Infrastructure Lifecycle and Operations

TERRAFORM-PRO-002 · 43 questions

• A single root configuration manages networking, databases, Kubernetes clusters and application services for one product. Plans take about 20 minutes, a small app change plans against everything, and one mistake can affect all layers. What is the recommended structural fix?
• A team uses one working directory with Terraform CLI workspaces named dev and prod on a single S3 backend. Security now requires prod to use different credentials and a separately access-controlled backend, so dev engineers cannot read prod state. What should they do?
• A large configuration's plans intermittently fail with HTTP 429 throttling errors from the cloud provider's API. The team wants plans to finish reliably now, without ignoring drift, while they consider longer-term changes. What should they adjust first?
• A platform team deploys the same set of components, network, cluster and service, together in many environments and regions. They want to define the components once, deploy them as a unit in HCP Terraform with each environment customized by inputs, and roll a change out environment by environment. Which feature fits?
• An HCP Terraform organization has grown to dozens of workspaces across three business units. Each unit's team should manage only its own workspaces, and the organization wants to keep one private registry and organization-wide policies. How should workspaces be organized?
• A pipeline runs terraform plan in one job, posts the plan for human approval, and runs apply in a later job after approval. The team must guarantee the apply performs exactly the actions that were approved, not a freshly computed plan. How should the jobs be set up?
• A plan for a load balancer contains the line +/- resource "awslb" "main", and the resource sets lifecycle { createbeforedestroy = true }. A junior reviewer asks what this marker means for the running service. What is the correct explanation?
• A nightly job runs terraform plan for many workspaces and should open a ticket only when a workspace has pending changes, while treating errors separately. Which approach lets the script tell these outcomes apart reliably?
• A change advisory board must approve the teardown of a temporary test environment and wants to review exactly which objects Terraform will remove before anything is deleted, then have that approved teardown executed as reviewed. What should the engineer do?
• A module uses foreach = toset(awssubnet.private[].id) to create route table associations. On a fresh environment, the plan fails with an error that foreach has dependencies that cannot be determined before apply. What is the best fix?
• A pipeline must run terraform apply without an interactive prompt. The security lead wants the change that executes to be exactly the change that was reviewed earlier in the pipeline. Which approach meets both requirements?
• An apply that should create ten resources creates eight and then fails on the ninth with a cloud quota error. After the quota is raised, what should the engineer expect and do next?
• A CI job saved a plan with terraform plan -out=tfplan and waited for approval. Meanwhile another pipeline applied a different change to the same workspace. When the approved job runs terraform apply tfplan, what happens?
• An engineer creates a plan file while the dev CLI workspace is selected, then switches to the staging workspace and runs terraform apply with that plan file on Terraform 1.15. What happens?
• During a production incident, one misconfigured security group rule is blocking traffic. The main branch also holds several merged but unapplied changes to other resources that have not been reviewed for release yet. The on-call engineer must correct only the broken rule right now. Which approach follows Terraform's guidance for this situation?
• A storage bucket was created by hand last year and now has to come under Terraform management. Team policy says every change to state must appear in a plan that is reviewed in a pull request and is then applied only by the pipeline. Which approach satisfies that policy?
• A team has written import blocks for 40 legacy resources but has no resource blocks for them yet. They want Terraform to draft the resource configuration so they do not have to write every argument by hand. Which workflow is correct?
• An engineer must import 30 existing subnets into a resource declared as awssubnet.this with foreach, keyed by subnet name. The real subnet IDs are already available in a map variable from name to ID. Which import configuration handles all 30 without writing 30 separate blocks?
• A workspace runs Terraform 1.15, and a recent provider release adds resource identity support to a resource type whose import IDs are long composite strings that engineers keep getting wrong. The team wants its import blocks to use identity instead. How should the import blocks change?
• A platform team must bring several hundred existing compute instances spread across one cloud account under Terraform management. Nobody has an inventory of their IDs, and hand-writing an import block for each is not practical. Using Terraform 1.15 and a provider that supports list resources, which approach fits?
• Changing the domain on a TLS certificate resource forces replacement. A load balancer listener references the certificate, and in the last change Terraform destroyed the old certificate before creating the new one, which broke HTTPS for several minutes. What should the team set so the next replacement avoids that gap?
• An autoscaling group is managed by Terraform, but a scaling policy changes its desired capacity throughout the day. Every plan now proposes setting desired capacity back to the configured value. Terraform must keep managing the group's launch template, sizes and tags. Which change is appropriate?
