Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Question and Answers

This is where Terraform saves resource state when using a remote backend or Terraform Cloud integration, as it allows you to store and manage your state file in a remote location, such as a cloud storage service or Terraform Cloud’s servers. This enables collaboration, security, and scalability for your Terraform infrastructure.

Rationale for Correct Answer: A Terraform configuration supports a single cloud block (similar to a single backend configuration). The cloud block defines where Terraform runs (HCP Terraform / Terraform Enterprise) and how the workspace is associated. You cannot connect one configuration to two separate Cloud/Enterprise instances simultaneously using multiple cloud blocks.

Analysis of Incorrect Options (Distractors):

A (True): Incorrect—Terraform does not allow multiple cloud blocks; the configuration can target only one Cloud/Enterprise context at a time.

Key Concept: cloud block constraints and workspace association with HCP Terraform/Terraform Enterprise.

This is the correct way to reference the volume IDs associated with the ebs_block_device blocks in this configuration, using the splat expression syntax. The other options are either invalid or incomplete.

The terraform fmt command is used to format Terraform configuration files to a canonical format and style. This ensures that all team members are using a consistent style, making the code easier to read and maintain. It automatically applies Terraform ' s standard formatting conventions to your configuration files, helping maintain consistency across the team ' s codebase.

Sensitive values such as API tokens should be stored in a secure way, either in Terraform Cloud variables marked as sensitive or in HashiCorp Vault. Storing secrets in version control systems or plaintext files is not recommended.

A secure string is not a valid option to keep secrets out of Terraform configuration files. A secure string is a feature of AWS Systems Manager Parameter Store that allows you to store sensitive data encrypted with a KMS key. However, Terraform does not support secure strings natively and requires a custom data source to retrieve them. The other options are valid ways to keep secrets out of Terraform configuration files. A Terraform provider can expose secrets as data sources that can be referenced in the configuration. Environment variables can be used to set values for input variables that contain secrets. A -var flag can be used to pass values for input variables that contain secrets from the command line or a file. References = [AWS Systems Manager Parameter Store], [Terraform AWS Provider Issue #55] , [Terraform Providers], [Terraform Input Variables]

Rationale for Correct Answer (B):

The file() function reads a file from disk and returns its content as a string. This is commonly used for public keys (.pub files).

Analysis of Incorrect Options:

A. fileset(): Returns a set of filenames matching a pattern, not file contents.

C. filebase64(): Reads file and returns Base64 encoded string — unnecessary for .pub.

D. templatefile(): Used for rendering templates with variables, not raw file contents.

Key Concept:

Terraform’s file() function is used for injecting file content directly.

Rationale for Correct Answer: Terraform state is Terraform’s record of what it manages: it maps resource addresses in configuration to real-world resource IDs and stores metadata needed to plan changes. That makes it a source of truth for resources Terraform is managing, enabling accurate diffs, updates, and deletes.

Analysis of Incorrect Options (Distractors):

A: Incorrect—Terraform state does not schedule jobs; that’s the role of external schedulers/automation tools.

B: Incorrect—the desired state is expressed in .tf configuration, not in the state file. State reflects the current known state of managed infrastructure.

D: Incorrect—resources created manually in a cloud console are not automatically in Terraform state unless they are imported/adopted.

Key Concept: Purpose of Terraform state: resource mapping, metadata, and planning accuracy.

Rationale for Correct Answer: A major IaC advantage is declarative desired state: you describe what you want, and the tool figures out the necessary create/update/delete API calls to converge infrastructure to that end state. This reduces manual API orchestration and makes changes repeatable and reviewable.

Analysis of Incorrect Options (Distractors):

A: Incorrect—IaC reduces the need to write individual API calls; that’s the point.

B: Incorrect—IaC tools typically use provider plugins and APIs; efficiency is not about “calling CLI tools.”

C: Incorrect—IaC configurations define desired state; “current state” is discovered via refresh/state, not defined as the goal.

Key Concept: Declarative IaC: define end state, tool determines API actions.

This is what will happen if you run terraform apply in the working directory again, after removing the resource definition from your Terraform configuration file. Terraform will detect that there is a resource in the state file that is not present in the configuration file, and will assume that you want to delete it.

This is the meta-argument that you must include in any non-default provider configurations, as it allows you to give a friendly name to the configuration and reference it in other parts of your code. The other options are either invalid or irrelevant for this purpose.

This is where Terraform cannot load a provider from, as it requires a compiled binary file that implements the provider protocol. You can load a provider from a plugins directory, a provider plugin cache, or the official HashiCorp distribution on releases.hashicorp.com.

Detailed Explanation:

Rationale for Correct Answer: HCP Terraform health assessments are part of continuous validation. They can detect resource drift and evaluate Terraform check blocks to validate infrastructure health after deployment.

Analysis of Incorrect Options (Distractors):

A. Terraform test execution. Incorrect. Terraform tests are not the core function of HCP Terraform health assessments.

C. Infrastructure cost estimation. Incorrect. Cost estimation is a run feature, not a health assessment function.

E. Sentinel policy checks. Incorrect. Sentinel policies are evaluated during the run workflow, not as the primary health assessment mechanism.

Key Concept: HCP Terraform health assessments support drift detection and check block validation.

Rationale for Correct Answer: A Terraform configuration supports only one backend at a time. The backend determines where state is stored and how locking works. Terraform does not support writing the same state to multiple backends simultaneously via multiple backend blocks.

Analysis of Incorrect Options (Distractors):

A (True): Incorrect—Terraform allows only a single backend configuration for a given working directory/root module.

Key Concept: Single-backend design: one state location per configuration/workspace.

Rationale for Correct Answer: terraform plan creates and displays an execution plan showing what Terraform would change, add, or destroy to reach the desired state—this is the standard preview step before applying changes.

Analysis of Incorrect Options (Distractors):

A: terraform show displays a human-readable view of an existing state or plan file; it doesn’t compute proposed changes by itself.

C: terraform validate checks configuration syntax and internal consistency, not proposed infrastructure changes.

D: terraform get downloads modules; it doesn’t preview infrastructure changes.

Key Concept: Previewing changes with plan in the Terraform workflow.

