Font size
WorksheetsT5 # 221- 275
Total questions: 55
Worksheet time: 55mins
Which of the following state management command allow you to retrieve a list of resources that are part of the state file?
terraform state list
terraform state view
terraform view
terraform list
If you delete a remote backend from the configuration, will you need to rebuild your state files locally?
True
False
During a terraform apply, a resource is successfully created but eventually fails during provisioning. What happens to the resource?
The resource will be planned for destruction and recreation upon the next terraform apply
Terraform will retry to provision again.
The failure of provisioner will be ignored and it will not cause a failure to terraform apply
The resource will be automatically destroyed.
Which of the following Terraform commands will automatically refresh the state unless supplied with additional flags or arguments? Choose TWO correct answers.
terraform state
terraform apply
terraform plan
terraform validate
terraform output
A user has created three workspaces using the command line - prod, dev, and test. The user wants to create a fourth workspace named stage. Which command will the user execute to accomplish this?
terraform workspace new stage
terraform workspace -new stage
terraform workspace -create stage
terraform workspace create stage
You cannot publish your own modules on the Terraform Registry.
True
False
Which of the following allows Terraform users to apply policy as code to enforce standardized configurations for resources being deployed via infrastructure as code?
Sentinel
Module registry
Functions
Workspaces
In Terraform Enterprise, a workspace can be mapped to how many VCS repos?
5
2
3
1
Terraform Enterprise currently supports running under which the following operating systems?
A. Ubuntu B. Amazon Linux C. Debian D. CentOS E. Red Hat Enterprise Linux F. Oracle Linux
Any
None abobe
Complete the following sentence: For local state, the workspaces are stored directly in a ___________.
a file called terraform.tfstate.backup
directory called terraform.workspaces.tfstate
a file called terraform.tfstate
directory called terraform.tfstate.d
You can migrate the Terraform backend but only if there are no resources currently being managed.
True
False
After running into issues with Terraform, you need to enable verbose logging to assist with troubleshooting the error. Which of the following values provides the MOST verbose logging?
ERROR
INFO
WARN
TRACE
DEBUG
From the answers below, select the advantages of using Infrastructure as Code.
Select four
Provide a codified workflow to develop customer-facing applications.
Safely test modifications using a "dry run" before applying any actual changes.
Easily integrate with application workflows (GitLab Actions, Azure DevOps, CI/CD tools).
Easily change and update existing infrastructure.
Provide reusable modules for easy sharing and collaboration.
What resource dependency information is stored in Terraform's state?
Only implicit dependencies are stored in state.
Both implicit and explicit dependencies are stored in state.
Only explicit dependencies are stored in state.
No dependency information is stored in state.
Consider the following Terraform 0.12 configuration snippet:
1. variable "vpc_cidrs" {
2. type = map
3. default = {
4. us-east-1 = "10.0.0.0/16"
5. us-east-2 = "10.1.0.0/16"
6. us-west-1 = "10.2.0.0/16"
7. us-west-2 = "10.3.0.0/16"
8. }
9. }
10.
resource "aws_vpc" "shared" {
cidr_block = _____________
}
How would you define the cidr_block for us-east-1 in the aws_vpc resource using a variable?
var.vpc_cidrs.0
vpc_cidrs[“us-east-1”]
var.vpc_cidrs[“us-east-1”]
var.vpc_cidrs[0]
Your organization has moved to AWS and has manually deployed infrastructure using the console. Recently, a decision has been made to standardize on Terraform for all deployments moving forward. What can you do to ensure that all existing is managed by Terraform moving forward without interruption to existing services?
Submit a ticket to AWS and ask them to export the state of all existing resources and use terraform import to import them into the state file.
Delete the existing resources and recreate them using new a Terraform configuration so Terraform can manage them moving forward.
Resources that are manually deployed in the AWS console cannot be imported by Terraform.
Using terraform import, import the existing infrastructure into your Terraform state.
Which of the following actions are performed during a terraform init?
Initializes downloaded and/or installed providers
Initializes the backend configuration
Provisions the declared resources in your configuration
Download the declared providers which are supported by HashiCorp
What is a downside to using the Vault provider to read secrets from Vault?
Secrets are persisted to the state file and plans.
Terraform and Vault must be running on the same version.
Terraform and Vault must be running on the same physical host.
Terraform requires a unique auth method to work with Vault.
