Core Terraform workflow

Which statement most accurately describes what running terraform plan does to your managed infrastructure?

• AIt applies additions immediately but defers deletions until the next apply
• BIt provisions any new resources while leaving existing resources untouched
• CIt previews the proposed changes without making any changes to infrastructurecheck_circle Correct
• DIt rolls back the most recent apply if drift is detected

Why A is wrong: This is tempting because plans distinguish additions from deletions, but plan enacts neither; it only reports both as proposed actions.

Why B is wrong: Plan does list new resources it intends to add, but it does not provision them; provisioning happens only during apply.

Why C is correct: Plan compares desired configuration against current state and shows the actions Terraform would take, without creating, updating, or deleting anything.

Why D is wrong: Plan does surface drift between configuration and reality, but it never reverts a prior apply or performs any rollback of its own.

A colleague changed an EC2 instance type directly in the AWS console, and the running configuration still lists the original type. A practitioner wants to know whether terraform validate will detect this difference between the configuration and the real infrastructure. What is the correct answer?

• AYes, because validate refreshes the state against the provider and reports any attribute that differs from the configuration.
• BYes, but only when validate is run with the -refresh-only flag so it compares state to the real instance.
• CNo, because validate only checks the configuration itself and does not read state or query the provider to detect drift.check_circle Correct
• DNo, because validate checks only for provider credentials and stops before reaching the resource definitions.

Why A is wrong: Tempting because it mirrors what plan does, but validate performs no refresh and reads no state, so it cannot compare against real resources.

Why B is wrong: Tempting because -refresh-only is a real mode, but it belongs to plan and apply, not validate, which accepts no such flag.

Why C is correct: Correct: validate never contacts the provider or refreshes state, so real-world drift is invisible to it; detecting drift is the job of plan.

Why D is wrong: Tempting because validate does run without credentials, but the reason is wrong: validate fully checks the resource definitions and simply never inspects real infrastructure.

A practitioner has just written a new configuration in an empty directory and runs terraform plan straight away. The command fails before producing any plan, complaining about an uninitialised working directory. Which step of the workflow did they skip?

$ terraform plan
Error: Initialization required. Please see the error message above.
$

• AThey skipped terraform apply, which must run once to register the providers before a plan works
• BThey skipped terraform init, which installs the required providers and prepares the working directorycheck_circle Correct
• CThey skipped terraform fmt, which must format the files before Terraform can read them
• DThey skipped terraform validate, which initialises the backend as a side effect of checking syntax

Why A is wrong: Apply comes after plan, not before it, and cannot run on an uninitialised directory either, so it is not the missing prerequisite.

Why B is correct: Init sits at the start of the workflow and downloads providers and modules into the directory, and plan cannot proceed until it has run.

Why C is wrong: fmt only rewrites configuration to canonical style and is entirely optional; unformatted files still parse and plan correctly.

Why D is wrong: validate checks configuration consistency but does not initialise the directory or install providers, and it also requires init to have run first.

A CI pipeline runs Terraform non-interactively and must apply an already-reviewed change without any human at a keyboard to confirm the prompt. Which single command lets the apply proceed unattended while still executing the changes?

# runs inside an automated CI job, no TTY attached

• ARun 'terraform apply -auto-approve' so Terraform skips the interactive prompt and applies the change.check_circle Correct
• BRun 'terraform plan -auto-approve' so the plan step approves itself for the later apply.
• CRun 'terraform apply -input=false' so Terraform treats the confirmation as automatically granted.
• DRun 'terraform apply -lock=false' so the run does not stop to wait for operator confirmation.

Why A is correct: Correct: -auto-approve tells apply to bypass the yes prompt, which is exactly what an unattended pipeline needs.

Why B is wrong: Tempting because -auto-approve is the right flag, but plan never changes infrastructure and does not accept that flag, so nothing would be applied.

Why C is wrong: The -input=false flag only disables prompting for missing variables; with no approval given the apply errors out rather than proceeding.

Why D is wrong: Disabling the state lock affects concurrency safety, not the approval prompt, so apply would still halt waiting for a yes.

A team lead wants a continuous integration job to fail whenever a submitted configuration is not in canonical format, without the job modifying any files in the checkout. Which terraform fmt invocation meets this requirement?

# CI pipeline step
terraform fmt <flag>

• Aterraform fmt -recursive
• Bterraform fmt -checkcheck_circle Correct
• Cterraform fmt -write=true
• Dterraform fmt -json

Why A is wrong: -recursive extends formatting into subdirectories but still rewrites files in place, so the job would edit the checkout rather than simply failing on badly formatted input.

Why B is correct: The -check flag reports whether files are already in canonical format and returns a non-zero exit code if any are not, all without writing changes, which is exactly what a gating CI job needs.

Why C is wrong: This is the default behaviour that overwrites files with the canonical form; a CI gate must not modify the checkout, and it would not fail on unformatted input.

Why D is wrong: -json changes the output format to machine-readable JSON but, without -check, still rewrites files and does not by itself turn unformatted input into a failing exit code.