All 37 Terraform & IaC quiz questions below come with a short explanation, visible right on the page — no sign-in needed. They're grouped by beginner and intermediate levels and 37 subtopics, so you can revise one part at a time. Choose Try Terraform & IaC quiz above to take a scored run and review the questions you got wrong.
C.The infrastructure is reproducible and the changes have a history
D.The infrastructure scales itself automatically as load rises
Answer: C
Infrastructure becomes reproducible and versioned: rebuild an identical environment with one command, know who changed what and when, and review changes before applying them just like reviewing code.
A.Mapping the resources in the code to the real ones
B.Storing a backup of the infrastructure for recovery
C.Holding the credentials for the cloud provider
D.Storing the history of every infrastructure change
Answer: A
The state file maps resources declared in code to the real resources on the provider. Without it, Terraform doesn't know what has already been created and will create duplicates instead of updating.
B.Creating the resources but not activating them yet
C.Comparing the code against the real state and listing the changes
D.Downloading the extensions that are needed
Answer: C
The plan step compares the code against the real state and lists what will be created, changed, or destroyed. It's a mandatory review step, since it shows the consequences before any change is made.
B.Translating the declarations into service API calls
C.Managing the users' credentials
D.Estimating the infrastructure's cost before creating it
Answer: B
A provider translates resource declarations into API calls for the corresponding service. That way the same syntax works across many platforms, and each provider has its own version that needs to be pinned.
What is the precedence order for Terraform variable values?
A.Environment variables always take the highest precedence
B.Terraform errors when several sources supply a value
C.The default in the declaration always wins
D.A command-line argument outranks a values file
Answer: D
From lowest to highest: default values, environment variables, auto-loaded value files, explicitly specified files, then command-line arguments at the highest level. That way you can override temporarily without editing files.
How does a data source differ from a resource in Terraform?
A.A data source only reads and neither creates nor changes anything
B.A data source is not written into the state file
C.A data source only works with the large cloud providers
D.A data source creates resources but does not manage their lifecycle
Answer: A
A data source only reads information about something that already exists; it doesn't create or modify anything. It's used to reference resources managed by another team or configuration, such as a shared network or the latest VM image.
B.It downloads the providers and modules and sets up the state backend
C.It generates documentation describing the resources in the configuration
D.It creates an empty state file for new infrastructure
Answer: B
It downloads providers and modules into the working directory, then configures where state is stored. It must be re-run whenever you add a new provider, add a module, or change the state backend configuration.
A.The configuration is compiled to machine code before running
B.The commands run in the order they appear in the file
C.Every change must be written as a script
D.You describe the desired state and the tool works out the rest
Answer: D
The author describes the desired state and the tool works out the steps to reach it. That way running it repeatedly gives the same result, unlike imperative scripts which can create duplicate resources when run twice.
B.Exposing infrastructure information for other things to use
C.Defining a module's input parameters
D.Storing variable values for the next run to reuse
Answer: B
Outputs expose information about the infrastructure just created, such as a server address or bucket name, to display to users, pass to a parent module, or let another configuration read via remote state.
A plan shows a resource will be destroyed and recreated. Common cause?
A.The Terraform version differs from the previous run
B.The state file has been corrupted or has drifted
C.The resource was deleted by hand in the console
D.The changed attribute is one that cannot be modified in place
Answer: D
The changed attribute is not updatable in place per the provider's rules, for example the name or region of some resources. Terraform must destroy and recreate, and for a database that means data loss.
Why should Terraform state live in a remote backend rather than a local machine?
A.Terraform runs faster with the state stored remotely
B.Remote state contains no sensitive data
C.The state is compressed so it takes less space
D.The whole team shares one state and it can be locked
Answer: D
So the whole team shares one state and has a locking mechanism preventing two people from applying at the same time. State on a local machine is lost if the machine fails, and no one else can run it if that person is away.
Someone edits a resource by hand in the console. What does Terraform do next run?
A.It detects the drift and proposes bringing it back to the code
B.It updates the code to match the manual change
C.It ignores it since the change was not made by Terraform
D.It errors and refuses to run until it is fixed by hand
Answer: A
Terraform detects the drift and proposes bringing the resource back to what the code describes. Code is the source of truth, so manual changes will be overwritten on the next apply unless they are added to the code.
A.Packaging a group of resources for reuse in several places
B.Splitting the state into several smaller files
C.Allowing parts of the infrastructure to run in parallel
D.Separating access between different teams
Answer: A
A module packages a group of resources with input variables and output values for reuse. Note: modules within the same configuration still share one state, so they cannot separate the blast radius.
