terraform interview questions Intermediate Practice Exam: Medium Difficulty 2025

Your team manages infrastructure across multiple environments (dev, staging, prod). A developer proposes manually editing cloud resources during incidents and later updating Terraform code to match. As the Terraform owner, what practice best preserves IaC benefits while still enabling urgent changes?

A platform team wants to standardize provisioning across multiple cloud providers. They have separate toolchains for each provider today. Which Terraform capability most directly addresses this goal while keeping configurations consistent?

You manage a set of subnets using `for_each` and a map variable. You change the map keys (e.g., rename "app" to "application") but the underlying subnet CIDRs are unchanged. What is the most likely impact during the next `terraform plan`?

You are writing a module that creates an IAM policy document and need to conditionally include an optional statement only when a variable is set. Which approach best fits Terraform language capabilities and keeps the plan predictable?

A teammate is new to Terraform and runs `terraform apply` without first downloading providers and configuring the backend. The run fails early. Which command should they run first to prepare the working directory, and what does it do?

You need to make a safe, minimal change to production. Company policy requires that the exact plan reviewed in a pull request is the one applied later by a CI job. Which CLI workflow best satisfies this requirement?

A module in your private registry creates an S3 bucket and exports the bucket name as an output. A consuming configuration also needs the bucket ARN. You cannot modify the module immediately. What is the best interim approach without duplicating resource creation?

You maintain a shared VPC module used by many teams. You want to introduce a new optional variable with a default value, and you must avoid breaking existing consumers. Which change best meets this requirement?

A team stores Terraform state remotely with locking enabled. During an apply, a CI job is canceled and the next run reports that the state is locked. What is the best next step to recover safely?

You need to move a resource from the root module into a child module (same provider resource, same real infrastructure object) without destroying and recreating it. Which approach is most appropriate?