Given the below resource configuration -
resource "aws_instance" "web" {
# ...
count = 4
}
What does the terraform resource address aws_instance.web refer to?
It refers to all 4 web instances , together , for further individual segregation , indexing is required , with a 0 based index.
It refers to the last web EC2 instance , as by default , if no index is provided , the last / N-1 index is used.
It refers to the first web EC2 instance out of the 4 ,as by default , if no index is provided , the first / 0th index is used.
The above will result in a syntax error , as it is not syntactically correct . Resources defined using count , can only be referenced using indexes.
State is a requirement for Terraform to function
True
False
You wanted to destroy some of the dependent resources from real infrastructure. You choose to delete those resources from your configuration file and run terraform plan and then apply. Which of the following way your resources would be destroyed?
Terraform can still determine the correct order for destruction from the state even when you delete one or more items from the configuration.
Those would be destroyed in the order in which they were written in the configuration file previously before you have deleted them from configuration file.
The resource will be destructed in random order as you have already deleted them from configuration.
You can not destroy resources by deleting them from configuration file and running plan and apply
Your developers are facing a lot of problem while writing complex expressions involving difficult interpolations . They have to run the terraform plan every time and check whether there are errors , and also check terraform apply to print the value as a temporary output for debugging purposes.
What should be done to avoid this?
Use terraform console command to have an interactive UI with full access to the underlying terraform state to run your interpolations , and debug at real-time.
Add a breakpoint in your code, using the watch keyword , and output the value to console for temporary debugging.
Use terraform zipmap function , it will be able to easily do the interpolations without complex code.
Use terraform console command to have an interactive UI , but you can only use it with local state , and it does not work with remote state.
When writing Terraform code, HashiCorp recommends that you use how many spaces between each nesting level?
0
1
2
4
When using parent/child modules to deploy infrastructure, how would you export a value from one module to import into another module. For example, a module dynamically deploys an application instance or virtual machine, and you need the IP address in another module to configure a related DNS record in order to reach the newly deployed application.
Export the value using terraform export and input the value using terraform input.
Configure the pertinent provider's configuration with a list of possible IP addresses to use.
Configure an output value in the application module in order to use that value for the DNS module.
Preconfigure the IP address as a parameter in the DNS module.
You have configured an Auto Scaling group in AWS to automatically scale the number of instances behind a load balancer based on the instances CPU utilization. The instances are configured using a Launch Configuration. You have observed that the Auto Scaling group doesn't successfully scale when you apply changes that require replacing the Launch Configuration. Why is this happening?
You need to configure an explicit dependency for the Auto Scaling group using the depends_on meta-parameter.
You need to configure an explicit dependency for the Launch Configuration using the depends_on meta-parameter.
You need to configure the Auto Scaling group's create_before_destroy meta-parameter.
You need to configure the Launch Configuration's create_before_destroy meta-parameter.
You have written a terraform IaC script which was working till yesterday , but is giving some vague error from today , which you are unable to understand . You want more detailed logs that could potentially help you troubleshoot the issue , and understand the root cause. What can you do to enable this setting? Please note , you are using terraform OSS.
Terraform OSS can push all its logs to a syslog endpoint. As such, you have to set up the syslog sink, and enable TF_LOG_PATH env variable to the syslog endpoint and all logs will automatically start streaming.
Detailed logs are not available in terraform OSS, except the crash message. You need to upgrade to terraform enterprise for this point.
Enable the TF_LOG_PATH to the log sink file location, and logging output will automatically be stored there.
Enable TF_LOG to the log level DEBUG, and then set TF_LOG_PATH to the log sink file location. Terraform debug logs will be dumped to the sink path, even in terraform OSS.
Given the Terraform configuration below, in which order will the resources be created?
resource "aws_instance" "web_server"{
ami = "ami-b374d5a5"
instance_type = "t2.micro"
}
resource "aws_eip" "web_server_ip"{
vpc = true
instance = aws_instance.web_server.id
}
aws_eip will be created first aws_instance will be created second
aws_eip will be created first aws_instance will be created second
Resources will be created simultaneously
aws_instance will be created first aws_eip will be created second
After executing a terraform apply, you notice that a resource has a tilde (~) next to it. What does this infer?
The resource will be updated in place.
The resource will be created.
Terraform can't determine how to proceed due to a problem with the state file.
The resource will be destroyed and recreated.
