Test yourself
Terraform
Final exam · 15 questions · answers explained as you pick
Beginner
5 questions
01Terraform being "declarative" means you…
Incorrect — that is imperative; Terraform computes the steps for you.
Correct — you assert what should exist; Terraform diffs against reality and converges.
Incorrect — idempotence means it changes only what differs.
Incorrect — providers make it cloud-agnostic across hundreds of platforms.
02What is the Terraform state file for?
Incorrect — it is not a vault — it stores state in plaintext, which is why it needs protecting.
Incorrect — providers are handled by init, not state.
Correct — state is Terraform’s memory of what it created and their real IDs.
Incorrect — that is terraform fmt, unrelated to state.
03In a plan, the symbol that should make you stop and check is…
Incorrect — creating is normal and safe.
Incorrect — in-place changes are usually safe.
Correct — replace destroys the existing resource first — data loss and downtime for stateful resources.
Incorrect — that is just a comment line.
04Why must you never commit terraform.tfstate to Git?
Correct — committing it leaks secrets to anyone with repo access; use a remote backend instead.
Incorrect — size is not the issue — sensitivity and conflicts are.
Incorrect — Git stores JSON fine; the problem is the secrets inside.
Incorrect — the real reasons are secret exposure and state conflicts.
05Marking an output sensitive = true…
Incorrect — it does not encrypt state; the value is still plaintext there.
Correct — sensitive is display hygiene, not encryption — secure the backend for the real protection.
Incorrect — the value remains in state; only the terminal display is redacted.
Incorrect — anyone with state access can read it.
5 questions · explanations appear as you answer
Intermediate
5 questions
01A Terraform module is…
Incorrect — no — it is a code construct, not an account.
Correct — modules package infrastructure into shareable components with an input/output contract.
Incorrect — state is separate; a module is code.
Incorrect — providers talk to platform APIs; modules are your reusable config.
02The two properties a real (team) backend must provide are…
Incorrect — not the point — correctness for teams is.
Incorrect — those are fmt/validate, not backend features.
Correct — shared encrypted storage plus a lock so two applies cannot corrupt state — e.g. S3 + DynamoDB.
Incorrect — cosmetic, not the requirement.
03For strong production isolation, the more robust environment pattern is…
Correct — prod has its own state and you must cd into it — hard to change by accident.
Incorrect — workspaces share code/backend and the current one is easy to mistake — risky for prod.
Incorrect — manual console changes are exactly what IaC forbids.
Incorrect — that removes isolation entirely.
04A data source (e.g. data "aws_ami") is used to…
Incorrect — resource blocks create; data blocks only read.
Correct — look up an AMI, another team’s VPC, a secret — without owning it.
Incorrect — data sources never modify anything.
Incorrect — that is a backend, not a data source.
05for_each is usually preferred over count because…
Incorrect — the real reason is stable keys, not just map support.
Incorrect — count is fine for fixed identical copies or a toggle.
Correct — count is positional — deleting a middle item shifts indexes and recreates resources.
Incorrect — speed is not the difference; state addressing is.
5 questions · explanations appear as you answer
Advanced
5 questions
01To bring an already-existing cloud resource under Terraform without recreating it, you…
Incorrect — that causes an outage — the opposite of adopting it.
Correct — import maps the real resource into state; plan should then show no changes.
Incorrect — error-prone; import is the supported path.
Incorrect — console changes do not put it under Terraform management.
02A moved block is used to…
Correct — it re-maps the state address, so a rename is a move, not a destroy/create.
Incorrect — moved does not delete; it re-addresses.
Incorrect — that is backend config / state migration, not a moved block.
Incorrect — importing is the import block; moved re-maps existing addresses.
03Checkov, Trivy config, Terrascan and KICS primarily…
Incorrect — they scan, not provision.
Incorrect — that is a secrets manager.
Correct — they ship large check libraries and gate the pipeline — catch it in review, not prod.
Incorrect — unrelated to state.
04The key safety property of the plan-on-PR / apply-on-merge CI flow is…
Incorrect — speed is not the point; reviewability and safety are.
Correct — plan -out=tfplan then apply tfplan closes the approval-to-apply gap.
Incorrect — state is still required.
Incorrect — the opposite — apply is gated behind review and restricted.
05The biggest CI credential improvement for Terraform is…
Correct — the pipeline assumes a narrow role for minutes — no permanent access key to leak.
Incorrect — never — that is a guaranteed leak.
Incorrect — scatters long-lived credentials; the opposite of the goal.
Incorrect — maximally over-privileged and long-lived — worst case.
5 questions · explanations appear as you answer