Rationale for Correct Answers:

C. terraform.tfvars securely managed: Acceptable if distributed securely outside version control.

D. HCP Terraform/Terraform Cloud sensitive variables: Official best practice for team-based workflows.

E. Vault: HashiCorp Vault is designed for secret management and integrates well with Terraform.

Analysis of Incorrect Options:

A: Storing plaintext secrets on shared drives is insecure.

B: Checking secrets into version control is a major security risk.

Key Concept:

Sensitive values should be managed securely in Vault, HCP Terraform, or securely shared .tfvars files — never in plaintext or version control.

You need to write Terraform configuration files for the existing infrastructure that you want to import into Terraform, otherwise Terraform will not know how to manage it. The configuration files should match the type and name of the resources that you want to import.

Rationale for Correct Answer: To make a variable optional, you define a type that allows omission. Using optional(string) indicates the input may be unset (commonly used when the variable is part of an object type, or when you want to explicitly model optionality). This supports reusable configs where the tag is included only when provided.

Analysis of Incorrect Options (Distractors):

A: Invalid syntax—type = default is not a valid type declaration.

B: Invalid syntax—default must have a value.

D: Invalid—there is no optional = true argument for variable blocks.

Key Concept: Input variable type constraints and optional inputs.

This is how the Terraform Cloud integration differs from other state backends such as S3, Consul, etc., as it allows you to perform remote operations on Terraform Cloud’s servers instead of your local machine. The other options are either incorrect or irrelevant.

terraform initretrieves and caches providers and modules, butonly for explicitly declared modulesin the configuration.

If a module isadded or updated, terraform init needs to be re-run to download the new version.

Terraform does not automatically cache all remote modules unless they are explicitly referenced in the configuration.

Official Terraform Documentation Reference:

terraform init - HashiCorp Documentation

Rationale for Correct Answer: A parent/root module can only read values from a child module if the child module exports them via an output block. The error indicates vnet_id is not an exported output from module.my_network. Defining output " vnet_id " { value = ... } inside the networking (child) module makes module.my_network.vnet_id valid.

Analysis of Incorrect Options (Distractors):

A: Incorrect—Terraform does not use module. < name > .outputs. < output > ; module outputs are referenced directly as module. < name > . < output > .

B: Incorrect—variables are inputs to a module, not values exported from it.

C: Incorrect—missing the module. prefix and still uses an invalid .outputs path.

Key Concept: Module outputs are the contract for exposing child module values to the root/parent.

Setting the TF_LOG environment variable to DEBUG causes debug messages to be logged into stdout, along with other log levels such as TRACE, INFO, WARN, and ERROR. This can be useful for troubleshooting or debugging purposes.

Rationale for Correct Answer:

D: Many remote backends support state locking, preventing concurrent operations from corrupting state and enabling safer team collaboration.

E: Remote state often supports encryption at rest (for example, via the remote storage system’s server-side encryption), improving security of sensitive values that may reside in state.

Analysis of Incorrect Options (Distractors):

A: Incorrect—remote state does not prevent drift; drift can still occur if changes are made outside Terraform.

B: Incorrect—credentials for providers are still required; remote state doesn’t remove that need (though a platform like HCP Terraform can centralize variable/credential management).

C: Incorrect—remote backends do not inherently make plan/apply faster; latency can even increase. Performance depends on environment and backend behavior.

Key Concept: Benefits of remote state: collaboration via locking and improved security controls for state storage.

This is how Terraform chooses which version of the provider to use, when you add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The lock file records the exact version of each provider that was installed in your working directory, and ensures that Terraform will always use the same provider versions until you run terraform init -upgrade to update them.

Some backends support state locking, which prevents other users from modifying the state file while a Terraform operation is in progress. This prevents conflicts and data loss. Not all backends support this feature, and you can check the documentation for each backend type to see if it does.

You must initialize your working directory before running terraform validate, as it will ensure that all the required plugins and modules are installed and configured properly. If you skip this step, you may encounter errors or inconsistencies when validating your configuration files.

This is the kind of configuration block that will create an infrastructure object with settings specified within the block. The other options are not used for creating infrastructure objects, but for configuring providers, accessing state data, or querying data sources.

Detailed Explanation:

Rationale for Correct Answer: Terraform state files (terraform.tfstate) can store sensitive data in plain text, including attributes such as passwords, private keys, API tokens, and other secrets returned by providers. Because of this, HashiCorp recommends securing state files using encryption, access controls, and remote backends (like S3 with encryption or Terraform Cloud). Protecting the state file is a critical part of state management and security in Terraform.

Analysis of Incorrect Options (Distractors):

B. It stores all environment variables from the machine that created it. Incorrect because Terraform state does not capture environment variables; it only tracks resource attributes and metadata.

C. It can be manually edited to change the deployed resources. Incorrect because while the state file can technically be edited, this is not the reason it is considered sensitive. Also, manual edits are discouraged and risky.

D. It contains personal information about the last user to update it. Incorrect because Terraform state does not store personal user data.

Key Concept: Terraform state files may contain sensitive infrastructure data and secrets, requiring secure storage and access control.

Detailed Explanation:

Rationale for Correct Answer:Changing count changes the desired number of resource instances. To reconcile real infrastructure with the updated configuration, you run terraform apply (typically after reviewing the plan). Terraform will create/destroy instances as needed to match the new count value.

Analysis of Incorrect Options (Distractors):

A: Incorrect. terraform init is required when you add/change providers, modules, or backend configuration—not for simple variable value changes.

B: Incorrect. Outputs do not change infrastructure; they only display derived values.

C: Incorrect. You generally should not edit state to reflect intended changes; you apply configuration changes and let Terraform update state.

Key Concept:Terraform workflow: update configuration → plan/apply to converge infrastructure to desired state.

The correct answer is A because a map is Terraform’s collection type for storing values by key. A map uses string keys and associates each key with a value, making it suitable for lookups such as environment-specific settings, tags, or named configuration values. For example, a map can store tags like { Environment = " prod " , Owner = " platform " }. A list is an ordered collection accessed by numeric index. A set is an unordered collection of unique values. A tuple is a structural type with a fixed sequence of elements that can have different types. Although objects also use named attributes, the Terraform collection type specifically designed for key/value pairs is map. This distinction is important when defining variable types and reusable configuration inputs.

