terraform interview questions Practice Exam 2025: Latest Questions

Your team wants to adopt Infrastructure as Code (IaC) to reduce configuration drift and improve repeatability. Which practice best aligns with IaC principles?

A Terraform configuration references resources from AWS and Azure in the same root module. What is Terraform primarily providing in this scenario?

You want to avoid hardcoding a region value in your Terraform configuration and instead supply it at runtime. Which approach is recommended?

You are reviewing a Terraform plan and want to see which resources will be destroyed before applying changes. Which Terraform CLI command is most appropriate?

A team wants to create a reusable networking component (VPC/VNet, subnets, routing) and use it across many environments. Which is the best Terraform approach?

You run `terraform apply` and Terraform proposes changing an attribute that was manually edited in the cloud console last week. What is the most accurate explanation for why Terraform is proposing this change?

A Terraform run fails with an error indicating the state is locked by another operation. What is the recommended first action?

Your team maintains separate dev and prod environments. They want to reuse the same module code but ensure dev and prod do not affect each other’s infrastructure or state. Which design is recommended?

A resource uses `count` to create multiple instances. You insert a new element at the beginning of the list that drives `count`, and now Terraform plans to replace many existing instances. What is the best way to make instance addressing more stable?

A root module calls a child module that defines a provider configuration internally. You want the root module to control which provider configuration (for example, which region or subscription) the child module uses. What Terraform pattern should you use?

You run `terraform plan` and the output shows `Plan: 0 to add, 0 to change, 0 to destroy.` What does this indicate?

A teammate accidentally hardcoded an API token in a Terraform variable default value. What is the recommended way to provide sensitive values to Terraform to reduce the risk of leaking them in code review?

You want Terraform to automatically store state in a shared remote location and to enable state locking to reduce concurrent modification risk. Which backend feature provides this locking behavior (when supported by the backend)?

A root module calls a child module. You want to expose the resource ID created inside the child module to the root module. What is the standard Terraform mechanism to do this?

You run `terraform apply` and Terraform prompts for each input variable value. You want `apply` to fail instead of prompting when required variables are missing (useful in CI). Which CLI option should you use?

A remote backend is configured for state storage. Your organization wants to ensure that changes are reviewed and that the exact plan reviewed is what gets applied. Which workflow best supports this?

Your configuration creates multiple similar resources using `for_each`. During a refactor, you want to rename the map keys used by `for_each` without destroying and recreating resources. What should you use?

A team maintains separate environments (dev, staging, prod) and wants reusable infrastructure code with environment-specific values. Which approach is a recommended Terraform pattern?

A CI job runs `terraform init` and fails with an error indicating the provider version in the lock file is not available for the runner's platform. What is the most appropriate fix?

You must rotate cloud credentials and want to ensure Terraform does not store these secrets in state in plaintext. Which statement is accurate about Terraform state and sensitive data?

You run `terraform apply` and it fails because a remote state backend cannot be reached. However, the `.terraform.lock.hcl` file already exists in the repo. What is the primary purpose of `.terraform.lock.hcl` in this situation?

Your configuration uses a module that needs a list of subnet IDs. One environment currently passes a map of subnets keyed by name (e.g., `{ "app" = "subnet-1", "db" = "subnet-2" }`) and `terraform plan` fails with a type mismatch. What is the best practice fix to make the module interface robust?

A teammate runs `terraform apply` and gets an error indicating the state is locked by another operation, but you confirm no Terraform runs are currently active. What is the recommended next step?

You want to roll out a change that only updates a single resource without applying other pending changes in the plan (for example, to quickly replace a failed instance). Which CLI approach most closely matches this requirement, and what is the key caveat?

A team wants an approval step between planning and applying in CI/CD. They also want to ensure the exact planned changes are what gets applied later, even if the live infrastructure changes slightly in between. What is the best workflow?