Font size
WorksheetsT3 # 111-165
Total questions: 55
Worksheet time: 55mins
ABC Enterprise has recently tied up with multiple small organizations for exchanging database information. Due to this, the firewall rules are increasing and are more than 100 rules. This is leading firewall configuration file that is difficult to manage. What is the way this type of configuration can be managed easily?
Terraform Backends
Terraform Functions
Dynamic Blocks
Terraform Expression
True or False: A list(...) contain a number of values of the same type while an object(...) can contain a number of values of different types.
True
False
You do not need to specify every required argument in the backend configuration. Omitting certain arguments may be desirable to avoid storing secrets, such as access keys, within the main configuration. When some or all of the arguments are omitted, we call this a _____________.
First Time Configuration
Default Configuration
Changing Configuration
Partial Configuration
Incomplete Configuration
lookup retrieves the value of a single element from which of the below data type?
map
set
string
list
Terraform must track metadata such as resource dependencies. Where is this data stored?
workspace
backend
state file
metadata store
Which of the below are paid features of Terraform Cloud?
Full API Coverage
Secure variable Storage
Roles/ Team management
Cost Estimation
Sentinel policies
Provisioners should only be used as a last resort.
False
True
Which Terraform command will force a marked resource to be destroyed and recreated on the next apply?
terraform fmt
terraform destroy
terraform taint
terraform refresh
What allows you to conveniently switch between multiple instances of a single configuration within its single backend?
Local backends
Providers
Remote backends
Workspaces
Terraform refresh will update the state file?
True
False
What does terrafom plan do ?
Create an execution plan by evaluating the difference between configuration file and state file.
Performs a refresh, unless explicitly disabled, and then apply the changes that are necessary to achieve the desired state specified in the configuration files.
Create an execution plan by evaluating the difference between configuration file and actual infrastructure.
Checks whether the execution plan for a set of changes matches your expectations by making changes to real resources or to the state
When TF_LOG_PATH is set, TF_LOG must be set in order for any logging to be enabled.
True
False
Workspaces in Terraform provides similar functionality in the open-source, Terraform Cloud, and Enterprise versions of Terraform.
True
False
The current implementation of Terraform import can only import resources into the state. It does not generate configuration.
True
False
Terraform has detailed logs which can be enabled by setting the _________ environmental variable.
TF_TRACE
TF_DEBUG
TF_LOG
TF_INFO
Which of the following best describes a Terraform provider?
A plugin that Terraform uses to translate the API interactions with the service or provider.
Serves as a parameter for a Terraform module that allows a module to be customized.
Describes an infrastructure object, such as a virtual network, compute instance, or other components.
A container for multiple resources that are used together.
Which one of the following will run echo 0 and echo 1 on a newly created host?
provisioner "local-exec" {
command = "echo 0" command = "echo 1"
}
provisioner "remote-exec" { inline = [
echo 0,
echo 1
]
}
provisioner "remote-exec" { command = "${echo 0}"
command = "${echo 1}" }
provisioner "remote-exec" { inline = [
"echo 0",
"echo 1"
]
}
How can you ensure that the engineering team who has access to git repo will not create any non- compliant resources that might lead to a security audit failure in future. your team is using Hashicorp Terraform Enterprise Edition.
Use Terraform OSS Sentinel Lite version , which will save cost , since there is no charge for OSS , but it can still check for most non-compliant rules using Policy-As-Code.
Implement a review process where every code will be reviewed before merging to the master branch.
Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them.
Create a design /security document (in PDF) and share to the team , and ask them to always follow that document , and never deviate from it.
If you enable TF_LOG = DEBUG, the log will be stored in syslog.log file in the current directory.
True
False
When using remote state, state is only ever held in memory when used by Terraform.
True
False
Which one of the following command will rewrite Terraform configuration files to a canonical format and style.
terraform graph -h
terraform init
terraform graph
terraform fmt
You have created a custom variable definition file testing.tfvars. How will you use it for provisioning infrastructure?
terraform apply -var-state-file ="testing.tfvars"
terraform plan -var-file="testing.tfvar"
terraform apply -var-file="testing.tfvars"
terraform apply var-file="testing.tfvars"
You want to get involved in the development of Terraform. As this is an open source project, you would like to contribute a fix for an open issue of Terraform. What programming language will need to use to write the fix?
It depends on which command issue related to.
Python
Go
Java
Terraform import command can import resources into modules as well directly into the root of your state.
True
False
Which of the following type of variable allows multiple values of several distinct types to be grouped together as a single value?
