HashiCorp HashiCorp Certifications TA-002-P Questions & Answers

• Question 231:

  You want terraform plan and terraform apply to be executed in Terraform Cloud's run environment but the output is to be streamed locally. Which one of the below you will choose?

  A. Local Backends.

  B. Terraform Backends.

  C. This can be done using any of the local or remote backends.

  D. Remote Backends.

  Correct Answer: D

  When using full remote operations, operations like terraform plan or terraform apply can be executed in Terraform Cloud's run environment, with log output streaming to the local terminal. Remote plans and applies use variable values from

  the associated Terraform Cloud workspace.

  Terraform Cloud can also be used with local operations, in which case only state is stored in the Terraform Cloud backend.

  https://www.terraform.io/docs/backends/types/remote.html

• Question 232:

  In Terraform Enterprise, a workspace can be mapped to how many VCS repos?

  A. 5

  B. 2

  C. 3

  D. 1

  Correct Answer: D

  A workspace can only be configured to a single VCS repo, however, multiple workspaces can use the same repo. https://www.terraform.io/docs/cloud/workspaces/vcs.html

• Question 233:

  During a terraform apply, a resource is successfully created but eventually fails during provisioning. What happens to the resource?

  A. The resource will be planned for destruction and recreation upon the next terraform apply

  B. Terraform will retry to provision again.

  C. The failure of provisioner will be ignored and it will not cause a failure to terraform apply

  D. The resource will be automatically destroyed.

  Correct Answer: A

  If a creation-time provisioner fails, the resource is marked as tainted. A tainted resource will be planned for destruction and recreation upon the next terraform apply. Terraform does this because a failed provisioner can leave a resource in a semi-configured state. Because Terraform cannot reason about what the provisioner does, the only way to ensure proper creation of a resource is to recreate it. This is tainting. You can change this behavior by setting the on_failure attribute, which is covered in detail below.

  https://www.terraform.io/docs/provisioners/index.html#creation-time-provisioners https://www.terraform.io/docs/provisioners/index.html#destroy-time-provisioners https://www.terraform.io/docs/provisioners/index.html#failure-behavior

• Question 234:

  Dawn has created the below child module. Without changing the module, can she override the instance_type from t2.micro to t2.large form her code while calling this module?

  1.

  resource "aws_instance" "myec2"

  2.

  {

  3.

  ami = "ami-082b5a644766e0e6f"

  4.

  instance_type = "t2.micro

  5.

  }

  A. YES

  B. No

  Correct Answer: B

  As the instance_type is hard-coded in source module, you will not be able to change its value from destination module. Instead of hard-coding you should use variable with default values.

• Question 235:

  Command terraform refresh will update state file?

  A. False

  B. True

  Correct Answer: B

  The terraform refresh command is used to reconcile the state Terraform knows about (via its state file) with the real-world infrastructure. This can be used to detect any drift from the last-known state, and to update the state file. This does not modify infrastructure, but does modify the state file. If the state is changed, this may cause changes to occur during the next plan or apply. https://www.terraform.io/docs/commands/refresh.html

• Question 236:

  Jim has created several AWS resources from a single terraform configuration file. Someone from his team has manually modified one of the EC2 instance.

  Now to discard the manual change, Jim wants to destroy and recreate the EC2 instance. What is the best way to do it?

  A. terraform recreate

  B. terraform taint

  C. terraform destroy

  D. terraform refresh

  Correct Answer: B

  The terraform taint command manually marks a Terraform-managed resource as tainted, forcing it to be destroyed and recreated on the next apply. This command will not modify infrastructure, but does modify the state file in order to mark a resource as tainted. Once a resource is marked as tainted, the next plan will show that the resource will be destroyed and recreated and the next apply will implement this change. Forcing the recreation of a resource is useful when you want a certain side effect of recreation that is not visible in the attributes of a resource. For example: re-running provisioners will cause the node to be different or rebooting the machine from a base image will cause new startup scripts to run. Note that tainting a resource for recreation may affect resources that depend on the newly tainted resource. For example, a DNS resource that uses the IP address of a server may need to be modified to reflect the potentially new IP address of a tainted server. The plan command will show this if this is the case. This example will taint a single resource: $ terraform taint aws_security_group.allow_all The resource aws_security_group.allow_all in the module root has been marked as tainted. https://www.terraform.io/docs/commands/taint.html

