TAO-Pro sample questions

Question 1

You are managing a critical production environment where applying a configuration that accidentally changes the `user_data` of an EC2 instance would trigger a replacement, causing unacceptable downtime. You want to ensure that any future `terraform apply` fails if it attempts to replace this specific instance due to a change in `user_data`. Which lifecycle configuration should you apply?

Accepted Answer

lifecycle {
ignore_changes = [user_data]
}

Answer

lifecycle {
create_before_destroy = true
}

Answer

lifecycle {
prevent_destroy = true
}

Answer

lifecycle {
replace_triggered_by = []
}

Question 2

A team is using a Terraform configuration that utilizes the `hashicorp/aws` provider. They need to ensure that the configuration is compatible with any version of the provider that is at least version 5.0.0 but less than 6.0.0. Which version constraint string correctly expresses this requirement?

Accepted Answer

"~> 5.0"

Answer

"5.x"

Answer

">= 5.0.0"

Answer

"~> 5.0.0"

Question 3

You are developing a Terraform module that creates an S3 bucket. You want to validate that the bucket name passed via the input variable `bucket_name` meets AWS naming requirements: it must be between 3 and 63 characters long and must start with a lowercase letter or number. You decide to use a `validation` block within the variable declaration. Which configuration correctly implements this?

Accepted Answer

variable "bucket_name" {
type = string
validation {
condition = length(var.bucket_name) >= 3 && length(var.bucket_name) <= 63 && can(regex("^[a-z0-9]", var.bucket_name))
error_message = "Bucket name must be 3-63 chars and start with a lowercase letter or number."
}
}

Answer

variable "bucket_name" {
type = string
check "name_valid" {
condition = can(regex("^[a-z0-9]", var.bucket_name))
}
}

Answer

variable "bucket_name" {
type = string
validation {
assert = length(var.bucket_name) >= 3
error_message = "Invalid name."
}
}

Answer

variable "bucket_name" {
type = string
validation {
condition = regex("^[a-z0-9]", var.bucket_name)
error_message = "Invalid start char."
}
}

Question 4

You are creating a reusable Terraform module for an AWS VPC. The module must accept a list of subnet objects, where each object has a `cidr` (string) and an optional `tags` (map of strings). If `tags` is omitted, it should default to an empty map. Which type constraint correctly defines this input variable using Terraform's optional object attributes feature?

Accepted Answer

type = list(object({
cidr = string
tags = optional(map(string), {})
}))

Answer

type = list(object({
cidr = string
tags = optional(map(string))
}))

Answer

type = list(object({
cidr = string
tags = map(string) | optional
}))

Answer

type = list(object({
cidr = string
tags = map(string)
}))
default = []

Question 5

During a `terraform apply`, you encounter a provider error related to API rate limiting. You need to gather more detailed information about the HTTP requests being made by the AWS provider to debug the issue. Which environment variable should you set to enable the most verbose logging specifically for Terraform core and providers?

Accepted Answer

TF_LOG=TRACE

Answer

AWS_DEBUG=true

Answer

TF_DEBUG=1

Answer

TF_LOG_LEVEL=VERBOSE

Question 6

You are managing a Terraform configuration that uses a local backend. You have been tasked with migrating this state to an S3 backend with DynamoDB locking. After configuring the `backend "s3"` block in your `terraform.tf` file, what is the next command you must run to successfully migrate the existing state data to the new backend?

Accepted Answer

terraform init -migrate-state

Answer

terraform state push

Answer

terraform force-unlock

Answer

terraform apply

Question 7

You are using HCP Terraform (formerly Terraform Cloud) and want to provision infrastructure in AWS. You need to authenticate the AWS provider without hardcoding long-lived access keys in your workspace variables. Which feature should you configure to allow HCP Terraform to authenticate with AWS using temporary, rotating credentials via OpenID Connect (OIDC)?

Accepted Answer

Dynamic Provider Credentials

Answer

Terraform Cloud Agents

Answer

Variable Sets

Answer

Remote State Sharing

Question 8

You are refactoring a Terraform configuration that manages an AWS VPC. You want to extract the security group rules into a separate module. However, the security groups themselves must remain in the root module. You need to pass the security group ID from the root module to the new child module. Which Terraform concept facilitates this data flow?

Accepted Answer

Input Variables

Answer

Local Values

Answer

Terraform Remote State

Answer

Module Outputs

Free TAO-Pro sample questions

A team is using a Terraform configuration that utilizes the `hashicorp/aws` provider. They need to ensure that the configuration is compatible with any version of the provider that is at least version 5.0.0 but less than 6.0.0. Which version constraint string correctly expresses this requirement?

9 more free samples are waiting