Why iterate by key rather than by index when creating many resources?
A.Key-based iteration lets you name the resources freely
B.Iterating by key applies faster
C.Index-based iteration cannot be used with modules
D.Removing a middle element does not shift the ones after it
Answer: D
With an index-based loop, deleting a middle element makes every following element shift index, so Terraform treats them as different resources and destroys and recreates them en masse. Iterating by key gives each resource a stable address.
How do you bring a manually created resource under Terraform management?
A.Run apply and Terraform will adopt the existing resource
B.Write the matching declaration and then import it into the state
C.Delete the old resource and let Terraform recreate it
D.Edit the state file by hand
Answer: B
Write the corresponding declaration in code, then import the resource into state using its real identifier. After that, run plan and adjust the declaration until the plan no longer proposes any changes.
How do you rename a resource block without recreating the resource?
A.Run apply twice so Terraform works it out
B.Delete the state file and reimport everything
C.Declare the address move within the state
D.Keep the old name and add an explanatory comment
Answer: C
Declare the state address move, either with a moved block in code or with the move command. Terraform identifies resources by their address in the configuration, so renaming without declaring it will be treated as destroying the old and creating the new.
How should staging and production be separated in Terraform?
A.Use the same state but different credentials
B.A separate state per environment with shared modules
C.One single state, distinguished by resource names
D.Copy the whole codebase into a directory per environment
Answer: B
Each environment has its own state to limit the blast radius, but shares modules so both are structurally identical and differ only in explicitly declared values.
What risk comes from not pinning provider versions?
A.Terraform refuses to run without a version constraint
B.An ordinary run suddenly proposes a mass of changes
C.The state becomes incompatible between machines
D.The provider cannot be downloaded without a network
Answer: B
An ordinary run can propose mass changes to resources because a new provider version changes default values or how attributes are interpreted. On production, that is unnecessary risk.
What does marking a Terraform variable as sensitive achieve?
A.It hides the displayed value without encrypting the state
B.It stops the value being written into the state
C.It requires extra confirmation when applying changes
D.It encrypts that value in the state file
Answer: A
It only masks the value in displayed output and logs, it doesn't encrypt anything. The value still sits in plaintext in the state file, so real protection has to come from encrypting the state storage and restricting access to it.
When is an explicit dependency between two resources needed?
A.When the two resources belong to the same module
B.When the resources are created with a loop
C.When you want the two resources created in parallel
D.When there is a real dependency but no reference between them
Answer: D
When there is a real dependency that cannot be expressed through attribute references, for example a permission policy must exist before a service starts even though the code does not reference it. If there is a reference, Terraform infers the order automatically.
A.Apply automatically as soon as code is pushed to the branch
B.Run apply on a nightly schedule
C.Plan when the pull request opens and apply after approval
D.Run it only from the infrastructure owner's own machine
Answer: C
Run plan automatically when opening a merge request and post the results to the discussion for review, then apply after approval and merge. This ensures infrastructure changes go through the same process as code changes.
How do Terraform locals differ from input variables?
A.A local value is usable from every module in the project
B.A local value is computed from an expression in the code
C.A local value is stored in its own state file
D.A local value can change while running
Answer: B
Local values are computed from expressions inside the configuration rather than passed in from outside like input variables. They are used to name a repeated expression, for example a naming convention or a common set of labels.
A server is in a broken state and must be replaced. How does Terraform handle it?
A.Remove the resource from the state and run apply
B.Change an arbitrary attribute to force a recreation
C.Mark the resource for replacement on the next apply
D.Delete it by hand in the console and run apply
Answer: C
Use terraform plan -replace=<resource_address> -out=tfplan then run terraform apply tfplan. The -replace option records the replacement intent in the plan for review, instead of the older terraform taint mechanism.
What is automated policy checking of infrastructure configuration for?
A.Producing documentation of the infrastructure for the operations team
B.Optimizing cost by picking cheaper machine types
C.Blocking non-compliant configuration before it is applied
D.Checking the configuration files' syntax
Answer: C
It blocks non-compliant configuration right in the pipeline, for example a public bucket, a security group opening management ports to the internet, or resources missing required tags. Blocking early is much cheaper than fixing later.
Why should all company infrastructure not live in one state?
A.Terraform limits how many resources one state may hold
B.The blast radius is too wide and the runs take too long
C.Each provider needs its own separate state
D.A large state cannot be stored in a remote backend
Answer: B
Because the blast radius is too wide and runtime is too long: a single mistake can affect everything, every run must refresh thousands of resources, and the state lock forces teams to wait for each other.
Why avoid running configuration commands inside servers from Terraform?
