A team is setting up an S3 backend for Terraform. They want to ensure that only the CI/CD pipeline's IAM role can read and write the state, and that no other users can access it. What is the best way to configure access?

Enable S3 Block Public Access and set the bucket ACL to private

Create a bucket policy that allows the IAM role to access the bucket, and deny all other principals

Make the bucket private and rely on the default deny-all behavior

Use an IAM role with a trust policy that allows only the CI/CD pipeline

A team uses an S3 backend with versioning enabled for their Terraform state. After a recent terraform apply, they notice that a critical resource was accidentally deleted. They want to restore the state to the version from before the apply. What is the correct way to accomplish this?

Use the AWS console to download the previous state version and upload it as the current state file

Run terraform state pull and pipe it to terraform state push

Run terraform apply with the -refresh-only flag

Run terraform state rm to remove the deleted resource from the current state

What is the purpose of state locking in Terraform?

To prevent multiple users from modifying the state file at the same time

To encrypt the state file to protect sensitive data

To restrict access to the state file to authorized users only

To automatically back up the state file before each apply

A team is migrating from a local state to an S3 backend. They have added the backend block to their configuration and run terraform init -migrate-state. The migration succeeds, but when they run terraform plan, they get an error saying the state file is not found in the S3 bucket. What is the most likely cause?

The team did not run terraform apply after migration

The S3 bucket does not have versioning enabled

The key specified in the backend block does not match the key where the state was migrated

The IAM role used by Terraform does not have permission to read from the S3 bucket

A team uses an S3 backend with versioning enabled. After a failed terraform apply, they need to understand what changes were made to the state. Where can they find a history of state changes?

In the Terraform state file itself, which contains a history of all changes

In the Terraform plan output, which is saved automatically

In the DynamoDB table used for locking, which stores state history

In the S3 bucket's versioning list, which shows all versions of the state file

HashiCorp Certified:Terraform Authoring and Operations Professional

Domain 3Objective 2

3b TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL Practice Questions (Page 4)

Part of the Develop collaborative Terraform workflows domain, which makes up ~16% of our current practice bank. HashiCorp does not publish an official question count, but from its 240-minute exam (~95–160 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

Questions 16–20

16application · medium
A team is setting up an S3 backend for Terraform. They want to ensure that only the CI/CD pipeline's IAM role can read and write the state, and that no other users can access it. What is the best way to configure access?
Select an answer first
17application · medium
A team uses an S3 backend with versioning enabled for their Terraform state. After a recent terraform apply, they notice that a critical resource was accidentally deleted. They want to restore the state to the version from before the apply. What is the correct way to accomplish this?
Select an answer first
18foundation · medium
What is the purpose of state locking in Terraform?
Select an answer first
19expert · hard
A team is migrating from a local state to an S3 backend. They have added the backend block to their configuration and run terraform init -migrate-state. The migration succeeds, but when they run terraform plan, they get an error saying the state file is not found in the S3 bucket. What is the most likely cause?
Select an answer first
20application · medium
A team uses an S3 backend with versioning enabled. After a failed terraform apply, they need to understand what changes were made to the state. Where can they find a history of state changes?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by HashiCorp. “TERRAFORM-AUTHORING-AND-OPERATIONS-PROFESSIONAL” is a trademark of its owner, used for identification only.