Terraform Cloud overview - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Terraform Cloud workspace state management

Which statement best describes how Terraform Cloud manages state files in workspaces?

A Terraform Cloud stores state files remotely and locks them during runs to prevent conflicts.

B Terraform Cloud requires users to manually upload state files after each run.

C Terraform Cloud deletes state files after each successful apply to save space.

D Terraform Cloud stores state files locally on the user's machine by default.

💡 Hint

Think about how Terraform Cloud helps teams avoid state conflicts.

Terraform Cloud automatically stores state files remotely and locks them during runs. This prevents multiple users from making conflicting changes at the same time.

❓ service_behavior

intermediate

Terraform Cloud run triggers

What happens when a new VCS commit is pushed to a repository connected to a Terraform Cloud workspace?

A Terraform Cloud automatically queues a plan and applies it without manual approval.

B Terraform Cloud queues a plan and waits for manual approval before applying changes.

C Terraform Cloud ignores the commit unless manually triggered by the user.

D Terraform Cloud deletes the workspace and creates a new one.

💡 Hint

Consider the default safety mechanism for applying changes.

By default, Terraform Cloud queues a plan when a new commit is detected and waits for manual approval before applying changes. This helps prevent unintended infrastructure changes.

❓ Architecture

advanced

Terraform Cloud team and policy architecture

Which architecture best supports enforcing security policies across multiple teams using Terraform Cloud?

A Create multiple organizations with separate policies for each team.

B Manage policies locally on each user's machine to allow flexibility.

C Use a single organization with multiple teams and apply Sentinel policies at the organization level.

D Disable policies to speed up deployments across teams.

💡 Hint

Think about centralized policy enforcement for consistency.

Using a single organization with multiple teams and applying Sentinel policies at the organization level ensures consistent security enforcement across all teams.

❓ security

advanced

Terraform Cloud sensitive variable handling

How does Terraform Cloud protect sensitive variables in workspaces?

A Sensitive variables must be stored in external files and cannot be set in Terraform Cloud.

B Sensitive variables are stored in plain text but hidden in the UI.

C Sensitive variables are shared openly with all workspace users for transparency.

D Sensitive variables are encrypted and never displayed in logs or UI after entry.

💡 Hint

Consider how secrets should be handled securely.

Terraform Cloud encrypts sensitive variables and ensures they are never shown in logs or the UI after being entered, protecting secrets from exposure.

✅ Best Practice

expert

Optimizing Terraform Cloud runs for large teams

Which practice best optimizes Terraform Cloud runs to reduce wait times and improve collaboration in large teams?

A Use multiple workspaces targeting smaller parts of infrastructure and enable run triggers between them.

B Use a single workspace for all infrastructure to simplify management.

C Disable state locking to allow parallel runs.

D Manually merge all Terraform configurations into one file to reduce complexity.

💡 Hint

Think about breaking down infrastructure and coordinating runs.

Splitting infrastructure into multiple workspaces and using run triggers allows parallel work and coordinated updates, reducing wait times and improving collaboration.

Practice

1. What is the main purpose of Terraform Cloud?

easy

A. To host websites built with Terraform

B. To replace Terraform CLI on your local machine

C. To store Terraform state remotely and run Terraform commands safely

D. To provide a graphical interface for writing Terraform code

Solution

1. Step 1: Understand Terraform Cloud's role

   Terraform Cloud stores state files remotely and runs Terraform commands in a managed environment.

2. Step 2: Compare options with this role

   Only To store Terraform state remotely and run Terraform commands safely correctly describes this purpose; others describe unrelated functions.

3. Final Answer:

   To store Terraform state remotely and run Terraform commands safely -> Option C

4. Quick Check:

   Terraform Cloud = Remote state + safe runs [OK]

Hint: Remember Terraform Cloud manages state and runs commands remotely [OK]

Common Mistakes:

• Thinking Terraform Cloud replaces local CLI
• Confusing Terraform Cloud with a code editor
• Assuming Terraform Cloud hosts websites

2. Which Terraform configuration block connects your code to Terraform Cloud?

easy

A. terraform { backend "cloud" { ... } }

B. terraform { cloud { organization = "org" } }

C. provider "cloud" { organization = "org" }

D. resource "cloud" { organization = "org" }

Solution

1. Step 1: Identify the correct block for Terraform Cloud

   The terraform { cloud { ... } } block is used to configure Terraform Cloud settings.