You should use the force-unlock command when automatic unlocking failed. Terraform will lock your state for all operations that could write state, such as plan, apply, or destroy. This prevents others from acquiring the lock and potentially corrupting your state. State locking happens automatically on all operations that could write state and you won’t see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the -lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn’t output a message, state locking is still occurring if your backend supports it. Terraform has a force-unlock command to manually unlock the state if unlocking failed. Be very careful with this command. If you unlock the state when someone else is holding the lock it could cause multiple writers. Force unlock should only be used to unlock your own lock in the situation where automatic unlocking failed. To protect you, the force-unlock command requires a unique lock ID. Terraform will output this lock ID if unlocking fails. This lock ID acts as a nonce, ensuring that locks and unlocks target the correct lock. The other situations are not valid reasons to use the force-unlock command. You should not use the force-unlock command if you have a high priority change, if apply failed due to a state lock, or if you see a status message that you cannot acquire the lock. These situations indicate that someone else is holding the lock and you should wait for them to finish theiroperation or contact them to resolve the issue. Using the force-unlock command in these cases could result in data loss or inconsistency. References = [State Locking] , [Command: force-unlock]

While terraform destroy is a common way to remove infrastructure, it isnot the only way.

You can also remove resources bydeleting them from the configuration and running terraform apply.

Manually deleting resources in the cloud provider can also remove infrastructure (but Terraform won’t be aware unless the state is updated).

Official Terraform Documentation Reference:

terraform destroy - HashiCorp Documentation

Terraform Cloud provides features like remote state storage and a web-based user interface for managing your Terraform runs. While it offers robust infrastructure as code capabilities, automatic backups of configuration and state are not directly provided by Terraform Cloud; instead, the state is stored remotely and secured.

Detailed Explanation:

Rationale for Correct Answer: terraform destroy destroys all resources managed by the current configuration, but it is not the only way to remove infrastructure. You can also remove a resource block from the configuration and run terraform apply; Terraform will then plan to destroy that specific resource because it is no longer declared.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. Terraform can destroy infrastructure through normal apply operations when resources are removed from configuration.

Key Concept: Terraform reconciles real infrastructure with configuration. Removing a resource from configuration and applying the change can destroy that resource.

Changes invoked by terraform apply take effect once the resource provider has fulfilled the request, not after Terraform has updated the state file or immediately. The state file is only a reflection of the real resources, not a source of truth.

You can develop a custom provider to manage its resources using Terraform, as Terraform is an extensible tool that allows you to write your own plugins in Go language. You can also publish your custom provider to the Terraform Registry or use it privately.

Rationale for Correct Answer: The Terraform import block (used with configuration-driven import) must specify:

id: the resource ID from the provider (the remote object identifier).

to: the target resource address in your configuration (where the imported object should map in state, e.g., aws_s3_bucket.example).These are the essential inputs Terraform needs to associate an existing remote object with a resource address in state.

Analysis of Incorrect Options (Distractors):

B (Provider): Not required as a parameter in the import block. Provider selection is determined by the configuration/provider setup (and optionally by provider meta-arguments on the resource), not by a required import block field.

D (Backend): Backends configure state storage and are set in the terraform block, unrelated to the import block’s required arguments.

Key Concept: Configuration-driven import requires mapping an existing remote object (id) to a resource address (to).

The terraform taint command marks a resource as tainted, which means it will be destroyed and recreated on the next apply. This way, you can replace the VM instance without affecting the database or other resources. References = [Terraform Taint]

The statement that you must use the CLI to switch between workspaces is false. Terraform Cloud workspaces are different from Terraform CLI workspaces. Terraform Cloud workspaces are required and represent all of the collections of infrastructure in an organization. They are also a major component of role-based access in Terraform Cloud. You can grant individual users and user groupspermissions for one or more workspaces that dictate whether they can manage variables, perform runs, etc. You can create, view, and switch between Terraform Cloud workspaces using the Terraform Cloud UI, the Workspaces API, or the Terraform Enterprise Provider5. Terraform CLI workspaces are optional and allow you to create multiple distinct instances of a single configuration within one working directory. They are useful for creating disposable environments for testing or experimenting without affecting your main or production environment. You can create, view, and switch between Terraform CLI workspaces using the terraform workspace command6. The other statements about Terraform Cloud workspaces are true. They have role-based access controls that allow you to assign permissions to users and teams based on their roles and responsibilities. You can create and manage roles using the Teams API or the Terraform Enterprise Provider7. Plans and applies can be triggered via version control system integrations that allow you to link your Terraform Cloud workspaces to your VCS repositories. You can configure VCS settings, webhooks, and branch tracking to automate your Terraform Cloud workflow8. They can securely store cloud credentials as sensitive variables that are encrypted at rest and only decrypted when needed. You can manage variables using the Terraform Cloud UI, the Variables API, or the Terraform Enterprise Provider9. References = [Workspaces]5, [Terraform CLI Workspaces] 6, [Teams and Organizations]7, [VCS Integration] 8, [Variables]9

Detailed Explanation:

Rationale for Correct Answer:Terraform import (including the newer import block workflow) needs:

A: the target resource address (e.g., aws_db_instance.main or module.db.aws_db_instance.main) where Terraform should map the existing remote object into state, and

C: the provider-specific import ID that uniquely identifies the existing database in the provider (for AWS RDS, Azure, GCP, etc. each has a defined import ID format).These are the two required pieces to tell Terraform what to import and where to place it in state.

Analysis of Incorrect Options (Distractors):

B: Incorrect. Terraform does not require a file path; it loads configuration from the working directory. What matters is the resource address exists in the configuration, not where it is located.

D: Incorrect. Platform/version may be relevant to configuring the resource correctly afterward, but it is not required to create the import mapping.

E: Incorrect. Terraform providers typically authenticate using configured credentials, not a “connection string” for importing. Import IDs are used instead.

Key Concept:Importing existing resources: mapping remote object ID to a Terraform resource address in state.

Rationale for Correct Answer:A Terraform resource block has the following structure:

resource " < RESOURCE TYPE > " " < RESOURCE NAME > " {

}

In the exhibit:

Resource type: azurerm_resource_group

Resource name: dev

The resource name is the second label in the resource block and is used internally by Terraform to reference the resource (e.g., azurerm_resource_group.dev).

Analysis of Incorrect Options (Distractors):

A. azurerm: This is the provider name, not the resource name.

B. azurerm_resource_group: This is the resource type, not the name.

D. test: This is the value of the name argument inside the resource, not the Terraform resource name.

Key Concept:Understanding the distinction between resource type, resource name, and resource arguments in Terraform configurations.

