--- title: "Terraform: Infrastructure as Code Essentials" description: "Test your knowledge of Terraform fundamentals with this quiz covering key concepts and best practices." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/terraform-essentials-quiz --- # Terraform: Infrastructure as Code Essentials Welcome to the Terraform Basics Quiz! This quiz is designed to test your understanding of fundamental Terraform concepts and best practices. Each question is multiple-choice, and you'll find hints to help you along the way. Good luck! ## Questions ### 1. In Terraform dynamic blocks, which attribute determines the number of times the nested configuration is repeated? - `content` - 'content' defines the internal settings of the block but does not control the iteration count. - `iterator` - 'iterator' defines the name of the temporary object but does not set the loop frequency. - `count` - 'count' is used for resources/modules; dynamic blocks specifically require for_each. - **`for_each`** ✅ - The 'for_each' argument defines the collection to loop through, generating one block per item. **Hint:** It shares its name with the meta-argument used to create multiple instances of a resource. ### 2. Which feature allows you to verify infrastructure health without needing to define a specific resource instance? - **`check` blocks** ✅ - Check blocks allow for functional validation of infrastructure state after the apply is complete. - `output` blocks - Output blocks export data from the state but do not perform health or logic assertions. - `import` blocks - Import blocks are used to bring existing infrastructure under management, not to verify health. - `assert` blocks - While logical, 'assert' is not a top-level HCL block; health checks use the 'check' syntax. **Hint:** Think of a top-level block that performs assertions independently. ### 3. Which lifecycle meta-argument ensures a new resource is provisioned before the old one is removed? - `depends_on` - Controls the order of creation between different resources, not the replacement logic of one. - `ignore_changes` - Prevents updates based on external drift but does not affect the creation/destruction sequence. - `prevent_destroy` - Provides a safety lock against deletion but does not allow for zero-downtime replacements. - **`create_before_destroy`** ✅ - This rule forces Terraform to create the new resource before deleting the one it replaces. **Hint:** Reverses the default destruction behavior. ### 4. When refactoring code to rename a resource without destroying it, which block should be added to the HCL? - `import` - Used for unmanaged infrastructure, not for renaming resources already present in the state. - **`moved`** ✅ - The 'moved' block allows HCL-native refactoring to keep state synchronized with name changes. - `alias` - Used within provider blocks to handle multiple regions or accounts, not for resource renaming. - `state` - There is no 'state' block in HCL; state is managed via CLI or the moved block. **Hint:** Records a movement or rename directly in the configuration. ### 5. What is the correct priority order for variable values (lowest to highest precedence)? - **`Env vars` < `terraform.tfvars` < `*.auto.tfvars` < `CLI flags`** ✅ - Variables start with environment shells, move to files, and are finally overridden by CLI flags. - `terraform.tfvars` < `Env vars` < `*.auto.tfvars` < `CLI flags` - Environment variables actually have lower precedence than local variable files. - `Env vars` < `*.auto.tfvars` < `terraform.tfvars` < `CLI flags` - Auto-tfvars files have higher precedence than the standard terraform.tfvars file. - `CLI flags` < `*.auto.tfvars` < `terraform.tfvars` < `Env vars` - CLI flags are the highest precedence, while environment variables are the lowest. **Hint:** CLI flags are generally considered the final override. ### 6. In HCP Terraform, what is the primary purpose of a 'Project'? - Isolating provider logic - Provider logic is handled in code; projects are used for workspace administration. - **Grouping related workspaces** ✅ - Projects allow teams to organize multiple workspaces into logical groups for access control. - Versioning module source - Module versioning is managed by the Private Module Registry, not by Project blocks. - Managing backend state - Backends are managed via the settings or terraform block, whereas projects organize the UI. **Hint:** An organizational layer above workspaces. ### 7. True or False: Values marked as 'sensitive = true' in HCL are encrypted within the state file. - True - The sensitive flag only masks output; it does not encrypt data inside the state file. - **False** ✅ - Data remains as plain text in the state file, which is why securing the backend is critical. **Hint:** Masking in the CLI is different from storage in the backend. ### 8. Which command provides an interactive REPL to evaluate HCL expressions? - **`terraform console`** ✅ - The console command allows you to interactively test expressions against your state. - `terraform debug` - There is no 'debug' command; debugging is typically handled via the TF_LOG environment variable. - `terraform output` - Output extracts defined values from state but does not provide an interactive shell. - `terraform graph` - Graph generates a visual representation of dependencies, not an interactive evaluation shell. **Hint:** Useful for testing functions and variable values. ### 9. Which command removes a resource from the state file without deleting the cloud resource? - `terraform taint` - Marks a resource for destruction and recreation, rather than removing it from management. - `terraform delete` - There is no 'delete' command in Terraform; removal is handled by destroy or state rm. - **`terraform state rm`** ✅ - This removes the resource from state tracking while leaving the physical infrastructure intact. - `terraform