HashiCorp Terraform Associate (004) Question 24
Single answer2 Terraform fundamentalsA platform team stores its Terraform configuration in Git and wants every engineer to review the exact infrastructure changes before anything is applied. An engineer updates a variable that changes the size of several existing resources and adds one new resource. The team wants a workflow that produces a reviewable artifact in CI and then applies exactly what was reviewed later in a controlled deployment step. Which approach best meets this requirement?
- A
Run
terraform apply -auto-approvein CI, because Terraform will automatically recalculate the latest changes at apply time and ensure they match what reviewers expect. - B
Run
terraform plan -out=tfplanin CI, store the generated plan file as an artifact, and later runterraform apply tfplanin the deployment step. - C
Run
terraform validatein CI, store the validation output, and later runterraform applybecause validation confirms the infrastructure changes that will occur. - D
Run
terraform fmt -checkand thenterraform applylater without a saved plan, because formatting ensures the reviewed configuration is the same as what will be deployed.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to generate and save a plan with terraform plan -out=<FILE> and later apply that same file with terraform apply <FILE>. This supports a common CI/CD workflow where engineers review a concrete execution plan before deployment. In Terraform fundamentals, it is important to distinguish among commands: terraform validate checks configuration validity, terraform fmt enforces style, and terraform plan creates an execution plan by comparing configuration with state and real infrastructure. Applying a saved plan ensures Terraform executes the reviewed actions instead of recalculating a potentially different plan later. This aligns with Terraform CLI behavior documented for plan and apply, especially the use of saved plan files to preserve reviewed changes between stages.
- A. Incorrect.
Incorrect.
terraform apply -auto-approveskips the interactive approval step, but it does not create a reviewable artifact that can be approved and then applied later. If run later without a saved plan file, Terraform generates a new plan at apply time based on the current state, configuration, variables, and provider behavior. That means reviewers are not approving an exact, fixed execution plan artifact. - B. Correct.
Correct.
terraform plan -out=tfplancreates a saved execution plan file containing the proposed actions Terraform intends to take. Storing that file as a CI artifact and later usingterraform apply tfplanapplies the exact reviewed plan, assuming the plan is still valid. This is the standard way to separate planning and applying while preserving what was reviewed. - C. Incorrect.
Incorrect.
terraform validatechecks whether the configuration is syntactically valid and internally consistent, but it does not compare configuration to current infrastructure state or show planned create/update/destroy actions. Teams sometimes confuse validation with planning, but onlyterraform planproduces a change plan. - D. Incorrect.
Incorrect.
terraform fmt -checkonly verifies formatting conventions for Terraform configuration files. It helps with code consistency and readability, but it provides no information about infrastructure changes and does not lock in a reviewed set of actions. Applying later without a saved plan means Terraform will recalculate the plan at that time.