Terraform Associate Use the Terraform CLI (outside of core workflow): 37 practice questions

12 of the 37 Use the Terraform CLI (outside of core workflow) questions in the Certsqill Terraform Associate bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Terraform Associate? Take the free 5-min readiness check →

1. terraform fmt to rewrite the files to the canonical: Which command accomplishes this?

1. terraform fmt to rewrite the files to the canonical HashiCorp style ✓

   Correct. terraform fmt rewrites configuration files to HashiCorp's canonical style, fixing indentation, spacing, and alignment automatically.
2. terraform validate to check configuration syntax and internal consistency

   Incorrect. terraform validate checks syntax and internal consistency but never rewrites files, so it cannot fix indentation or spacing.
3. terraform lint to flag style and best-practice problems across the code

   Incorrect. There is no terraform lint command; linting is handled by third-party tools like TFLint, while terraform fmt handles canonical formatting.
4. terraform check to verify the configuration for errors safely

   Incorrect. There is no terraform check command in the core CLI; terraform validate is what checks a configuration for errors.

terraform fmt automatically formats .tf files to HashiCorp's canonical style — indentation, spacing, and alignment are standardized.

2. terraform import aws_s3_bucket.my_bucket my-legacy-bucket: After writing the `aws_s3_bucket` resource block in

1. terraform state add aws_s3_bucket.my_bucket my-legacy-bucket to register the bucket

   Incorrect. There is no terraform state add subcommand; state supports list, mv, rm, show, and pull/push, so this cannot bring the bucket under management.
2. terraform import aws_s3_bucket.my_bucket my-legacy-bucket to manage the bucket ✓

   Correct. terraform import maps an existing resource's real-world ID to a resource address in state; the matching aws_s3_bucket block must already exist in the configuration.
3. terraform apply --import aws_s3_bucket.my_bucket my-legacy-bucket to adopt it

   Incorrect. terraform apply has no --import flag; importing an existing resource is done with the separate terraform import command.
4. terraform init --import aws_s3_bucket.my_bucket my-legacy-bucket to load it

   Incorrect. terraform init only initializes the directory and downloads providers; it has no import capability.

terraform import maps an existing real-world resource to a Terraform resource address, adding it to state without creating or modifying the resource.

3. Creates a separate state file for the staging workspace: What does this achieve?

1. Deploys the current configuration to a live staging environment in your AWS account immediately after it is created in the cloud

   Incorrect. Creating a workspace provisions nothing; it only creates a new state namespace, and a separate terraform apply is still required to deploy.
2. Creates a new Terraform Cloud workspace that enables remote runs and team collaboration on shared remote state files

   Incorrect. CLI workspaces and Terraform Cloud workspaces are distinct; terraform workspace new creates a local state partition, not a Terraform Cloud workspace.
3. Creates a separate state file for the staging workspace, allowing the same configuration to manage multiple environments ✓

   Correct. terraform workspace new adds a named workspace with its own state file in the same backend, so one configuration can manage multiple environments; the initial workspace is 'default'.
4. Creates a new directory named 'staging' containing a full copy of the current configuration files on disk

   Incorrect. Workspaces neither create directories nor copy configuration; they create a separate state slice within the existing backend.

Terraform workspaces create separate state files within the same backend — allowing one configuration to manage multiple environments (dev/staging/prod) without state collision.

4. terraform state mv aws_instance.web: Which command renames the resource in state to match the new name without

1. terraform refresh --rename aws_instance.web aws_instance.web_server

   Incorrect. terraform refresh does not accept rename arguments — it only syncs state with real infrastructure.
2. terraform import aws_instance.web_server <instance-id>

   Incorrect. Import adds a new state entry — it doesn't rename the existing one. Running import without first doing state rm would result in duplicate state entries.
3. Manually editing the terraform.tfstate JSON file to update the resource name

   Incorrect. Manually editing state is dangerous and not recommended — state has checksums and complex structures. terraform state mv is the safe, supported way.
4. terraform state mv aws_instance.web aws_instance.web_server ✓

   Correct. terraform state mv renames a resource address in the state file — updating the mapping without any infrastructure changes, preventing unintended destroy+create.

terraform state mv renames a resource's state entry to match a config rename — preventing destroy+recreate when only the Terraform name changes.