untrack` - Untrack is not a valid Terraform command; the correct syntax is 'state rm'. **Hint:** Forces Terraform to "forget" an object. ### 10. What is the function of the 'depends_on' meta-argument? - **Forcing resource order** ✅ - Used to create explicit dependencies when one resource relies on another without a direct link. - Handling error logic - Depends_on affects the graph and order but does not provide try/catch or error handling logic. - Optimizing plan speed - Adding dependencies can actually slow down operations by reducing the level of parallelism. - Managing provider bits - Providers are managed through the provider block; depends_on is only for resource relationships. **Hint:** Used when dependencies cannot be automatically inferred. ### 11. Which command downloads providers and initializes the working directory? - `terraform get` - Get is used to download modules, but it does not initialize providers or backends. - **`terraform init`** ✅ - Initialization prepares the directory, downloads plugins, and configures the backend. - `terraform plan` - Plan requires an initialized directory to compare the code against the current state. - `terraform start` - There is no 'start' command; Terraform uses init, plan, and apply to manage workflows. **Hint:** The mandatory first step for any project. ### 12. What is the default number of concurrent operations used during a Terraform apply? - 5 - This is a common custom setting, but the default is higher. - **10** ✅ - Terraform defaults to 10 concurrent operations to balance speed and provider rate limits. - 25 - While possible via flags, 25 is not the built-in default for parallelism. - 50 - 50 is generally too high for default use as it could trigger API throttling. **Hint:** The standard parallelism setting. ### 13. Which built-in function is used to combine multiple maps into one? - `concat()` - Concat is used to combine lists; it does not work on map data types. - **`merge()`** ✅ - The merge function takes multiple maps and creates a single map containing all keys. - `join()` - Join is used to turn a list into a single string using a specific delimiter. - `union()` - Union is used for set operations on lists, not for combining map attributes. **Hint:** Commonly used for merging sets of tags. ### 14. Which block type allows for code-based importing of existing infrastructure? - `resource` - Defines the end state but does not itself perform the import logic from existing cloud IDs. - **`import`** ✅ - The import block allows you to define import operations directly within the HCL configuration. - `external` - The external block is a data source for running scripts, not for importing resources into state. - `include` - There is no 'include' block for importing; import and moved are the primary refactoring blocks. **Hint:** The modern alternative to the "terraform import" CLI command. ### 15. Where does the 'local' backend store its data by default? - **`terraform.tfstate`** ✅ - By default, the local backend saves all state data to this file in the root directory. - `.terraform/state` - The .terraform folder stores binaries and cache, not the primary state file. - `terraform.config` - There is no 'terraform.config' file for state; configuration is stored in .tf files. - `state.json` - While the state is JSON, the default filename is always terraform.tfstate. **Hint:** The standard filename for local state. ### 16. Which feature handles data that should not be persisted in the state file at all? - Sensitive values - Sensitive values are still stored in the state; they are merely masked in the CLI output. - **Ephemeral values** ✅ - Ephemeral values allow for data handling that completely bypasses persistence in the state file. - Dynamic values - Dynamic blocks handle iteration, but all resulting values are still recorded in the state. - Output values - Outputs are explicitly designed to be stored in state for use by other configurations. **Hint:** Used for transient data like temporary credentials. ### 17. What is the result of a creation-time provisioner failing during an apply? - Resource is deleted - Terraform does not auto-delete failed resources; it leaves them for manual inspection. - **Resource is tainted** ✅ - The resource is marked as tainted, meaning it will be replaced during the next apply. - State is rolled back - Terraform does not support automatic state rollbacks for failed resource provisioners. - Command is retried - Terraform does not automatically retry failed provisioners unless specified in a script. **Hint:** Affects the reliability status of the resource. ### 18. What is the definition of a 'child module' in Terraform? - The root directory - The root directory is known as the root module, which calls other modules. - **A module called by another** ✅ - Any module invoked within another module's configuration is considered a child module. - A provider plugin - Providers are plugins that talk to APIs; they are not part of the HCL module hierarchy. - A local variable set - Local variables are internal to a module but do not constitute a 'child' relationship. **Hint:** Relates to how modules are called in the hierarchy. ### 19. Which command automatically updates HCL code to follow canonical styling? - `terraform lint` - Terraform does not have a 'lint' command; it uses validate for logic and fmt for style. - **`terraform fmt`** ✅ - The fmt command rewrite configuration files to follow the standard HCL formatting rules. - `terraform tidy` - Tidy is not a valid Terraform command; formatting is handled exclusively by 'fmt'. - `terraform clean` - There is no 'clean' command; 'fmt' is used to organize and standardize code appearance. **Hint:** Standardizes indentation and layout. ### 20. In HCP Terraform, what is a 'Variable Set'? - A collection of modules - Variable sets contain data values and credentials, not