A single terraform resource file that defines an aws_instance resource can simple be renamed to azurerm_virtual_machine in order to switch cloud providers
True
False
A "backend" in Terraform determines how state is loaded and how an operation such as apply is executed. Which of the following is not a supported backend type?
Terraform enterprise
Consul
Github
S3
Artifactory
John is writing a module and within the module, there are multiple places where he has to use the same conditional expression but he wants to avoid repeating the same values or expressions multiple times in a configuration,. What is a better approach to dealing with this?
Local Values
Expressions
Functions
Variables
You have created a custom variable definition file my_vars.tfvars. How will you use it for provisioning infrastructure?
terraform apply -var-state-file ="my_vars.tfvars"
terraform apply var-file="my_vars.tfvars"
terraform plan -var-file="my_vars.tfvar"
terraform apply -var-file="my_vars.tfvars"
Which one is the right way to import a local module names consul?
module "consul" {
source = "consul"
}
module "consul" {
source = "consul"
}
module "consul" {
source = "../consul"
}
module "consul" {
source = "module/consul"
}
Your team uses terraform OSS . You have created a number of resuable modules for important , independent network components that you want to share with your team to enhance consistency .
What is the correct option/way to do that?
Terraform modules cannot be shared in OSS version . Each developer needs to maintain their own modules and leverage them in the main tf file.
Upload your modules with proper versioning in the terraform public module registry . Terraform OSS is directly integrated with the public module registry , and can reference the modules from the code in the main tf file.
Terraform module sharing is only available in Enterprise version via terraform private module registry , so no way to enable it in OSS version.
Store your modules in a NAS/ shared file server , and ask your team members to directly reference the code from there. This is the only viable option in terraform OSS ,which is better than individually maintaining module versions for every developer.
Using multi-cloud and provider-agnostic tools provides which of the following benefits?
Operations teams only need to learn and manage a single tool to manage infrastructure, regardless of where the infrastructure is deployed.
Increased risk due to all infrastructure relying on a single tool for management.
Can be used across major cloud providers and VM hypervisors.
Slower provisioning speed allows the operations team to catch mistakes before they are applied.
A variable az has the following default value. What will be the datatype of the variable?
az=["us-west-1a","us-east-1a"]
object
list
map
string
Your team lead does not trust the junior terraform engineers who now have access to the git repo . So , he wants you to have some sort of a checking layer , whereby , you can ensure that the juniors will not create any non-compliant resources that might lead to a security audit failure in future. What can you do to efficiently enforce this?
Create a design /security document (in PDF) and share to the team , and ask them to always follow that document , and never deviate from it.
Since your team is using Hashicorp Terraform Enterprise Edition , enable Sentinel , and write Policy-As-Code rules that will check for non-compliant resource provisioning , and prevent/report them.
Use Terraform OSS Sentinel Lite version , which will save cost , since there is no charge for OSS , but it can still check for most non-compliant rules using Policy-As-Code.
Create a git master branch , and implement PR . Every change needs to be reviewed by you , before being merged to the master branch.
Which of the following connection types are supported by the remote-exec provisioner? (select two)
WinRM
UDP
SMB
RDP
ssh
Select all features which are exclusive to Terraform Enterprise. (Select Three)
Sentinel
Cost Estimation
Audit Logs
Clustering
SAML/SSO
Valarie has created a database instance in AWS and for ease of use is outputting the value of the database password with the following code. Valarie wants to hide the output value in the CLI after terraform apply that's why she has used sensitive parameter.
1. output "db_password" {
2. value = local.db_password
3. sensitive = true
4. }
Since sensitive is set to true, will the value associated with db password be available in plain-text in the state file for everyone to read?
Yes
No
Select the feature below that best completes the sentence:
The following list represents the different types of __________ available in Terraform.
1. max
2. min
3. join
4. replace
5. list
6. length
7. range
Backends
Data sources
Named values
Functions
Named workspaces are not a suitable isolation mechanism for strong separation between staging and production?
True
False
Talal is a DevOps engineer and he has deployed the production infrastructure using Terraform. He is using a very large configuration file to maintain and update the actual infrastructure. As the infrastructure have grown to a very complex and large, he has started experiencing slowness when he run runs terraform plan. What are the options for him to resolve this slowness?
Use -refresh=true flag as well as the -target flag with terraform plan in order to work around this.
