Test yourself

Pulumi

Final exam · 14 questions · answers explained as you pick

Beginner

4 questions

01The defining difference of Pulumi vs a DSL tool like Terraform is that Pulumi programs are…

Awritten in YAML only

Incorrect — YAML is one option, but the point is general-purpose languages.

Bwritten in real languages (TS, Python, Go, C#) with loops, functions, classes

Correct — you use the language’s own constructs instead of a DSL’s.

Cstateless

Incorrect — Pulumi keeps state like other desired-state tools.

DAWS-only

Incorrect — Pulumi supports many providers.

02A Pulumi stack is…

Aa container image

Incorrect — unrelated to images.

Bthe state backend

Incorrect — the backend stores state; a stack is an instance of the program.

Can isolated instance of a program (dev, prod) with its own config and state

Correct — one project, many stacks, is how Pulumi does environments.

Da module registry

Incorrect — that is not what a stack is.

03Renaming a resource’s logical name (its first argument) causes Pulumi to…

Adestroy the old resource and create a new one

Correct — it tracks by logical name; a rename is a replace unless you use an alias.

Brename it in place with no effect

Incorrect — there is no free in-place rename — it is a replace.

Cerror out

Incorrect — it proceeds as a destroy/create, which is the danger.

Dignore the change

Incorrect — the change is significant — it replaces the resource.

04In a preview, the symbol for destroy-and-recreate is…

A+ (create)

Incorrect — + is a plain create.

B~ (update)

Incorrect — ~ is in-place update.

C+- (replace)

Correct — replace = destroy then create; on stateful resources that means data loss.

D- (delete)

Incorrect — - is a plain delete.

Intermediate

5 questions

01An Output<T> in Pulumi represents…

Aa plain synchronous string

Incorrect — if it were plain, you would not need apply.

Ba value known only after deploy, handled asynchronously (apply/interpolate/all)

Correct — the value does not exist while the program runs, so you transform it, not read it directly.

Ca secret only

Incorrect — secrets are Outputs, but not all Outputs are secret.

Da log line

Incorrect — unrelated.

02Concatenating an Output with a plain string ("id: " + res.id) yields…

A"Calculating..." / [object Object], not the value — you must use apply/interpolate

Correct — the value is not known at program-run time; that is the classic first-day bug.

Bthe correct value

Incorrect — it does not resolve synchronously.

Ca compile error always

Incorrect — it often compiles but produces the wrong string at runtime.

Da secret

Incorrect — stringifying does not make it a secret.

03pulumi config set dbPassword X --secret causes the value to be…

Aprinted to the console

Incorrect — secrets are not printed.

Bencrypted with the stack’s encryption provider before being stored in config/state

Correct — the file holds ciphertext; it arrives as a sensitive Output in the program.

Cstored in plaintext

Incorrect — the whole point is that it is encrypted.

Dignored

Incorrect — it is stored, encrypted.

04A ComponentResource is used to…

Astore state

Incorrect — that is the backend’s job.

Bencrypt secrets

Incorrect — unrelated to components.

Cpackage several resources into one reusable, higher-level class (like a module)

Correct — it encapsulates a pattern — e.g. a secure bucket — behind a clean class.

Drun tests

Incorrect — components are for composition, not testing.

05A StackReference lets one stack…

Aread another stack’s exported outputs (read-only)

Correct — e.g. an app stack reads the networking stack’s VPC/subnet IDs.

Bmodify another stack’s resources

Incorrect — it is read-only — it cannot change the producer.

Cmerge two stacks

Incorrect — it references, it does not merge.

Ddelete another stack

Incorrect — no — it only reads outputs.

Advanced

5 questions

01The Automation API is…

Aa state backend

Incorrect — no — it is the engine exposed as a library.

Bthe Pulumi engine as a library, so preview/up/destroy are function calls (no CLI)

Correct — it lets you build infra provisioning into an app or platform.

Ca secrets manager

Incorrect — unrelated.

Da linter

Incorrect — no.

02A dynamic provider is for…

Aspeeding up previews

Incorrect — not its purpose.

Bencrypting state

Incorrect — unrelated.

Cmanaging a resource that has no existing provider by implementing CRUD yourself

Correct — e.g. an internal API or a SaaS with only a REST interface.

Drunning tests

Incorrect — no.

03CrossGuard evaluates policies…

Aduring preview/update, and mandatory violations block the deploy

Correct — so a non-compliant resource never reaches the cloud; advisory lets you warn first.

Bonly after resources are deployed

Incorrect — it gates before deploy, not after.

Conly in Pulumi Cloud, never locally

Incorrect — you can run a policy pack on a local update too.

Dnever — it is documentation

Incorrect — it actively enforces.

04For fast, free security-invariant checks on infra code you should write…

Aonly integration tests that deploy real resources

Incorrect — those are slow and billable; not for every commit.

Bmocked unit tests asserting on resource inputs (e.g. never public)

Correct — they run in milliseconds with no deployment — ideal for invariants on every commit.

Cno tests — previews are enough

Incorrect — a preview is not a test suite.

Dmanual review only

Incorrect — automation is the point.

05The critical thing to protect for a self-managed Pulumi backend is…

Athe CLI version

Incorrect — helpful to pin, but not the crown jewel.

Bthe preview output

Incorrect — previews are meant to be visible.

Cthe secrets encryption key (KMS/passphrase) — losing it can make secrets/state unrecoverable

Correct — back it with managed KMS and backups; never commit a passphrase.

Dthe number of stacks

Incorrect — irrelevant to security.