reusable HCL infrastructure code. - **Shared workspace variables** ✅ - Variable Sets allow you to define variables globally and assign them to multiple workspaces. - A provider configuration - Providers are configured in HCL; Variable Sets provide the values used by those providers. - A list of state backups - State backups are managed by the versioning system, not by variable configuration tools. **Hint:** A way to apply common variables to many workspaces at once. ### 21. Which lifecycle rule prevents a resource from being deleted during an apply or destroy? - `create_before_destroy` - Reorders the replacement process but does not block the eventual deletion of the resource. - `ignore_changes` - Stops updates to specific attributes but allows the resource itself to be destroyed. - **`prevent_destroy`** ✅ - This rule acts as a safety lock, throwing an error if an operation attempts to delete the resource. - `fixed_resource` - There is no 'fixed_resource' argument; protection is handled by 'prevent_destroy'. **Hint:** Commonly used for high-value data resources. ### 22. What is the primary technical benefit of using Remote Backends? - Reducing HCL complexity - Backends change where state is stored but have no impact on the complexity of the HCL code. - **State locking and sharing** ✅ - Remote backends allow teams to share state files and prevent concurrent writes via locking. - Automating cloud login - Authentication is usually handled by the provider or environment, not the backend storage. - Eliminating the need for init - Init is always required to configure the connection to a remote backend. **Hint:** Addresses issues with local file sharing. ### 23. Which flag allows an operation to focus on a single specific resource? - **`-target`** ✅ - The -target flag limits Terraform's scope to a specific resource and its dependencies. - `-only` - Incorrect flag; the specific command for targeting resources is '-target'. - `-focus` - Incorrect flag; targeting logic in Terraform is strictly managed via the '-target' parameter. - `-single` - Incorrect flag; Terraform does not recognize '-single' for resource isolation. **Hint:** Used to isolate changes during troubleshooting. ### 24. Which value is used with the 'sensitive' argument to mask CLI output? - `mask` - Incorrect type; sensitive requires a boolean (true/false) rather than a string. - `hide` - Incorrect type; sensitive requires a boolean (true/false) rather than a string. - **`true`** ✅ - Setting 'sensitive = true' ensures that the value is redacted in the terminal and logs. - `private` - Incorrect type; sensitive requires a boolean (true/false) rather than a string. **Hint:** A standard HCL boolean. ### 25. What is the official name for HashiCorp's managed Terraform service? - **HCP Terraform** ✅ - Terraform Cloud was rebranded as HCP Terraform to align with the HashiCorp Cloud Platform. - Terraform SaaS - While it is a SaaS product, its official brand name is HCP Terraform. - Terraform Hub - The public repository for providers is the Registry; the service is HCP Terraform. - HCP Infrastructure - HCP Infrastructure is a category of tools, but the specific product is HCP Terraform. **Hint:** Reflects the move to the unified Cloud Platform. ### 26. Which block type is used for global settings like the required Terraform version? - `provider` - Used for vendor-specific settings like API keys, not for core Terraform versioning. - **`terraform`** ✅ - The terraform block contains metadata about the required version and backend configuration. - `settings` - There is no 'settings' block in HCL; global metadata is stored in the 'terraform' block. - `version` - There is no 'version' block; version constraints are defined inside the 'terraform' block. **Hint:** Named after the application itself. ### 27. True or False: A provider block must be explicitly defined for every resource in the HCL. - True - Incorrect. Terraform can use default provider configurations if no block is present. - **False** ✅ - If a resource name starts with a known prefix, Terraform can infer the provider automatically. **Hint:** Terraform can often guess based on resource prefixes. ### 28. Which command displays the current state file in a human-readable format? - **`terraform show`** ✅ - The show command outputs the full details of the current state or a plan file. - `terraform list` - Only lists the addresses of resources without showing their attributes or values. - `terraform read` - There is no 'read' command; inspecting state data is handled by 'show'. - `terraform view` - There is no 'view' command; inspecting state data is handled by 'show'. **Hint:** Used to inspect what Terraform is currently managing. ### 29. What is an 'Implicit Dependency' in Terraform? - Using `depends_on` - This is an explicit dependency because you are manually declaring it in the code. - **Resource attribute reference** ✅ - When you use a value from Resource A inside Resource B, Terraform infers the dependency. - Manual state modification - State modifications do not create HCL code dependencies between resource blocks. - Global variable usage - Variables provide values but do not create dependencies between different resource instances. **Hint:** Created automatically when one resource references another. ### 30. Which command verifies that HCL is syntactically correct and internally consistent? - `terraform fmt` - Fmt only manages visual styling and does not check for logic or syntax errors. - `terraform plan` - Plan checks logic but also requires a connection to the backend and cloud APIs. - **`terraform validate`** ✅ - Validate checks the configuration for syntax and internal consistency without remote calls. - `terraform check` - The 'check' block is used within HCL; the CLI command for validation is 'validate'. **Hint:** Checks for logic errors without connecting to the cloud.