Test yourself
Terragrunt
Final exam · 14 questions · answers explained as you pick
Beginner
4 questions
01Terragrunt is…
Incorrect — no — it calls Terraform/OpenTofu under the hood.
Correct — it adds generated backend, inputs, and dependency handling.
Incorrect — no.
Incorrect — it uses Terraform backends; it is not one.
02The two problems Terragrunt mainly solves are…
Correct — DRY config plus a dependency graph across small state units.
Incorrect — not its focus.
Incorrect — unrelated.
Incorrect — it inherits Terraform’s state, but that is not its core purpose.
03A module source without a pinned ?ref…
Incorrect — the opposite — it floats.
Incorrect — unrelated.
Correct — pin to a tag/SHA — same discipline as any dependency.
Incorrect — no.
04Every terragrunt command ultimately…
Incorrect — no — it runs Terraform, which does.
Correct — terragrunt plan = terraform plan with the glue applied first.
Incorrect — it is a wrapper — Terraform does the work.
Incorrect — no.
4 questions · explanations appear as you answer
Intermediate
5 questions
01DRY remote state in Terragrunt works by…
Correct — path_relative_to_include() isolates each unit’s state while sharing the definition.
Incorrect — the opposite — units get isolated state.
Incorrect — there is a backend, defined once.
Incorrect — that is the duplication Terragrunt removes.
02Two units resolving to the same backend key will…
Incorrect — no — state is not meant to be shared like that.
Incorrect — no.
Correct — keep the state key unique per unit (derive from folder path).
Incorrect — it is not auto-prevented; you must keep keys unique.
03A dependency block lets a unit…
Incorrect — no.
Correct — first-class dependency graph instead of fragile remote-state data sources.
Incorrect — no.
Incorrect — no.
04mock_outputs on a dependency exist to…
Incorrect — no.
Incorrect — no — only for plan/validate.
Correct — mocks feed plan; real outputs are used at apply. Keep them minimal.
Incorrect — no.
05run-all is used to…
Correct — apply a whole environment at once — powerful, with big blast radius.
Incorrect — that is a plain terragrunt apply.
Incorrect — no.
Incorrect — no.
5 questions · explanations appear as you answer
Advanced
5 questions
01A large Terragrunt layout typically mirrors…
Incorrect — that does not scale.
Correct — navigable, and each level owns its config; modules live in a separate versioned repo.
Incorrect — modules are separate from the live config repo.
Incorrect — no.
02A before_hook/after_hook runs…
Incorrect — no.
Incorrect — no.
Correct — useful (policy check, notify) but treat hook commands as reviewed code.
Incorrect — they execute.
03Why is the shared state backend the estate’s crown jewels?
Correct — read access can expose secrets estate-wide; write access can hijack everything Terraform manages.
Incorrect — modules live in a code repo, not state.
Incorrect — no.
Incorrect — it must not be public — lock it down.
04For cross-account credentials, Terragrunt should generate providers that…
Incorrect — a breach vector; avoid.
Correct — scope each account’s role; no durable keys.
Incorrect — never for automation.
Incorrect — impossible.
05The biggest risk of a Terragrunt CI job is…
Incorrect — not the security concern.
Incorrect — not the risk.
Correct — scope to changed units, require approval, guard destroy, use scoped OIDC roles.
Incorrect — no.
5 questions · explanations appear as you answer