• A team runs dev and prod from the same Terraform configuration with separate state for each environment. An engineer runs terraform destroy against the dev state to tear dev down. It is rejected because the database resource sets preventdestroy = true. A colleague also worries the destroy could have removed prod resources. Which statement is accurate?
• An engineer wants an application instance to be replaced whenever the input variable appversion changes. They added replacetriggeredby = [var.appversion] to the instance's lifecycle block, and Terraform rejects it. Which change achieves the goal?
• An engineer deleted the resource block for a logging bucket, intending Terraform to stop managing it while the bucket and its data stay in place. The plan now proposes to destroy the bucket. Which change achieves the goal through a normal reviewed plan?
• A configuration uses CLI workspaces named dev and prod and builds resource names from the prefix app- followed by the interpolation of the current workspace name. Both workspaces store state in the same backend bucket, and engineers use the same cloud credentials for both. A security review asks whether this setup isolates production. What is the accurate assessment?
• A root module contains terraform.tfvars with dev values and prod.tfvars with prod values. A manual production apply was run without -var-file, silently loaded the dev values, and resized production resources. Which change best prevents this from happening again?
• Dev and prod both call a shared registry module with version = "~> 3.0". Dev was tested on 3.4.0, but when prod was initialized two weeks later it installed 3.5.0, which nobody had tested. The team wants prod to run only module code that has already passed in dev. Which practice achieves this?
• An engineer wants each environment's state in a different S3 bucket and wrote bucket = var.statebucket inside the backend block. terraform init fails with an error about variables not being allowed there. The configuration targets Terraform 1.15. What is the supported way to vary backend settings per environment?
• One Terraform configuration deploys the same stack to a dev account and a prod account in the same cloud. Compliance requires that a dev run can never authenticate into the prod account. Which approach meets the requirement?
• A terraform apply fails with a vague provider error, and the team needs the provider's detailed debug output, which for this provider includes its API requests and responses. They want the output saved to a file and do not need Terraform core's internal logs. Which settings should they use?
• Two security groups each allow traffic from the other, and both rules are written as inline ingress blocks that reference the other group's ID. terraform plan now fails with a Cycle error naming both groups. Which change resolves the error?
• A pipeline's plan job fails with an error acquiring the state lock. The lock details show the operation, the user, and a creation time from a few minutes ago, and another pipeline job targeting the same state may still be running. What should the engineer do?
• A terraform apply fails while creating a storage bucket because the provider reports that a bucket with that name already exists. Investigation shows a teammate created the bucket by hand last week with the settings the configuration expects. Which response is correct?
• An apply ends with an error saying the provider produced an inconsistent result after apply. terraform validate passes, and the same configuration has applied cleanly for months. The error appeared right after a provider minor version upgrade. What does this error indicate, and what is the appropriate response?
• A root module calls a child module named network, which creates private subnets. The root needs those subnet IDs for a database resource, but referencing module.network.awssubnet.private[].id fails with an error. Which change provides the IDs correctly?
• A child module's output sometimes returns a tuple and sometimes a list depending on how it is called, and callers that pass it into list(string) variables keep breaking. The module targets Terraform 1.15, and the maintainers want the output itself to declare and enforce list(string). Which change achieves this?
• In HCP Terraform, an app workspace needs the subnet ID that a network workspace exposes as an output. Security does not want the app workspace's runs to have read access to the network workspace's full state. Which approach fits HashiCorp's recommendation?
• An application configuration hardcodes a VPC ID. The VPC belongs to a network team that manages it with its own tooling outside Terraform and occasionally rebuilds it, which breaks the application's plans each time. The VPC always carries agreed tags. How should the application configuration obtain the VPC ID?
• A module block uses source = "git::https://example.com/org/network.git" with version = "1.2.0", and terraform init rejects the configuration. The team wants to pin the module to the repository's v1.2.0 tag. Which change is correct?
• A platform team wants one root module to choose a registry module's version from an input variable so each environment's pipeline can pass its own version. The configuration targets Terraform 1.15. Which approach is supported?
• An engineer commits .terraform.lock.hcl and assumes it also pins the registry module that the configuration calls with version = "~> 4.1". Weeks later, a teammate's fresh init installs a newer 4.x module release. Why did this happen, and what pins the module?
• A provider release fixes a bug the team keeps hitting, and the new version falls within the configuration's existing version = "~> 5.40" constraint. Running terraform init in the repository, which has a committed lock file, still installs the older release. What should the engineer do?