Map
Object
Tuple
List
Which of the following best describes the default local backend?
The local backend is where Terraform Enterprise stores logs to be processed by an log collector.
The local backend stores state on the local filesystem, locks the state using system APIs, and performs operations locally.
The local backend is the directory where resources deployed by Terraform have direct access to in order to update their current state.
The local backend is how Terraform connects to public cloud services, such as AWS, Azure, or GCP.
Which of the following command can be used to view the specified version constraints for all providers used in the current configuration.
terraform providers
terraform state show
terraform provider
terraform plan
Which of the following represents a feature of Terraform Cloud that is NOT free to customers?
Roles and Team Management
WorkSpace Management
Private Module Registry
VCS Integration
What is the purpose of using the local-exec provisioner? (Select Two)
To invoke a local executable.
Executes a command on the resource to invoke an update to the Terraform state.
To execute one or more commands on the machine running Terraform.
Ensures that the resource is only executed in the local infrastructure where Terraform is deployed.
terraform state subcommands such as list are read-only commands, do read-only commands create state backup files?
True
False
You want to use terraform import to start managing infrastructure that was not originally provisioned through infrastructure as code. Before you can import the resource's current state, what must you do in order to prepare to manage these resources using Terraform?
Run terraform refresh to ensure that the state file has the latest information for existing resources.
Update the configuration file to include the new resources.
Shut down or stop using the resources being imported so no changes are inadvertently missed.
Modify the Terraform state file to add the new resources.
Which of the below terraform commands do not run terraform refresh implicitly before taking actual action of the command?
terraform apply
terraform destroy
terraform init
terraform import
terraform plan
You want to use different AMI images for different regions and for the purpose you have defined following code block.
1. variable "images"
2. {
3. type = "map"
4.
5. default = {
6. us-east-1 = "image-1234"
7. us-west-2 = "image-4567"
8. us-west-1 = "image-4589"
9. }
10. }
What of the following approaches needs to be followed in order to select image-4589?
var.images["us-west-1"]
var.images[3]
var.images[2]
lookup(var.images["us-west-1"]
By default, a defined provisioner is a creation-time provisioner.
True
False
What is the default backend for Terraform?
consul
gcs
local
etc
You want terraform plan and apply to be executed in Terraform Cloud's run environment but the output is to be streamed locally. Which one of the below you will choose?
Local Backends
This can be done using any of the local or remote backends
Remote Backends
Terraform Backends
Which of the following Terraform files should be ignored by Git when committing code to a repo? (select Three)
Files named exactly terraform.tfvars or terraform.tfvars.json
Any files with names ending in .auto.tfvars or .auto.tfvars.json
input.tf
terraform.tfstate
output.tf
What is the command you can use to set an environment variable named "var1"of type String?
export TF_VAR_VAR1
set TF_VAR_var1
variable "var1" { type = "string"}
export TF_VAR_var1
As a member of an operations team that uses infrastructure as code (laC) practices, you are tasked with making a change to an infrastructure stack running in a public cloud. Which pattern would follow laC best practices for making a change?
Make the change via the public cloud API endpoint
Make the change programmatically via the public cloud CLI
Submit a pull request and wait for an approved merge of the proposed changes
Use the public cloud console to make the change after a database record has been approved
Clone the repository containing your infrastructure code and then run the code
Terraform works well in Windows but a Windows server is required.
True
False
Any user can publish modules to the public Terraform Module Registry.
True
False
You have created 2 workspaces PROD and RQ
You have switched to RQA and provisioned RQA infrastructure from this workspace. Where is your state file stored?
terraform.tfstate.d
terraform.d
terraform.tfstate.RQA
terraform.tfstate
Refer to the below code where developer is outputting the value of the database password but has used sensitive parameter to hide the output value in the CLI. output "db_password" { value = aws_db_instance.db.password description = "The password for logging in to the database." sensitive = true}
Since sensitive is set to true, the value associated with db password will not be present in state file as plain-text?
True
False
While using generic git repository as a module source, which of the below options allows terraform to select a specific version or tag instead of selecting the HEAD.
Append ref argument as
module "vpc" {
source = "git::https://example.com/vpc.git?ref=v1.2.0"
}
Append version argument as
module "vpc" {
source = "git::https://example.com/vpc.git?version=v1.2.0"
}
Append ref argument as
module "vpc" {
source = "git::https://example.com/vpc.git#ref=v1.2.0"
}
By default, Terraform will clone and use the default branch (referenced by HEAD) in the selected repository and you can not override this.