The terraform import command allows Terraform to takeexistinginfrastructure andbring it under Terraform’s management.

A (terraform get)is incorrect because it is used to fetch modules.

B (terraform refresh)is incorrect because it only updates Terraform ' s state to match the infrastructure but does not import resources.

D (terraform init)is incorrect because it only initializes the Terraform working directory.

Official Terraform Documentation Reference:

terraform import - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer:The lifecycle argument create_before_destroy = true ensures that Terraform creates the new resource first before destroying the old one. This minimizes or eliminates downtime, which is critical for high-availability systems. This directly aligns with Terraform best practices for managing resource replacement scenarios.

Analysis of Incorrect Options (Distractors):

A. prevent_destroy = true — Incorrect because it prevents Terraform from destroying the resource entirely, which would block the update rather than enable it.

B. ignore_changes = all — Incorrect because it tells Terraform to ignore changes to the resource, meaning the update would not be applied at all.

D. destroy = false — Incorrect because this is not a valid lifecycle argument in Terraform.

Key Concept:Lifecycle meta-arguments, specifically create_before_destroy, help control how Terraform handles resource replacement and minimize downtime.

Detailed Explanation:

Rationale for Correct Answer: The resource group is declared as a data source, so its name is referenced with data.azurerm_resource_group.example.name. Appending -vnet creates the required virtual network name. Option A correctly produces a string such as my-resource-group-vnet.

Analysis of Incorrect Options (Distractors):

B. Incorrect. concat() is used to concatenate lists, not strings.

C. Incorrect. join() expects a separator and a list of strings, such as join( " - " , [var.resource_group_name, " vnet " ]). The syntax shown is invalid.

D. Incorrect. This references a managed resource named azurerm_resource_group.example, but the exhibit shows a data source named data.azurerm_resource_group.example.

Key Concept: Referencing data source attributes and using string interpolation/concatenation in Terraform expressions.

Infrastructure as Code (IaC) can indeed be stored in a version control system along with application code. This practice is a fundamental principle of modern infrastructure management, allowing teams to apply software development practices like versioning, peer review, and CI/CD to infrastructure management. Storing IaC configurations in version control facilitates collaboration, history tracking, and change management.References = While this concept is a foundational aspect of IaC and is widely accepted in the industry, direct references from the HashiCorp Terraform Associate (003) study materials were not found in the provided files. However, this practice is encouraged in Terraform ' s best practices and various HashiCorp learning resources.

Detailed Explanation:

Rationale for Correct Answer:

A is correct because Terraform may replace (destroy and recreate) resources when changes cannot be applied in-place. This behavior depends on the provider and resource type (e.g., immutable infrastructure changes).

B is correct because terraform apply operates on the configuration in the current working directory and uses the currently selected workspace, which determines the state being modified.

Analysis of Incorrect Options (Distractors):

C. You must pass the output of a terraform plan command to it. Incorrect because passing a saved plan file is optional. Running terraform apply without a plan will generate and apply a plan automatically.

D. By default, it does not refresh your state file. Incorrect because Terraform does refresh state by default before applying changes (unless explicitly disabled).

E. You cannot target specific resources. Incorrect because you can use the -target flag to apply changes to specific resources.

Key Concept:Behavior of terraform apply, including execution scope, state refresh, and resource lifecycle (create/update/replace).

Details

Rationale for Correct Answer:The primary purpose of Infrastructure as Code (IaC) is to define, provision, and manage infrastructure using code. Exam

Analysis of Incorrect Options (Distractors):

A. To provision infrastructure cheaply. Incorrect because cost reduction may be a benefit, but it is not the primary goal of IaC.

C. To define a vendor-agnostic API. Incorrect because IaC tools may support multiple providers, but their purpose is not to define APIs.

D. To define a pipeline to test and deliver software. Incorrect because this refers to CI/CD pipelines, not IaC.

Key Concept:IaC enables automation, consistency, and version-controlled infrastructure management through code.

Terraform configuration can import modules from various sources, not only from the public registry. Modules can be sourced from local file paths, Git repositories, HTTP URLs, Mercurial repositories, S3 buckets, and GCS buckets. Terraform supports a number of common conventions and syntaxes for specifying module sources, as documented in the [Module Sources] page. References = [Module Sources]

Rationale for Correct Answer (A):

Terraform does not automatically update state references when resource identifiers are renamed. Instead, you must use a moved block in your configuration to inform Terraform how to map the old resource to the new one. This prevents Terraform from destroying and recreating the resource.

Analysis of Incorrect Options:

B & C: Incorrect syntax — moved requires from and to.

D: Incorrect, Terraform won’t auto-detect renames and will plan to destroy and recreate the resource unless a moved block is provided.

Key Concept:

The moved block is essential for refactoring resource names without losing resources in state.

To prevent two Terraform runs from changing the same state file simultaneously, state locking is used. State locking ensures that when one Terraform operation is running, others will be blocked from making changes to the same state, thus preventing conflicts and data corruption. This is achieved by configuring the state backend to support locking, which will lock the state for all operations that could write to the state.References = This information is supported by Terraform ' s official documentation, which explains the importance of state locking and how it can be configured for different backends to prevent concurrent state modifications .

From the official Terraform Type Constraints Documentation:

The object({ name = string, age = number }) type expects:

name to be aquoted string, e.g. " John "

age to be anumber, e.g. 52

Option Bsatisfies both:

{

name = " John " #✅Valid string

age = 52 #✅Valid number

}

Let ' s analyze the incorrect ones:

❌Option A: " fifty two " is not a valid number.

❌Option C: John is unquoted (invalid string), and " fifty two " is not a number.

❌Option D: name = John is not quoted, making it an invalid string in HCL.

Terraform is strict about type and formatting. Stringsmust be quoted, and numbersmust be numeric literals.

In the given Terraform configuration snippet:

resource " aws_vpc " " main " {

name = " test "

}

The provider for the resource aws_vpc is aws. The provider is specified by the prefix of the resource type. In this case, aws_vpc indicates that the resource type vpc is provided by the aws provider.

