TF-Associate-004 - Core Terraform workflow (19% of the exam) - Section 3d
Generate and review an execution plan for Terraform.
terraform plan produces a preview of create, update, in-place versus replace, and destroy actions by diffing configuration against state and refreshing real resources. A plan makes no changes. Candidates should read plan symbols and know a saved plan file can be passed to apply.
terraform planplan does not change infrastructurecreate update replace destroysaved plan file
Practice question for this objective
lock_openFree sampleCore Terraform workflowmedium
A practitioner runs 'terraform plan' against a configuration that would add two resources and delete one. Before the command finishes, they cancel a meeting because they worry the plan has already begun deleting the resource. A colleague reassures them. Which statement correctly describes what running 'terraform plan' on its own has done to the real infrastructure?
$ terraform plan
Plan: 2 to add, 0 to change, 1 to destroy.
AIt has made no changes; plan only previews the actions it would take and leaves the real infrastructure untouched.check_circle Correct
BIt has already deleted the one resource marked for destroy, because destroys are executed during the plan phase for safety.
CIt has created the two new resources but deferred the destroy until an apply is run.
DIt has applied every change immediately because no '-out' file was supplied to hold the proposal.
Understand that 'terraform plan' only previews proposed actions and makes no changes to real infrastructure. The plan command reads configuration, refreshes state against the provider, and computes a diff of intended create, update, and destroy actions. It is strictly read-and-report: no resource is altered until apply executes the proposed changes.
Why A is correct: Correct: 'terraform plan' compares the configuration and refreshed state to build a proposed set of actions, but it never creates, updates, or destroys real resources.
Why B is wrong: Tempting because the summary lists a destroy, but plan only reports intended actions; nothing is destroyed until 'terraform apply' runs.
Why C is wrong: Plausible if you assume additions are low risk, but plan creates nothing; all actions, additions included, wait for apply.
Why D is wrong: The absence of '-out' only means the proposal is not saved to disk; it does not cause plan to apply anything, which plan never does.
Answers that look right on this material and are not. Each one is a distractor from a different question in the TF-Associate-004 bank for this domain.
terraform plan, because generating the execution plan is the point at which resources are created
errorWhy it is wrong: Plan is frequently mistaken for the provisioning step, but it only computes and displays the proposed changes and never creates real resources.
terraform plan -destroy, which by itself removes the managed resources from the cloud
errorWhy it is wrong: plan -destroy previews a teardown but is still only a plan; it displays the destroy actions and does not remove anything on its own.
Nothing about the change, because plan reads only the configuration files and ignores the current state of real resources.
errorWhy it is wrong: Tempting, but plan refreshes state against the provider during the run, so it does detect out-of-band drift rather than ignoring it.