terraform interview questions Advanced Practice Exam: Hard Questions 2025

A platform team is migrating from ad-hoc scripts to Terraform. They want to enforce two rules: (1) all changes must be reviewable as code before execution, and (2) every environment can be recreated deterministically. Teams argue they can still run imperative "fix-up" scripts after Terraform applies. Which response best aligns with Infrastructure as Code (IaC) principles and Terraform best practices?

Your organization must provision infrastructure across two cloud providers and a SaaS platform. Some resources require creation in a strict order, but the teams also want fast feedback from `terraform plan` and minimal manual coordination. Which Terraform capability most directly supports these requirements while keeping provisioning declarative?

A team refactors a module that manages subnets. Previously it used `count` on a list variable `var.subnets`, and state addresses look like `module.vpc.aws_subnet.this[0]`, `[1]`, etc. They change the input to a map keyed by subnet name and refactor to `for_each = var.subnets`. On the next plan, Terraform wants to destroy and recreate all subnets even though the underlying CIDRs are unchanged. What is the most appropriate way to preserve existing resources and avoid replacement?

A configuration uses a data source to lookup an AMI and passes it into an instance resource. The data source query depends on tags that are applied by another resource created in the same apply. The first `terraform apply` fails because the data source cannot find the AMI yet. The team considers adding `depends_on` to the data source. What is the best Terraform-native approach to handle this scenario?

Your CI pipeline runs `terraform plan` for pull requests and `terraform apply` on merge. A developer reports that CI sometimes fails at plan time with an error about acquiring the state lock, even though no apply is running. They also see occasional long delays when multiple PRs are opened. Which change best reduces lock contention while keeping plans accurate?

A team uses `terraform apply -target=module.db` to speed up changes during an incident. Afterward, later plans show unexpected diffs in unrelated resources and outputs. What is the most accurate explanation and recommended practice regarding `-target`?

You maintain a shared module used by many teams. The module currently pins provider configuration internally (it includes a `provider` block) and is called from multiple root modules that each need different provider settings (regions/accounts). Teams report they cannot use multiple provider instances cleanly. What is the best module design change to support this?

A root module calls a child module that outputs a list of objects. The root needs to create one resource per object and ensure stable addressing even when the list order changes. Which approach best meets this requirement?

A team runs `terraform apply` and it succeeds, but another engineer later runs `terraform apply` and Terraform proposes to delete and recreate several resources that were manually modified in the cloud console. The team wants to prevent console changes from being overwritten while still allowing Terraform to manage everything else. Which is the best practice approach?

A remote backend with state locking is used. During an apply, Terraform crashes after creating some resources. The lock remains, blocking subsequent runs. The team is unsure whether the state is partially updated. What is the safest sequence of actions to recover while minimizing the risk of state corruption?