When declaring a Terraform output, the value argument is required. Outputs are a way to extract information from Terraform-managed infrastructure, and the value argument specifies what data will be outputted. While other arguments like description and sensitive can provide additional context or security around the output, value is the only mandatory argument needed to define an output.References = The requirement of the value argument for outputs is specified in Terraform ' s official documentation, which provides guidelines on defining and using outputs in Terraform configurations.

Rationale for Correct Answer (True):

Local values (locals {}) are scoped to a module and are not directly visible outside. To make them available to callers, you must define outputs in the module. Outputs act as the interface for exposing values from a child module to the root module.

Analysis of Incorrect Option:

False: Incorrect, because locals cannot be exposed directly; only via outputs.

Key Concept:

Outputs are the way to expose information outside of a module.

The two steps that are required to provision new infrastructure in the Terraform workflow are init and apply. The terraform init command initializes a working directory containing Terraform configuration files. It downloads and installs the provider plugins that are needed for the configuration, and prepares the backend for storing the state. The terraform apply command applies the changes required to reach the desired state of the configuration, as described by the resource definitions in the configuration files. It shows a plan of the proposed changes and asks for confirmation before making any changes to the infrastructure. References = [The Core Terraform Workflow], [Initialize a Terraform working directory with init] , [Apply Terraform Configuration with apply]

Changing the Terraform backend after performing the initial terraform apply is technically possible but strongly discouraged. This is because changing backends can lead to complexities in state management, requiring manual intervention such as state migration to ensure consistency. Terraform ' s documentation and best practices advise planning the backend configuration carefully before applying Terraform configurations to avoid such changes.References = This guidance is consistent with Terraform ' s official documentation, which recommends careful consideration and planning of backend configurations to avoid the need for changes.

This is the variable type that you could use for this input, as it can store multiple attributes of different types within a single value. The other options are either invalid or incorrect for this use case.

The default “local” Terraform backend stores the state file in a local file named terraform.tfstate, which can be used to track and manage the state of your infrastructure3.

Rationale for Correct Answer: Terraform uses a declarative approach: you define the desired end state of infrastructure in configuration files that can be version-controlled and repeatedly applied. Terraform then computes an execution plan to reach that state. This is a key distinction from ad-hoc API calls or hand-written scripts that typically manage infrastructure in a more imperative and less state-aware way.

Analysis of Incorrect Options (Distractors):

B: Incorrect because Terraform is not “merely a wrapper.” It provides a workflow (state, diff/plan, dependency graph, drift detection) that fundamentally changes how infrastructure is managed.

C: Incorrect because Terraform does not replace provider APIs; providers still use the underlying cloud/service APIs.

D: Incorrect because Terraform is primarily declarative, not imperative scripting to force a specific order (ordering is derived from dependencies).

Key Concept: Declarative desired-state configuration, plan/apply workflow, and version-controlled IaC.

Detailed Explanation:

Rationale for Correct Answer:

A: terraform plan -out=planfile saves the proposed execution plan so you can later run terraform apply planfile. This supports review and controlled deployments.

B: terraform plan shows what Terraform would change (create/update/destroy) so you can verify changes before applying—this is one of the primary purposes of plan.

Analysis of Incorrect Options (Distractors):

C: Incorrect. Scheduling runs is not a capability of terraform plan (that’s handled by external schedulers/CI systems or HCP Terraform scheduling features—not the CLI plan command itself).

D: Incorrect. Workspaces are selected via terraform workspace select < name > (or by using separate working directories / automation). terraform plan itself doesn’t “execute in a different workspace” without switching context first.

Key Concept:terraform plan for previewing changes and optionally saving an execution plan file for later application.

Terraformdownloads modules and providersinto the .terraform directory inside the working directory.

A (/tmp/)– Incorrect; modules arenot stored temporarily.

C (In memory)– Incorrect; modules persist on disk.

D (Not cached)– Incorrect; Terraformdoes cache modulesfor efficiency.

Official Terraform Documentation Reference:

Terraform Module Caching

This is not true, as modules can be either public or private, depending on your needs and preferences. You can use the Terraform Registry to publish and consume public modules, or use Terraform Cloud or Terraform Enterprise to host and manage private modules.

Not all modules published on the official Terraform Module Registry have been verified by HashiCorp. While HashiCorp verifies some modules, there are many community-contributed modules that are not verified. Verified modules have a " Verified " badge indicating that HashiCorp has reviewed them for security and best practices, but the registry also includes unverified modules.

This is the best way to delete the newly-created VM with Terraform, as it will only affect the resource that was created by your configuration and state file. The other options are either incorrect or inefficient.

The -replace flag is used with the terraform apply command when there is a need to explicitly force Terraform to destroy and then recreate a specific resource during the next apply. This can be necessary in situations where a simple update is insufficient or when a resource must be re-provisioned to pick up certain changes.

The terraform state rm commandremovesa resource from Terraform’s state file butdoes not destroythe resource in the actual infrastructure. It only removes Terraform’s knowledge of the resource, meaning Terraform will no longer manage it.

If you run terraform state rm on a resource, Terraform will forget that the resource exists.

However, the resource will still exist in the cloud or infrastructure provider.

If you later run terraform apply, Terraform may try torecreatethe resource because it is no longer present in its state file.

Official Terraform Documentation Reference:

terraform state rm - HashiCorp Documentation

Terraform’s Indentation Standards: Terraform’s style convention usestwo spaces per nesting levelfor readability, helping to maintain uniform code across teams.

Configuration Files: Consistent indentation is crucial for Terraform’s HCL syntax, as it improves readability and avoids parsing issues.

More details are available in theTerraform configuration style guide.

Detailed Explanation:

Rationale for Correct Answer: A failed Terraform check block assertion does not block the current operation from executing. check blocks are used for non-blocking validation. If an assertion fails, Terraform reports a warning, but it does not stop the plan or apply operation. This is a common exam trap: check blocks differ from variable validation, preconditions, and postconditions, which can block execution when they fail.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. Terraform does not block execution because of a failed check block assertion.

Key Concept: Terraform check blocks perform non-blocking assertions and report failures as warnings.

Sentinel policies are checked after the plan stage of a Terraform run, but before it can be confirmed or the terraform apply is executed3. This allows you to enforce rules on your infrastructure before it is created or modified.

Detailed Explanation:

Rationale for Correct Answer:The core purpose of IaC is to define, provision, and configure infrastructure using code so it becomes repeatable, versionable, and automatable. Terraform is an IaC tool that uses declarative configuration to manage infrastructure resources consistently across environments.

