Terraform's declarative approach - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Terraform's Desired State

Terraform uses a declarative approach to manage infrastructure. What does Terraform primarily store and use to manage resources?

A The desired state of infrastructure as code

B The sequence of commands to create resources

C The current live state of infrastructure only

D Manual scripts to update resources

💡 Hint

Think about what Terraform compares before making changes.

Terraform stores the desired state in configuration files and compares it with the current state to decide what changes to apply.

❓ service_behavior

intermediate

Terraform Plan Behavior

What does the terraform plan command do in Terraform's declarative workflow?

A Deletes all existing resources

B Shows the changes Terraform will make to reach the desired state

C Immediately applies changes to the infrastructure

D Generates random resource names

💡 Hint

It previews changes without applying them.

terraform plan shows a preview of changes Terraform will make to match the desired state without applying them yet.

❓ Configuration

advanced

Terraform Resource Dependency Declaration

Given the following Terraform configuration snippet, what is the correct way to declare that aws_instance.web depends on aws_security_group.web_sg?

resource "aws_security_group" "web_sg" {
  name = "web_sg"
}

resource "aws_instance" "web" {
  ami           = "ami-123456"
  instance_type = "t2.micro"
  # Where to declare dependency?
}

A Add <code>depends_on = ["aws_security_group.web_sg"]</code> inside <code>aws_instance.web</code>

B Add <code>depends_on = [aws_instance.web]</code> inside <code>aws_security_group.web_sg</code>

C No need to declare; Terraform infers dependencies automatically

D Add <code>depends_on = [aws_security_group.web_sg]</code> inside <code>aws_instance.web</code>

💡 Hint

Explicit dependencies use depends_on with resource references.

To explicitly declare that aws_instance.web depends on aws_security_group.web_sg, use depends_on = [aws_security_group.web_sg] inside the instance resource.

❓ Architecture

advanced

Terraform State Management Best Practice

In a team environment, what is the best practice for managing Terraform state files to avoid conflicts and ensure consistency?

A Store state files locally on each developer's machine

B Manually merge state files after each run

C Use remote state storage with locking, such as Terraform Cloud or S3 with DynamoDB locking

D Delete state files after each apply to avoid conflicts

💡 Hint

Think about shared access and preventing simultaneous changes.

Using remote state storage with locking prevents conflicts by ensuring only one user can modify the state at a time, which is essential in team environments.

❓ security

expert

Handling Sensitive Data in Terraform

Which approach best protects sensitive data such as passwords or API keys in Terraform configurations and state files?

A Use Terraform variables marked as <code>sensitive = true</code> and store secrets in a secure secrets manager referenced via data sources

B Hardcode secrets directly in Terraform configuration files for easy access

C Share secrets via email among team members to keep them private

D Store secrets in plain text in the Terraform state file without encryption

💡 Hint

Consider both configuration and state file security.

Marking variables as sensitive hides them in output, and referencing secrets from secure managers avoids storing them directly in code or state files.