Run terraform refresh every time before running terraform plan.
Break large configurations into several smaller configurations that can each be independently applied.
Use -refresh=false flag as well as the -target flag with terraform plan in order to work around this.
Your team has started using terraform OSS in a big way , and now wants to deploy multi region deployments (DR) in aws using the same terraform files . You want to deploy the same infra (VPC,EC2 ...) in both us-east-1 ,and us-west-2 using the same script , and then peer the VPCs across both the regions to enable DR traffic. But , when you run your script , all resources are getting created in only the default provider region.
What should you do? Your provider setting is as below -
# The default provider configuration
provider "aws" {
region = "us-east-1"
}
No way to enable this via a single script . Write 2 different scripts with different default providers in the 2 scripts , one for us-east , another for us-west
Create a list of regions , and then use a for-each to iterate over the regions , and create the same resources ,one after the one , over the loop.
Use provider alias functionality , and add another provider for us-west region . While creating the resources using the tf script , reference the appropriate provider (using the alias).
Manually create the DR region , once the Primary has been created , since you are using terraform OSS , and multi region deployment is only available in Terraform Enterprise.
Which of the following is considered a Terraform plugin?
Terraform language
Terraform tooling
Terraform logic
Terraform provider
Multiple provider instances blocks for AWS can be part of a single configuration file?
False
True
In the example below, where is the value of the DNS record's IP address originating from?
1. resource "aws_route53_record" "www"
2. {
3. zone_id = aws_route53_zone.primary.zone_id
4. name = "www.example.com"
5. type = "A"
6. ttl = "300"
7. records = [module.web_server.instance_ip_address]
8. }
The regular expression named module.web_server
The output of a module named web_server
By querying the AWS EC2 API to retrieve the IP address
Value of the web_server parameter from the variables.tf file
What does the command terraform fmt do?
Rewrite Terraform configuration files to a canonical format and style.
Deletes the existing configuration file.
Updates the font of the configuration file to the official font supported by HashiCorp.
Formats the state file in order to ensure the latest state of resources can be obtained.
Which feature of Terraform allows multiple state files for a single configuration file depending upon the environment?
Terraform Modules
Terraform Enterprise
Terraform Workspaces
Terraform Remote Backends
Terraform will sync all resources in state by default for every plan and apply, hence for larger infrastructures this can slow down terraform plan and terraform apply commands?
True
False
Your company has a lot of workloads in AWS , and Azure that were respectively created using CloudFormation , and AzureRM Templates. However , now your CIO has decided to use Terraform for all new projects , and has asked you to check how to integrate the existing environment with terraform code. What should be your next plan of action?
Tell the CIO that this is not possible . Resources created in CloudFormation , and AzureRM templates cannot be tracked using terraform.
Use terraform import command to import each resource one by one
This is only possible in Terraform Enterprise , which has the TerraformConverter exe that can take any other template language like AzureRM and convert to Terraform code
Just write the terraform config file for the new resources , and run terraform apply , the state file will automatically be updated with the details of the new resources to be imported
In order to make a Terraform configuration file dynamic and/or reusable, static values should be converted to use what?
Input Parameters
Module
Regular Expressions
Output Value
Which Terraform command will check and report errors within modules, attribute names, and value types to make sure they are syntactically valid and internally consistent?
terraform validate
terraform format
terraform fmt
terraform show
When using constraint expressions to signify a version of a provider, which of the following are valid provider versions that satisfy the expression found in the following code snippet: (select two)
1. terraform
2. {
3. required_providers
4. {
5. aws = "~> 1.2.0"
6. }
7. }
1.3.1
1.2.3
1.2.9
1.3.0
resource "aws_s3_bucket" "example" {
bucket = "my-test-s3-terraform-bucket"
...
}
resource "aws_iam_role" "test_role" {
name = "test_role"
...
}
Due to the way that the application code is written ,
the s3 bucket must be created before the test role is created , otherwise there will be a problem.
How can you ensure that?
This will already be taken care of by terraform native implicit dependency. Nothing else needs to be done from your end.
Add explicit dependency using depends_on . This will ensure the correct order of resource creation.
Create 2 separate terraform config scripts , and run them one by one , 1 for s3 bucket , and another for IAM role , run the S3 bucket script first.
This is not possible to control in terraform . Terraform will take care of it in a native way , and create a dependency graph that is best suited for the parallel resource creation.