Analysis of Incorrect Options (Distractors):

A: Incorrect. IaC may reduce costs indirectly (less manual work, fewer mistakes), but “cheaply” is not its primary purpose.

C: Incorrect. Terraform can manage many vendors, but IaC is not primarily about defining a vendor-agnostic API.

D: Incorrect. CI/CD pipelines are for software delivery; IaC can be used within pipelines, but it is not the pipeline itself.

Key Concept:IaC enables automated, repeatable infrastructure provisioning and configuration using code.

Rationale for Correct Answer: terraform apply -replace=ADDRESS forces Terraform to replace the specified resource during the next apply, meaning it will plan to destroy and then recreate it (or create-before-destroy if the resource supports it and the graph/lifecycle allows). This is used when a resource is unhealthy, drifted in a way that’s hard to correct, or you want a fresh instance without changing configuration.

Analysis of Incorrect Options (Distractors):

A: Incorrect—-replace is not “destroy only”; it’s destroy + recreate.

B: Incorrect—ignoring changes is done with lifecycle ignore_changes, not -replace.

D: Incorrect—destroying everything is terraform destroy (or apply with all resources removed), not -replace.

Key Concept: Forcing resource replacement using -replace in the apply workflow.

Terraforminstalls providers during the terraform init phase.

Providers aredownloaded and installedwhen running terraform init.

A (terraform plan)is incorrect because terraform plan only calculates changes but does not install providers.

C (terraform refresh)is incorrect because terraform refresh only updates the state but does not install providers.

Official Terraform Documentation Reference:

Provider Installation - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer:The terraform validate command checks whether the Terraform configuration is syntactically valid and internally consistent, but it does not check runtime state, enforce formatting preferences, or require all optional blocks to exist. None of the listed scenarios will cause terraform validate to fail:

Terraform does not require a variable block unless a variable is referenced incorrectly.

Tabs vs. spaces are formatting concerns handled by terraform fmt, not validate.

State drift is not checked by validate.

Analysis of Incorrect Options (Distractors):

A. The state file does not match the current infrastructure. Incorrect because terraform validate does not compare state with real infrastructure; that is handled during plan or apply.

B. The code contains tabs for indentation instead of spaces. Incorrect because formatting issues are handled by terraform fmt, not validate.

C. There is a missing variable block. Incorrect because Terraform does not require variable blocks unless variables are declared and improperly referenced. Simply missing a variable block is not a validation error.

Key Concept:terraform validate checks syntax and internal consistency, not formatting, runtime state, or infrastructure drift.

Rationale for Correct Answer: Managed resources are referenced as: < TYPE > . < NAME > . < ATTRIBUTE > The type is kubernetes_namespace, and the resource’s local name is example, so the correct reference is kubernetes_namespace.example.name.✅ Note: Option B appears intended to be correct, but it uses test in the middle. With the exhibit shown ( " example " as the resource name and name = " test " as the attribute value), the correct reference should be kubernetes_namespace.example.name. Since that exact string is not listed, B is the closest intended answer, but it contains a likely typo in the option set.

Analysis of Incorrect Options (Distractors):

A: Invalid syntax (comma) and not Terraform addressing.

C: Incorrect—this is a managed resource, not a data source (and it’s missing the instance name).

D: Incorrect—Terraform does not use a resource. prefix when referencing resources.

Key Concept: Resource addressing syntax in HCL (type.name.attribute).

Detailed Explanation:

Rationale for Correct Answer:

B: HashiCorp Vault is designed for securely storing and dynamically generating secrets, with access controls and auditing.

D: Using environment variables (including TF_VAR_... for input variables) avoids committing secrets to code and works well in CI/CD.

E: HCP Terraform sensitive variables (workspace variables marked sensitive) are a recommended way to store secrets for runs in HCP Terraform without exposing them in the UI or logs (they are masked).

Analysis of Incorrect Options (Distractors):

A: Incorrect. Plaintext on a shared drive is insecure and lacks access control/auditing best practices.

C: Incorrect. Committing secrets to version control is strongly discouraged; even private repos can leak, and history is hard to scrub.

Key Concept:Secrets management best practices in Terraform workflows: keep secrets out of code and VCS; use Vault, HCP Terraform sensitive vars, or environment variables.

Child modulesdo not automatically inheritvariables from the parent module.

To pass values from theparent moduleto thechild module, you mustexplicitly define input variablesin the child module and pass them in the parent module.

Example:

hcl

CopyEdit

module " example " {

source = " ./child_module "

var1 = " value "

}

Official Terraform Documentation Reference:

Passing Variables to Modules

Rationale for Correct Answer (B):

Terraform uses a state file to map real-world resources to your configuration. By default, if no backend is explicitly defined, Terraform stores this information in a file named terraform.tfstate located in the same directory as your configuration files. This local state file is critical for Terraform to understand what infrastructure already exists and to plan updates correctly.

Analysis of Incorrect Options (Distractors):

A. .terraform.d (home directory subdirectory):

This is used for storing plugins and some global settings, not for resource state.

C. .terraform.lock.hcl (lock file):

This file locks provider versions to ensure reproducible runs, but it does not contain resource state information.

D. .terraform (subdirectory):

This folder contains cached provider binaries and related data, but not the actual state file.

Key Concept:

Terraform state management is at the core of " Implement and Maintain State. " Understanding where Terraform stores the state by default is critical because state files should often be stored remotely (using a backend like S3, GCS, or Terraform Cloud) for collaboration and reliability.

The terraform apply command changes both the cloud infrastructure and the state file after you approve the execution plan. The command creates, updates, or destroys the infrastructure resources to match theconfiguration. It also updates the state file to reflect the new state of the infrastructure. The .terraform directory, the execution plan, and the Terraform code are not changed by the terraform apply command. References = Command: apply and Purpose of Terraform State

This will enable additional logging messages to find out from which paths Terraform is loading providers referenced in your Terraform configuration files, as it will set the log level to TRACE, which is the most verbose and detailed level.

Terraform follows adeclarativeapproach, meaning it ensures the infrastructure matches the configuration.

If you run terraform apply againwithout any changes, Terraform willdetect that the infrastructure is already up to dateand willdo nothing.

