HashiCorp TERRAFORM-ASSOCIATE-003 Online Practice Questions and Exam Preparation

HashiCorp TERRAFORM-ASSOCIATE-003 Online Questions & Answers

• Question 321:

  Which of the following command would be use to access all of the attributes and details of a resource managed by Terraform?

  A. Terraform state show ` provider_type_name
  B. Terraform state list
  C. Terraform get provider_type_name
  D. Terraform state list provider_type_name
  A. Terraform state show ` provider_type_name

  ---

  Explanation

  This is the command that you would use to access all of the attributes and details of a resource managed by Terraform, by providing the resource address as an argument. For example, terraform state show 'aws_instance.example' will show you all the information about the AWS instance named example.

• Question 322:

  Terraform console provides an interactive command-line console for evaluating and experimenting with expressions. You can use it to test interpolations before using them in configurations and to interact with any values currently saved in state.

  Which configuration consistency errors does terraform validate report?

  A. A mix of spaces and tabs in configuration files
  B. Differences between local and remote state
  C. Terraform module isn't the latest version
  D. Declaring a resource identifier more than once
  D. Declaring a resource identifier more than once

  ---

  Explanation

  Terraform validate reports configuration consistency errors, such as declaring a resource identifier more than once. This means that the same resource type and name combination is used for multiple resource blocks, which is not allowed in Terraform. For example, resource "aws_instance" "example" {...} cannot be used more than once in the same configuration. Terraform validate does not report errors related to module versions, state differences, or formatting issues, as these are not relevant for checking the configuration syntax and structure. References = [Validate Configuration], [Resource Syntax]

• Question 323:

  You add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The existing and new resources use the same provider. The working contains a .terraform.lock, hc1 file. How will Terraform choose which version of the provider to use?

  A. Terraform will use the version recorded in your lock file
  B. Terraform will use the latest version of the provider for the new resource and the version recorded in the lock file to manage existing resources
  C. Terraform will check your state file to determine the provider version to use
  D. Terraform will use the latest version of the provider available at the time you provision your new resource
  A. Terraform will use the version recorded in your lock file

  ---

  Explanation

  This is how Terraform chooses which version of the provider to use, when you add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The lock file records the exact version of each provider that was installed in your working directory, and ensures that Terraform will always use the same provider versions until you run terraform init -upgrade to update them.

• Question 324:

  In the example below, the depends_on argument creates what type of dependency?

  A. implicit dependency
  B. internal dependency
  C. explicit dependency
  D. non-dependency resource
  C. explicit dependency

  ---

  Explanation

• Question 325:

  A developer on your team is going lo leaf down an existing deployment managed by Terraform and deploy a new one. However, there is a server resource named aws instant.ubuntu[l] they would like to keep. What command should they use to tell Terraform to stop managing that specific resource?

  A. Terraform plan rm:aws_instance.ubuntu[1]
  B. Terraform state rm:aws_instance.ubuntu[1]
  C. Terraform apply rm:aws_instance.ubuntu[1]
  D. Terraform destory rm:aws_instance.ubuntu[1]
  B. Terraform state rm:aws_instance.ubuntu[1]

  ---

  Explanation

  To tell Terraform to stop managing a specific resource without destroying it, you can use the terraform state rm command. This command will remove the resource from the Terraform state, which means that Terraform will no longer track or update the corresponding remote object. However, the object will still exist in the remote system and you can later use terraform import to start managing it again in a different configuration or workspace. The syntax for this command is terraform state rm

  , where

  is the resource address that identifies the resource instance to remove. For example, terraform state rm aws_instance.ubuntu[1] will remove the second instance of the aws_instance resource named ubuntu from the state.

  References: : Command: state rm : Moving Resources

• Question 326:

  terraform apply is failing with the following error. What next step should you take to determine the root cause of the problem? Error loading state: AccessDenied: Access Denied status code: 403, request id: 288766CE5CCA24A0, host id: FOOBAR

  A. Set TF_LOG=DEBUG
  B. Review syslog for Terraform error messages
  C. Run terraform login to reauthenticate with the provider
  D. Review /var/log/terraform.log for error messages
  A. Set TF_LOG=DEBUG

  ---

  Explanation

  Terraform has detailed logs which can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr. You can set TF_LOG to one of the log levels (in order of decreasing verbosity) TRACE, DEBUG, INFO, WARN or ERROR to change the verbosity of the logs.

• Question 327:

  When do changes invoked by terraform apply take effect?

  A. After Terraform has updated the state file
  B. Once the resource provider has fulfilled the request
  C. Immediately
  D. None of the above are correct
  B. Once the resource provider has fulfilled the request

  ---

  Explanation

  Changes invoked by terraform apply take effect once the resource provider has fulfilled the request, not after Terraform has updated the state file or immediately. The state file is only a reflection of the real resources, not a source of truth.

• Question 328:

  What is not processed when running a terraform refresh?

  A. State file
  B. Configuration file
  C. Credentials
  D. Cloud provider
  B. Configuration file

  ---

  Explanation

  "The terraform refresh command reads the current settings from all managed remote objects and updates the Terraform state to match."

• Question 329:

  You have modified your local Terraform configuration and ran terraform plan to review the changes. Simultaneously, your teammate manually modified the infrastructure component you are working on. Since you already ran terraform plan locally, the execution plan for terraform apply will be the same.

  A. True
  B. False
  B. False

  ---

  Explanation

  The execution plan for terraform apply will not be the same as the one you ran locally with terraform plan, if your teammate manually modified the infrastructure component you are working on. This is because Terraform will refresh the state file before applying any changes, and will detect any differences between the state and the real resources.

• Question 330:

  In regards to Terraform state file, select all the statements below which are correct?

  A. When using local state, the state file is stored in plain-text.
  B. The state file is always encrypted at rest.
  C. Storing state remotely can provide better security.
  D. Using the mask feature, you can instruct Terraform to mask sensitive data in the state file.
  E. The Terraform state can contain sensitive data, therefore the state file should be protected from unauthorized access.
  F. Terraform Cloud always encrypts state at rest.
  A. When using local state, the state file is stored in plain-text.
  C. Storing state remotely can provide better security.
  E. The Terraform state can contain sensitive data, therefore the state file should be protected from unauthorized access.
  F. Terraform Cloud always encrypts state at rest.

  ---

  Explanation

  Terraform state can contain sensitive data, depending on the resources in use and your definition of "sensitive." The state contains resource IDs and all resource attributes. For resources such as databases, this may contain initial passwords.

  When using local state, state is stored in plain-text JSON files. When using remote state, state is only ever held in memory when used by Terraform. It may be encrypted at rest, but this depends on the specific remote state backend. Storing

  Terraform state remotely can provide better security. As of Terraform 0.9, Terraform does not persist state to the local disk when remote state is in use, and some backends can be configured to encrypt the state data at rest.

  Recommendations

  If you manage any sensitive data with Terraform (like database passwords, user passwords, or private keys), treat the state itself as sensitive data. Storing state remotely can provide better security. As of Terraform 0.9, Terraform does not

  persist state to the local disk when remote state is in use, and some backends can be configured to encrypt the state data at rest.

  For example:

  *

  Terraform Cloud always encrypts state at rest and protects it with TLS in transit. Terraform Cloud also knows the identity of the user requesting state and maintains a history of state changes. This can be used to control access and track activity. Terraform Enterprise also supports detailed audit logging.

  *

  The S3 backend supports encryption at rest when the encrypt option is enabled. IAM policies and logging can be used to identify any invalid access. Requests for the state go over a TLS connection.