most optional feature of Terraform state and is done only as a performance improvement. When running a terraform plan, Terraform must know the current state of resources in order to effectively determine the changes that it needs to make to reach your desired configuration. For small infrastructures, Terraform can query your providers and sync the latest attributes from all your resources. This is the default behavior of Terraform: for every plan and apply, Terraform will sync all resources in your state. For larger infrastructures, querying every resource is too slow. Many cloud providers do not provide APIs to query multiple resources at once, and the round trip time for each resource is hundreds of milliseconds. On top of this, cloud providers almost always have API rate limiting so Terraform can only request a certain number of resources in a period of time. Larger users of Terraform make heavy use of the-refresh=false flag as well as the-target flag in order to work around this. In these scenarios, the cached state is treated as the record of truth.

  4.

  Syncing In the default configuration, Terraform stores the state in a file in the current working directory where Terraform was run. This is okay for getting started, but when using Terraform in a team it is important for everyone to be working with the same state so that operations will be applied to the same remote objects. Remote state is the recommended solution to this problem. With a fully-featured state backend, Terraform can use remote locking as a measure to avoid two or more different users accidentally running Terraform at the same time, and thus ensure that each Terraform run begins with the most recent updated state.

• Question 43:

  Which of the following does terraform apply change after you approve the execution plan? Choose two correct answers.

  A. The execution plan

  B. Terraform code

  C. Cloud infrastructure

  D. State file

  E. The .terraform directory

  Correct Answer: CD

• Question 44:

  After executing a terraform apply, you notice that a resource has a tilde (~) next to it. What does this infer?

  A. The resource will be updated in place.

  B. The resource will be created.

  C. Terraform can't determine how to proceed due to a problem with the state file.

  D. The resource will be destroyed and recreated.

  Correct Answer: A

  The prefix-/+ means that Terraform will destroy and recreate the resource, rather than updating it in-place.

  The prefix ~ means that some attributes and resources can be updated in-place.

  $ terraform apply

  aws_instance.example: Refreshing state... [id=i-0bbf06244e44211d1] An execution plan has been generated and is shown below. Resource actions are indicated with the following symbols:

  -/+ destroy and then create replacement

  Terraform will perform the following actions:

  # aws_instance.example must be replaced

  -/+ resource "aws_instance" "example" {

  ~ ami = "ami-2757f631"-> "ami-b374d5a5" # forces replacement ~ arn = "arn:aws:ec2:us-east-1:130490850807:instance/i-0bbf06244e44211d1"-> (known after apply) ~ associate_public_ip_address = true-> (known after apply) ~

  availability_zone = "us-east-1c"-> (known after apply) ~ cpu_core_count = 1-> (known after apply) ~ cpu_threads_per_core = 1-> (known after apply)

  -disable_api_termination = false-> null

  -ebs_optimized = false-> null

  get_password_data = false

  +

  host_id = (known after apply)

  ~ id = "i-0bbf06244e44211d1"-> (known after apply) ~ instance_state = "running"-> (known after apply) instance_type = "t2.micro" ~ ipv6_address_count = 0-> (known after apply)

  ~ ipv6_addresses = []-> (known after apply)

  +

  key_name = (known after apply)

  -monitoring = false-> null

  +

  network_interface_id = (known after apply)

  +

  password_data = (known after apply)

  +

  placement_group = (known after apply)

  ~ primary_network_interface_id = "eni-0f1ce5bdae258b015"-> (known after apply) ~ private_dns = "ip-172-31-61-141.ec2.internal"-> (known after apply) ~ private_ip = "172.31.61.141"-> (known after apply) ~ public_dns = "ec2-54-166-19244.compute-1.amazonaws.com"-> (known after apply) ~ public_ip = "54.166.19.244"-> (known after apply) ~ security_groups = [

  -"default",

  ]-> (known after apply)

  source_dest_check = true

  ~ subnet_id = "subnet-1facdf35"-> (known after apply) ~ tenancy = "default"-> (known after apply)

  ~ volume_tags = {}-> (known after apply)

  ~ vpc_security_group_ids = [

  -"sg-5255f429",

  ]-> (known after apply)

  -credit_specification {

  -cpu_credits = "standard"-> null

  }

  +

  ebs_block_device {

  +

  delete_on_termination = (known after apply)

  +

  device_name = (known after apply)

  +

  encrypted = (known after apply)

  +

  iops = (known after apply)

  +

  snapshot_id = (known after apply)

  +

  volume_id = (known after apply)

  +

  volume_size = (known after apply)

  +

  volume_type = (known after apply)

  }

  +

  ephemeral_block_device {

  +

  device_name = (known after apply)

  +

  no_device = (known after apply)

  +

  virtual_name = (known after apply)

  }

  +

  network_interface {

  +

  delete_on_termination = (known after apply)

  +

  device_index = (known after apply)

  +

  network_interface_id = (known after apply)

  }

  ~ root_block_device {

  ~ delete_on_termination = true-> (known after apply) ~ iops = 100-> (known after apply)

  ~ volume_id = "vol-0079e485d9e28a8e5"-> (known after apply) ~ volume_size = 8-> (known after apply)

  ~ volume_type = "gp2"-> (known after apply)

  }

  }

  Plan: 1 to add, 0 to change, 1 to destroy.

• Question 45:

  What Terraform feature is shown in the example below?

  A. conditional expression

  B. local values

  C. dynamic block

  D. data source

  Correct Answer: C

• Question 46:

  When configuring a remote backend in Terraform, it might be a good idea to purposely omit some of the required arguments to ensure secrets and other important data aren't inadvertently shared with others. What are the ways the remaining configuration can be added to Terraform so it can initialize and communicate with the backend? (select three)

  A. directly querying HashiCorp Vault for the secrets

  B. command-line key/value pairs

  C. use the-backend-config=PATH to specify a separate config file

  D. interactively on the command line

  Correct Answer: BCD

  You do not need to specify every required argument in the backend configuration. Omitting certain arguments may be desirable to avoid storing secrets, such as access keys, within the main configuration. When some or all of the arguments are omitted, we call this a partial configuration. With a partial configuration, the remaining configuration arguments must be provided as part of the initialization process. There are several ways to supply the remaining arguments: https://www.terraform.io/docs/backends/init.html#backendinitialization

• Question 47:

  What does terraform import allow you to do?

  A. Import a new Terraform module

  B. Use a state file to import infrastructure to the cloud

  C. Import provisioned infrastructure to your state file

  D. Import an existing state file to a new Terraform workspace

  Correct Answer: C

• Question 48:

  terraform apply will fail if you have not run terraform plan first to update the plan output.

  A. True

  B. False

  Correct Answer: B

• Question 49:

  Which Terraform collection type should you use to store key/value pairs?

  A. set

  B. tuple

  C. list

  D. map

  Correct Answer: D

  Maps/objects are represented by a pair of curly braces containing a series of = pairs

  Source: https://www.terraform.io/language/expressions/types

• Question 50:

  Which type of block fetches or computes information for use elsewhere in a Terraform configuration?

  A. provider

  B. resource

  C. local

  D. data

  Correct Answer: D

  Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to build on information defined outside of Terraform, or defined by another separate Terraform configuration.