5. terraform state rm aws_instance.legacy to stop tracking it: Which command removes the instance from Terraform

1. terraform state rm aws_instance.legacy to stop tracking it in state ✓

   Correct. terraform state rm drops the resource from state without touching real infrastructure, so the EC2 instance keeps running untracked.
2. Delete the resource block from config and run terraform apply next

   Incorrect. Removing the block makes the next apply plan a destroy, so the instance would be terminated rather than left running.
3. terraform import aws_instance.legacy <id> with the --untrack flag set

   Incorrect. terraform import has no --untrack flag and only adds resources to state; it cannot remove one.
4. terraform destroy -target=aws_instance.legacy removing that resource

   Incorrect. terraform destroy -target actually terminates the targeted instance, which is the opposite of keeping it running.

terraform state rm removes a resource from state without destroying it — the infrastructure continues running unmanaged by Terraform.

6. terraform apply -replace=aws_instance.web: Which approach forces Terraform to replace the instance on the next

1. terraform destroy -target=aws_instance.web and then run terraform apply to recreate it cleanly again

   Incorrect. This two-step destroy-then-apply works but is manual; -replace (or taint) is the purpose-built way to force replacement in a single apply.
2. terraform apply -replace=aws_instance.web (or terraform taint aws_instance.web in older versions) ✓

   Correct. In Terraform 0.15.2+ the -replace flag on apply forces replacement of a resource; older versions used terraform taint to mark it tainted in state.
3. terraform state rm aws_instance.web and then run terraform apply to rebuild it from scratch

   Incorrect. state rm only stops tracking the resource; the next apply creates a new one but leaves the corrupted instance orphaned and unmanaged.
4. terraform refresh to update the state with the corrupted instance's current status again

   Incorrect. terraform refresh reconciles state with real infrastructure and will not flag the instance for replacement, especially when the API still reports it healthy.

terraform apply -replace=<address> forces a specific resource to be destroyed and recreated in a single operation — the modern replacement for terraform taint.

7. TF_LOG=TRACE to emit the most detailed trace-level API: Which environment variable enables this?

1. terraform apply --verbose to print detailed request logs

   Incorrect. terraform apply has no --verbose flag; log detail is controlled entirely through the TF_LOG environment variable.
2. TERRAFORM_DEBUG=true to enable verbose provider debug logging

   Incorrect. TERRAFORM_DEBUG is not a recognized Terraform variable; the correct control is TF_LOG.
3. TF_LOG=TRACE to emit the most detailed trace-level API logs ✓

   Correct. TF_LOG sets log verbosity, and TRACE is the most detailed level, exposing API calls and HTTP request/response bodies for debugging.
4. TF_LOG=ERROR to show only high-severity error-level messages

   Incorrect. TF_LOG=ERROR surfaces only error messages, not the detailed API traces you need; use TRACE or DEBUG for that.

TF_LOG=TRACE enables maximum verbosity in Terraform — showing all API calls, provider plugin communication, and internal decision logic.

8. Save the plan with terraform plan -out=tfplan then apply: How is this achieved?

1. Lock the state file before running plan so no configuration changes can occur afterward

   Incorrect. State locking only prevents concurrent operations; it does not capture a plan snapshot to guarantee the same changes are applied later.
2. Run terraform plan and terraform apply together as one combined command invocation

   Incorrect. Terraform never combines plan and apply into a single command; they are always separate steps.
3. Use terraform apply -auto-approve to skip the interactive confirmation prompt entirely

   Incorrect. -auto-approve only skips the prompt; apply still re-evaluates state at run time, so the applied changes may differ from an earlier plan.
4. Save the plan with terraform plan -out=tfplan then apply with terraform apply tfplan ✓

   Correct. A saved plan file records the exact diff at plan time, and terraform apply tfplan executes precisely those changes with no re-analysis or prompt.

terraform plan -out=tfplan saves the plan to a binary file; terraform apply tfplan executes exactly those planned changes with no re-analysis — ideal for CI/CD.