2. Step 2: Check other options for correctness

   terraform { backend "cloud" { ... } } uses backend "cloud" which is invalid; provider and resource blocks are unrelated.

3. Final Answer:

   terraform { cloud { organization = "org" } } -> Option B

4. Quick Check:

   Cloud config = terraform block with cloud [OK]

Hint: Look for terraform { cloud { ... } } syntax [OK]

Common Mistakes:

• Using backend "cloud" instead of cloud block
• Confusing provider or resource blocks with cloud config
• Missing the organization attribute inside cloud block

3. Given this Terraform snippet, what happens when you run terraform apply?

terraform {
  cloud {
    organization = "my-org"
    workspaces {
      name = "my-workspace"
    }
  }
}

medium

A. Terraform ignores the cloud block and runs with default settings

B. Terraform runs locally and stores state on your machine

C. Terraform throws a syntax error due to missing backend block

D. Terraform connects to Terraform Cloud and uses the specified workspace

Solution

1. Step 1: Analyze the cloud block configuration

   The cloud block specifies organization and workspace, so Terraform connects to Terraform Cloud.

2. Step 2: Understand Terraform apply behavior with cloud config

   Terraform runs remotely using the workspace and stores state in Terraform Cloud.

3. Final Answer:

   Terraform connects to Terraform Cloud and uses the specified workspace -> Option D

4. Quick Check:

   Cloud block present = remote run in workspace [OK]

Hint: Presence of cloud block means remote run in Terraform Cloud [OK]

Common Mistakes:

• Assuming local run despite cloud block
• Expecting syntax error without backend block
• Ignoring workspace setting in cloud block

4. You added this block to your Terraform config but get an error:

terraform {
  cloud {
    organization = "my-org"
  }
}

What is the likely cause?

medium

A. Missing workspace configuration inside the cloud block

B. Incorrect organization name format

C. Terraform Cloud requires a backend block instead

D. The cloud block must be inside a provider block

Solution

1. Step 1: Check required fields in cloud block

   Terraform Cloud requires workspace info inside the cloud block to know where to store state.

2. Step 2: Identify missing workspace causes error

   Without workspace, Terraform cannot connect properly, causing an error.

3. Final Answer:

   Missing workspace configuration inside the cloud block -> Option A

4. Quick Check:

   Cloud block needs workspace info [OK]

Hint: Always include workspace inside cloud block [OK]

Common Mistakes:

• Assuming organization name format is wrong
• Thinking backend block is mandatory with cloud block
• Placing cloud block inside provider block

5. You want to share Terraform state safely among your team using Terraform Cloud. Which steps should you take to set this up correctly?

hard

A. Configure terraform { cloud { organization = "org" workspaces { name = "ws" } } } and push code to VCS connected to Terraform Cloud

B. Run Terraform locally and manually upload state files to Terraform Cloud

C. Use a local backend and share the state file via email with your team

D. Configure a provider block for Terraform Cloud and run terraform init locally

Solution

1. Step 1: Set up Terraform Cloud connection in config

   Use the terraform { cloud { ... } } block with organization and workspace to connect to Terraform Cloud.

2. Step 2: Integrate with version control system (VCS)

   Push your Terraform code to a VCS repository linked to Terraform Cloud for automated runs and shared state.

3. Final Answer:

   Configure terraform { cloud { organization = "org" workspaces { name = "ws" } } } and push code to VCS connected to Terraform Cloud -> Option A

4. Quick Check:

   Cloud block + VCS = safe shared state [OK]

Hint: Use cloud block and VCS integration for team state sharing [OK]

Common Mistakes:

• Uploading state files manually instead of using Terraform Cloud
• Sharing state files via email (unsafe and error-prone)
• Misusing provider block for Terraform Cloud connection