The command will complete successfully with the message " No changes. Your infrastructure matches the configuration. "

Official Terraform Documentation Reference:

Terraform Apply - HashiCorp Documentation

This is not a valid Terraform variable type. The other options are valid variable types that can store different kinds of values2.

The command that makes your code more human readable is terraform fmt. This command is used to rewrite Terraform configuration files to a canonical format and style, following the Terraform language style conventions and other minor adjustments for readability. The command is optional, opinionated, and has no customization options, but it is recommended to ensure consistency of style across different Terraform codebases. Consistency can help your team understand the code more quickly and easily, making the use of terraform fmt very important. You can run this command on your configuration files before committing them to source control or as part of your CI/CD pipeline. References = : Command: fmt : Using Terraform fmt Command to Format Your Terraform Code

This is the type of block that is used to construct a collection of nested configuration blocks, by using a for_each argument to iterate over a collection value and generate a nested block for each element. For example, you can use a dynamic block to create multiple ingress rules for a security group resource.

This is the Terraform style convention for indenting a nesting level compared to the one above it. The other options are not consistent with the Terraform style guide.

Detailed Explanation:

Rationale for Correct Answer: The configuration uses a data block, not a resource block. In Terraform, a data block reads information about existing infrastructure from a provider. It does not create, update, or delete infrastructure. This data source searches for an existing AWS EC2 instance with the tag Name = web.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. A new AWS instance would be created using a resource block such as resource " aws_instance " " web " { ... }, not a data source.

Key Concept: Terraform data blocks are used to query existing infrastructure, while resource blocks manage infrastructure lifecycle.

Rationale for Correct Answer (B):

Terraform interacts with external systems through providers. Since this is a new proprietary service with its own API, Terraform does not support it by default. You would need to develop a custom provider that implements Terraform’s provider interface and interacts with the proprietary APIs to manage resources like users.

Analysis of Incorrect Option:

A. Any service hosted on a public cloud provider: Not true. Terraform can only manage services that have providers (official or custom). Just being " hosted on a public cloud " doesn’t guarantee Terraform support.

Key Concept:

Terraform providers act as the bridge between Terraform and external APIs. For unsupported services, a custom provider must be developed.

Rationale for Correct Answer: IaC enables reviewable, version-controlled change proposals (for example, Terraform plans in pull requests). This makes it possible to systematically review proposed infrastructure changes—including automated security/policy checks—before they are applied. That review-and-approve workflow is a direct outcome of defining infrastructure as code and generating an execution plan.

Analysis of Incorrect Options (Distractors):

A: Auto scaling is enabled by cloud services (e.g., ASGs, autoscalers) and can be configured with or without IaC.

B: RBAC is a capability of cloud/IAM platforms and can be managed without IaC (though IaC can codify it).

C: Cost optimization is a practice/process; IaC can help standardize and enforce cost controls, but it’s not “only enabled” by IaC.

Key Concept: IaC enables version control, change review, and pre-deployment validation (plan + policy/security review).

You can configure a backend in your Terraform code before initializing it. Initializing a backend will store the state file remotely and enable features like locking and workspaces. References = [Terraform Backends]

In Terraform, the correct way to reference a resource attribute is:

pgsql

CopyEdit

resource_type.resource_name.attribute

For example, if the resource block is:

hcl

CopyEdit

resource " kubernetes_namespace " " example " {

metadata {

name = " my-namespace "

}

}

To reference the name attribute, use:

pgsql

CopyEdit

kubernetes_namespace.example.name

Explanation of incorrect answers:

A (resource.kubernetes_namespace.example.name)– Incorrect. Terraform does not use the resource. prefix when referencing resources.

C (data.kubernetes.namespace.name)– Incorrect. This syntax is used fordata sources, not resources.

D (kubernetes_namespace.test.name)– Incorrect. The resource name is " example " , not " test " .

Official Terraform Documentation Reference:

Terraform Resource References

This is the scenario that poses a challenge for this team, if they adopt AWS CloudFormation as their standardized method for provisioning public cloud resources, as CloudFormation only supports AWS services and resources, and cannot be used to provision infrastructure on other cloud platforms such as Azure.

E (✅Correct)–IaC aims to eliminate manual cloud console workflowsby using code-based automation.

A, B, C (✅Advantages of IaC)– IaC enablesself-service deployment, API-driven workflows, and dynamic resource scaling.

D (diff command)– While useful, troubleshooting via diff is not acore advantageof IaC.

Official Terraform Documentation Reference:

What is Infrastructure as Code?

Detailed Explanation:

Rationale for Correct Answer:A local value in Terraform allows you to define reusable expressions within a module. By combining the random_id and a variable into a local value, you can reference it multiple times without repeating the expression. This improves readability and maintainability, which aligns with Terraform best practices for configuration design.

Example:

locals {

combined_name = " ${random_id.example.hex}-${var.name} "

}

You can then reuse local.combined_name throughout your configuration.

Analysis of Incorrect Options (Distractors):

A. Use a data source. Incorrect because data sources are used to fetch information from existing infrastructure, not to define reusable expressions.

B. Use a module. Incorrect because modules are used for grouping and reusing infrastructure components, not for simple expression reuse.

D. Add an output value. Incorrect because outputs are used to expose values outside a module, not for internal reuse within the same configuration.

Key Concept:Local values (locals) are used to simplify and reuse expressions within a Terraform configuration.

Detailed Explanation:

Rationale for Correct Answer:In Terraform, a data source reference follows the format:

data. < DATA_SOURCE_TYPE > . < NAME > . < ATTRIBUTE >

Here:

Data source type = vsphere_datacenter

Name = dc

Attribute = id

Therefore, the correct reference is:

data.vsphere_datacenter.dc.id

This correctly retrieves the id attribute from the declared data source and passes it to the resource argument.

Analysis of Incorrect Options (Distractors):

B. data.vsphere_datacenter.dc — Incorrect because it references the entire data object, not a specific attribute like id.

C. data.dc.id — Incorrect because it omits the data source type (vsphere_datacenter), making the reference invalid.

D. vsphere_datacenter.dc.id — Incorrect because it is missing the data. prefix required for data sources.

Key Concept:Proper data source referencing syntax: data. < type > . < name > . < attribute > .