9. terraform state show aws_instance.web to view its stored: Which command displays this?

1. terraform state show aws_instance.web to view its stored attributes ✓

   Correct. terraform state show prints all stored attributes of one resource, including provider-assigned values like instance ID, private IP, and public DNS.
2. terraform state list aws_instance.web to filter the resource addresses

   Incorrect. terraform state list only lists resource addresses (optionally filtered); it does not display attribute values.
3. terraform output aws_instance.web to read defined output values

   Incorrect. terraform output prints declared output values, not the arbitrary stored attributes of a resource.
4. terraform show aws_instance.web to display the whole saved state file

   Incorrect. terraform show without the state subcommand renders the entire state or a saved plan, not a single resource; state show targets one resource.

terraform state show <address> displays all current attributes of a specific Terraform-managed resource as stored in state.

10. terraform.workspace: How can the current workspace name be referenced in configuration?

1. local.workspace_name

   Incorrect. locals.workspace_name would require you to define it yourself: `locals { workspace_name = terraform.workspace }` — the built-in reference is `terraform.workspace` directly.
2. terraform.workspace ✓

   Correct. `terraform.workspace` is a built-in Terraform expression that returns the name of the current workspace — usable in conditional expressions like `terraform.workspace == "prod" ? "t3.large" : "t3.micro"`.
3. var.workspace

   Incorrect. There is no built-in `var.workspace` variable. The workspace name is accessed via `terraform.workspace`, not through the variable system.
4. env.TF_WORKSPACE

   Incorrect. `env.` is not a valid Terraform expression namespace. The TF_WORKSPACE environment variable sets the workspace, but it's read via `terraform.workspace` in config.

`terraform.workspace` is the built-in expression for the current workspace name — usable in conditionals to vary configuration between workspaces.

11. terraform output -raw bucket_arn: Which command extracts just the value (no labels)?

1. terraform show --output bucket_arn

   Incorrect. `terraform show --output` is not valid syntax. terraform show displays the full state or plan, not a specific named output.
2. terraform output bucket_arn

   Incorrect. Without -raw, terraform output prints the value with formatting (quotes around strings). For scripting, -raw is cleaner.
3. terraform output -raw bucket_arn ✓

   Correct. `terraform output -raw <name>` prints just the raw output value without quotes or labels — ideal for piping into scripts or environment variables.
4. terraform state show output.bucket_arn

   Incorrect. Outputs are not queried via `terraform state show` — they are queried with `terraform output`. Outputs are stored in state but accessed differently.

terraform output -raw <name> prints just the raw value of a named output — no quotes or labels, ideal for shell scripts.

12. State may become inconsistent because dependent resources: What is a risk of using -target in this way?

1. Terraform will automatically apply all 50 managed resources anyway, completely ignoring the -target flag that you explicitly passed

   Incorrect. -target restricts the run to the specified resources and their dependencies, so Terraform does not apply all fifty.
2. The -target option cannot be used with terraform apply and is only ever accepted by the terraform plan command

   Incorrect. -target works with both terraform plan and terraform apply, limiting which resources each operation includes.
3. Using -target once permanently excludes the targeted resource from every future plan and apply run automatically

   Incorrect. -target affects only the single invocation; later runs without it evaluate every resource normally.
4. State may become inconsistent because dependent resources may not be updated to reflect the targeted resource's changes ✓

   Correct. -target skips evaluating non-targeted resources, so dependents that should also change can be left stale, producing an inconsistent state.

-target is a tactical shortcut for development; it risks state inconsistency by skipping dependent resource updates — avoid in production workflows.

Other Terraform Associate domains

• Understand Terraform Basics — 197 questions →
• Implement and Maintain State — 77 questions →
• Interact with Terraform Modules — 50 questions →
• Use and Apply the Terraform Workflow — 49 questions →
• Understand Infrastructure as Code (IaC) Concepts — 45 questions →
• All 495 Terraform Associate questions →