• Question 237:

  You have been given requirements to create a security group for a new application. Since your organization standardizes on Terraform, you want to add this new security group with the fewest number of lines of code. What feature could you use to iterate over a list of required tcp ports to add to the new security group?

  A. dynamic backend

  B. splat expression

  C. terraform import

  D. dynamic block

  Correct Answer: D

  A dynamic block acts much like a for expression, but produces nested blocks instead of a complex typed value. It iterates over a given complex value and generates a nested block for each element of that complex value. https://www.terraform.io/docs/configuration/expressions.html#dynamic-blocks

• Question 238:

  Which of the below features of Terraform can be used for managing small differences between different environments which can act more like completely separate working directories.

  A. Repositories

  B. Workspaces

  C. Environment Variables

  D. Backends

  Correct Answer: B

  workspaces allow conveniently switching between multiple instances of a single configuration within its single backend. They are convenient in a number of situations, but cannot solve all problems. A common use for multiple workspaces is to create a parallel, distinct copy of a set of infrastructure in order to test a set of changes before modifying the main production infrastructure. For example, a developer working on a complex set of infrastructure changes might create a new temporary workspace in order to freely experiment with changes without affecting the default workspace. Non-default workspaces are often related to feature branches in version control. The default workspace might correspond to the "master" or "trunk" branch, which describes the intended state of production infrastructure. When a feature branch is created to develop a change, the developer of that feature might create a corresponding workspace and deploy into it a temporary "copy" of the main infrastructure so that changes can be tested without affecting the production infrastructure. Once the change is merged and deployed to the default workspace, the test infrastructure can be destroyed and the temporary workspace deleted. https://www.terraform.io/docs/state/workspaces.html https://www.terraform.io/docs/state/workspaces.html#when-to-use-multiple-workspaces

• Question 239:

  You have multiple developers working on a terraform project (using terraform OSS), and have saved the terraform state in a remote S3 bucket . However ,team is intermittently experiencing inconsistencies in the provisioned infrastructure / failure in the code . You have traced this problem to simultaneous/concurrent runs of terraform apply command for 2/more developers . What can you do to fix this problem?

  A. Use terraform workspaces feature, this will fix this problem by default , as every developer will have their own state file , and terraform will merge them on server side on its own.

  B. Structure your team in such a way that only one individual will run terraform apply , everyone will just make changes and share with him. Then there will be no chance of any inconsistencies.

  C. Stop using remote state , and store the developer tfstate in their own machine . Once a day , all developers should sit together and merge the state files manually , to avoid any inconsistencies.

  D. Enable terraform state locking for the S3 backend using DynamoDB table. This prevents others from acquiring the lock and potentially corrupting your state.

  Correct Answer: D

  S3 backend support state locking using DynamoDB. https://www.terraform.io/docs/state/locking.html

• Question 240:

  After running into issues with Terraform, you need to enable verbose logging to assist with troubleshooting the error. Which of the following values provides the MOST verbose logging?

  A. ERROR

  B. INFO

  C. WARN

  D. TRACE

  E. DEBUG

  Correct Answer: D

  Terraform has detailed logs that can be enabled by setting the TF_LOG environment variable to any value. This will cause detailed logs to appear on stderr. You can set TF_LOG to one of the log levels TRACE, DEBUG, INFO, WARN or ERROR to change the verbosity of the logs. TRACE is the most verbose and it is the default if TF_LOG is set to something other than a log level name. Examples: export TF_LOG=DEBUG export TF_LOG=TRACE