In regards to deploying resources in multi-cloud environments, what are some of the benefits of using Terraform rather than a provider's native tooling? (select three)
Terraform can help businesses deploy applications on multiple clouds and on-premises infrastructure.
Terraform is not cloud-agnostic and can be used to deploy resources across a single public cloud.
Terraform simplifies management and orchestration, helping operators build large-scale, multi- cloud infrastructure.
Terraform can manage cross-cloud dependencies.
Matt wants to import a manually created EC2 instance into terraform so that he can manage the EC2 instance through terraform going forward. He has written the configuration file of the EC2 instance before importing it to Terraform. Following is the code:
resource "aws_instance" "matt_ec2" {
ami = "ami-bg2640de"
instance_type = "t2.micro"
vpc_security_group_ids = ["sg-6ae7d613", "sg-53370035"]
key_name = "mysecret"
subnet_id = "subnet-9e3cfbc5"
}
The instance id of that EC2 instance is i-0260835eb7e9bd40
How he can import data of EC2 to state file?
terraform import aws_instance.id = i-0260835eb7e9bd40
terraform import i-0260835eb7e9bd40
terraform import aws_instance.i-0260835eb7e9bd40
terraform import aws_instance.matt_ec2 i-0260835eb7e9bd40
John wants to use two different regions to deploy two different EC2 instances. He has specified two provider blocks in his providers.tf file.
provider "aws" {
region = "us-east-1"
}
provider "aws" {
region = "us-west-2"
}
When he run terraform plan he encountered an error. How to fix this?
Use another provider version
Use alias for region = "us-west-2"
Use default keyword with region = "us-east-1"
It can not be fixed
How does Terraform handle working with so many providers?
Terraform ships with all of the plugins embedded in the Terraform binary.
Terraform uses a plugin architecture for providers and only installs the provider plugins required by your configuration in the configuration's working directory.
Terraform uses a plugin architecture for providers and only installs the provider plugins required by your configuration in a shared, system-wide plugins directory.
Terraform allows you to select the providers you want to support during the Terraform installation process.
What is the standard workflow that a developer follows while working with terraform open source version?
Run terraform refresh to update the terraform state , then write the terraform code , and finally run terraform apply.
Run terraform destroy first since you need to start from fresh every time , before running terraform apply.
Write terraform code , and run terraform push , to update the terraform state to the remote repo , which in turn will take care of the next steps.
Write the terraform code on the developer machine , run terraform plan to check the changes , and run terraform apply to provision the infra.
You are using a terraform operation that writes state. Unfortunately automatic state unlocking has failed for that operation. Which of the below commands can be used to remove the already acquired lock on the state?
terraform unlock
terraform force-unlock
terraform state unlock
None of the above
Ric wants to enable detail logging and he wants highest verbosity of logs. Which of the following environment variable settings is correct option for him to select.
Set TF_LOG = DEBUG
Set VAR_TF = TRACE
Set TF_LOG = TRACE
Set VAR_TF_LOG = TRACE
The canonical format may change in minor ways between Terraform versions, so after upgrading Terraform it is recommended to proactively run.
terraform fmt
terraform init
terraform validate
terraform plan
What does terraform refresh command do?
terraform refresh can be used to selectively update sections of the state file, using terraform resource level addressing.
terraform refresh command basically updates the configuration file with the current state of the actual infrastructure
terraform refresh is use to change/modify the infrastructure based on the existing state file, at that moment.
terraform refresh can be used to selectively update sections of the state file, using terraform resource level addressing.
terraform refresh syncs the state file with the real world infrastructure.
Which of the following is the right substitute for static values that can make Terraform configuration file more dynamic and reusable?
Output value
Input parameters
Functions
Modules
1. resource "aws_s3_bucket" "example" {
2. bucket = "my-test-s3-terraform-bucket"
3. ...} resource "aws_iam_role" "test_role" {
4. name = "test_role"
5. ...}
Due to the way that the application code is written, the s3 bucket must be created before the test role is created, otherwise there will be a problem. How can you ensure that?
Add explicit dependency using depends_on . This will ensure the correct order of resource creation.
This will already be taken care of by terraform native implicit dependency. Nothing else needs to be done from your end.
This is not possible to control in terraform . Terraform will take care of it in a native way , and create a dependency graph that is best suited for the parallel resource creation.
Create 2 separate terraform config scripts , and run them one by one , 1 for s3 bucket , and another for IAM role , run the S3 bucket script first.