The correct answers are A and C. To update a registry module from version 4.2.1 to 5.0.0, you must first update the module block’s version argument so Terraform knows which module version is required. After changing the module version constraint, you must reinitialize the working directory so Terraform can install the selected module version into the local .terraform directory. In many real workflows, terraform init is sufficient after changing the version, while terraform init -upgrade is commonly used when refreshing already-installed modules to newer acceptable versions. terraform pull is not a Terraform command for updating modules. Removing the version argument is not a controlled upgrade because Terraform may then choose the newest available version, which can reduce reproducibility and increase upgrade risk.

The public Terraform Module Registry automatically exposes all the information about published modules, including required input variables, optional input variables and default values, and outputs. This helps users to understand how to use and configure the modules.

This is how Terraform manages most dependencies between resources, by using the references between them in the configuration files. For example, if resource A depends on resource B, Terraform will create resource B first and then pass its attributes to resource A.

The execution plan for terraform apply will not be the same as the one you ran locally with terraform plan, if your teammate manually modified the infrastructure component you are working on. This is because Terraform will refresh the state file before applying any changes, and will detect any differences between the state and the real resources.

Rationale for Correct Answer: Remote state storage is configured using a backend block, which lives inside the top-level terraform block (for example, terraform { backend " s3 " { ... } }). Backends control where Terraform stores state (local vs remote), locking, and related settings—this is squarely in the Terraform configuration’s global settings area, not in resources or providers.

Analysis of Incorrect Options (Distractors):

A (The resource block): Resources define infrastructure objects (e.g., servers, buckets). They do not configure where Terraform stores state.

B (The provider block): Providers configure how Terraform talks to an API (credentials/regions/features). They don’t define state storage.

C (The data block): Data sources read existing infrastructure; they are unrelated to backend/state storage configuration.

Key Concept: Backends and remote state configuration using terraform { backend ... }.

Rationale for Correct Answer: terraform state rm < address > removes a resource from Terraform state without destroying the real infrastructure. After removal, Terraform “forgets” it and will no longer manage it (unless it’s re-imported). That matches the requirement: keep the resource, stop managing it.

Analysis of Incorrect Options (Distractors):

A: Removing the resource block causes Terraform to plan to destroy the resource (because it’s in state but no longer in config), which is the opposite of “keep it.”

B: Changing count can cause Terraform to destroy instances that no longer have an address (depending on indexing), and it doesn’t explicitly “stop managing” a specific existing instance safely.

D: moved blocks are for renaming/refactoring addresses while keeping management; they do not stop managing a resource.

Key Concept: Detaching resources from Terraform management using state subcommands (terraform state rm).

Detailed Explanation:

Rationale for Correct Answer:terraform fmt rewrites Terraform configuration files (.tf, and commonly .tfvars) into Terraform’s canonical formatting style (indentation, alignment, spacing, etc.). By default, it formats files in the current directory (and with flags like -recursive, it can format subdirectories too).

Analysis of Incorrect Options (Distractors):

B: Incorrect because formatting is exactly what terraform fmt is designed to do.

Key Concept:Using terraform fmt to enforce consistent HCL formatting.

To import existing resources into Terraform, you need to do two things1:

Write a resource configuration block for each resource, matching the type and name used in your state file.

Run terraform import for each resource, specifying its address and ID. There is no such command as terraform Import-gcp, and provisioning new VMs with the same names will not import them into Terraform.

Detailed Explanation:

Rationale for Correct Answer:

C (tfe_outputs data source): This automates step #2 by allowing the example-compute workspace to read output values directly from the example-network workspace, eliminating manual copying of outputs into input variables. This aligns with Terraform objectives around using HCP Terraform capabilities to share data between workspaces safely and consistently.

E (Run trigger on example-compute): This automates step #3 by making example-compute automatically run (plan, and then apply depending on settings) after HCP Terraform successfully applies changes in example-network. Run triggers are specifically designed to orchestrate workspace dependencies so downstream infrastructure reacts to upstream changes.

Analysis of Incorrect Options (Distractors):

A: Incorrect. Health checks are not used to orchestrate cross-workspace plans/applies. They are for monitoring run status/health signals, not dependency automation.

B: Incorrect for the same reason as A—health checks don’t trigger downstream runs based on upstream applies.

D: Incorrect. The run trigger should be configured on the downstream workspace (example-compute) so it is triggered by upstream changes. Configuring it “on the network workspace” is the wrong direction for this dependency flow in typical HCP Terraform orchestration.

Key Concept:Automating dependencies between HCP Terraform workspaces using:

Cross-workspace output consumption (tfe_outputs) and

Run triggers to automatically start downstream runs after upstream applies.

Rationale for Correct Answer: A resource block creates/updates/destroys an infrastructure object and contains the configuration settings for that managed object (e.g., a VM, bucket, network). This is how Terraform manages real infrastructure.

Analysis of Incorrect Options (Distractors):

B (provider): Configures how Terraform connects to an API (region, credentials), not an infrastructure object.

C (data): Reads existing infrastructure; it does not manage (create/update/destroy) it.

D (locals): Defines named expressions for reuse; it doesn’t manage infrastructure.

Key Concept: Managed infrastructure is defined with resource blocks.

Detailed Explanation:

Rationale for Correct Answer:Terraform’s import block (introduced in newer versions) requires two essential pieces of information:

A. Resource address – This specifies where in Terraform configuration the imported resource will be mapped (e.g., aws_db_instance.example).

C. Resource ID – This is the unique identifier used by the provider to locate the existing infrastructure (e.g., database ID in AWS, Azure, etc.).

These two elements allow Terraform to associate an existing real-world resource with a resource block in your configuration, aligning with the objective of managing existing infrastructure using Terraform.

Analysis of Incorrect Options (Distractors):

B. Path to the .tf file Incorrect because Terraform does not require file paths; it works with resource addresses defined in configuration.

D. Database platform and version Incorrect because this information may exist in configuration but is not required for the import operation itself.

E. Connection string Incorrect because Terraform uses provider APIs, not direct connection strings, to manage infrastructure.

Key Concept: Importing existing infrastructure requires a resource address and provider-specific resource ID.

 This is a quick way to inspect the state file and find the information you need without modifying anything5. The other options are either incorrect or inefficient.

terraform validate does not confirm that your infrastructure matches the Terraform state file. It only checks whether the configuration files in a directory are syntactically valid and internally consistent3. To confirm that your infrastructure matches the Terraform state file, you need to use terraform plan or terraform apply with the -refresh-only option.