A.The commands only run on certain operating systems
B.Terraform cannot connect into a server
C.The commands run too slowly compared with creating resources
D.The result is not recorded in the state
Answer: D
The result of the command is not reflected in the state, so Terraform only knows whether the command ran or not, not what configuration the server is in. A command that fails midway also leaves resources in an undefined state.
How do you create resources in two regions within one configuration?
A.Run Terraform twice with a different region variable
B.Set the region attribute directly on each resource
C.Declare several provider configurations with aliases
D.Use two workspaces for the two regions
Answer: C
Declare multiple provider configurations with aliases, each pointing to a region or an account, then specify the alias for each resource. This allows one configuration to manage multiple regions and cross-reference between them.
Why is tagging every resource an important practice?
A.Cost allocation and identifying who owns a resource
B.The provider discounts resources that carry enough tags
C.Terraform uses the tags to identify resources in the state
D.It improves the performance of the tagged resources
Answer: A
Tags allow cost allocation by team and by project, and answer the question of who owns an unknown resource. Without tags, the bill is just a single total, and nobody dares to delete something whose origin is unclear.
At what level should infrastructure configuration testing start?
A.A visual code review is enough for infrastructure
B.Only test in production since that is the real environment
C.Automated syntax checking and plan generation
D.Provision real infrastructure and check it with scripts
Answer: C
Start with automated syntax checking and planning in the pipeline. These two steps are cheap and catch most errors. Tests that build real infrastructure are expensive, so reserve them for important shared modules.
Who should have permission to apply changes to production?
A.Anyone who can merge into the main branch
B.Only the integration system, with people holding read access
C.One single owner holding all the rights
D.Every engineer on the infrastructure team, so they can act quickly
Answer: B
Only CI has permission to apply, while humans only have read access in the production environment. This way every change goes through review, leaves an audit trail, and nobody can run it from a local machine.
How do you replace a serving resource without downtime?
A.Split the change across several smaller applies
B.Increase the replica count before applying the change
C.Apply during off-peak hours to reduce the impact
D.Declare that the new one is created before the old is destroyed
Answer: D
Declare create before destroy in the resource's lifecycle block. Terraform defaults to destroy before create, so there is a window where no resource is serving.
How do you prevent a database from being deleted by mistake through Terraform?
A.Declare deletion prevention in the resource's lifecycle block
B.Add a warning comment above the resource block
C.Put that resource in a separate module
D.Remove the resource from the state so Terraform forgets it
Answer: A
Declare prevent destroy in the lifecycle block (lifecycle { prevent_destroy = true }): while the resource block remains in the configuration, any plan containing a destroy of that resource will fail. Also add provider-level protection and enable automatic backups, because one layer is not enough.
An apply fails midway due to a provider API error. What is the state then?
A.The state is corrupted and must be restored from a copy
B.The already-created resources are deleted automatically on failure
C.Every change is rolled back as one transaction
D.The resources already created are recorded in the state
Answer: D
Resources that were already created are still written to state, so re-running continues from the missing part instead of starting over. There is no full rollback, because Terraform has no transaction across multiple resources.
What matters most when splitting a large configuration into modules?
A.Destroy the old resources and rebuild them from the new module
B.Split the state per module as soon as it is created
C.Declare the address moves within the state
D.Name the modules after the cloud provider
Answer: C
You must declare moved blocks in state. Moving resources into a module changes their addresses, so without declarations Terraform will destroy the old resources and recreate everything.
How should a company-wide shared module be referenced?
A.By a pinned version rather than the main branch
B.By the main branch so it is always the newest
C.By a relative path to a directory on the machine
D.Copy the module's code into each project that uses it
Answer: A
Reference it at a pinned version, for example a release tag. Pointing at the main branch means infrastructure can change just because someone merged a change, and nobody can trace the cause when an incident happens.
How does infrastructure as code help control cloud cost?
A.Estimating the cost during the review itself
B.Automatically shutting unused resources down at night
C.Automatically choosing the cheapest machine type for each resource
D.Negotiating a better price with the cloud provider
Answer: A
Cost becomes visible before apply: estimation tools read the plan and show how much the change increases or decreases the bill. That way the decision happens at review time instead of being discovered at the end of the month.
What does creating an ephemeral environment per branch require?
A.Every resource must have a parameterized name and be fully destroyable
B.The state stored on the developer's machine
C.A separate configuration per branch in the repository
D.A separate cloud account for each branch
Answer: A
Every resource must have names parameterised by branch so they don't collide, and must be cleanly destroyable when the branch closes. Fixed names collide as soon as a second environment is created, while leftover resources accumulate cost silently.
