TAO-Pro sample questions

Question 1

You are the Lead Terraform Architect for a financial services firm. You are refactoring a large monolithic configuration into smaller, reusable modules to improve maintainability. One specific resource, an `aws_s3_bucket` named `logs`, needs to be moved from the root configuration into a new child module named `audit_logs`. You must ensure that the existing bucket is NOT destroyed and recreated during this refactoring process, as it contains petabytes of compliance data. Which configuration block should you add to your root module to facilitate this state migration?

Accepted Answer

moved {
from = aws_s3_bucket.logs
to = module.audit_logs.aws_s3_bucket.logs
}

Answer

import {
to = module.audit_logs.aws_s3_bucket.logs
id = aws_s3_bucket.logs.id
}

Answer

lifecycle {
prevent_destroy = true
}

Answer

resource "aws_s3_bucket" "logs" {
moved_to = module.audit_logs.aws_s3_bucket.logs
}

Question 2

A DevOps engineer is tasked with importing a legacy EC2 instance into a Terraform configuration. The engineer has written the `resource "aws_instance" "legacy" {}` block but does not know the exact instance ID required for the import. However, they know the instance has a specific tag `Role = "LegacyApp"`. Which approach allows the engineer to import this resource using Terraform 1.5+ declarative import syntax without manually looking up the ID first?

Accepted Answer

Use a `data "aws_instance"` block to find the instance by tag, and reference `data.aws_instance.legacy.id` in the `id` argument of an `import` block.

Answer

Run `terraform import aws_instance.legacy $(aws ec2 describe-instances --filters ...)` in the terminal.

Answer

Use the `import` lifecycle meta-argument within the resource block: `lifecycle { import = { id_from_tag = "Role=LegacyApp" } }`.

Answer

Define the `import` block with `to = aws_instance.legacy` and leave the `id` field blank; Terraform will prompt for it during `terraform plan`.

Question 3

You are managing a critical production environment where applying a configuration that accidentally changes the `user_data` of an EC2 instance would trigger a replacement, causing unacceptable downtime. You want to ensure that any future `terraform apply` fails if it attempts to replace this specific instance due to a change in `user_data`. Which lifecycle configuration should you apply?

Accepted Answer

lifecycle {
ignore_changes = [user_data]
}

Answer

lifecycle {
prevent_destroy = true
}

Answer

lifecycle {
create_before_destroy = true
}

Answer

lifecycle {
replace_triggered_by = []
}

Question 4

A team is using a Terraform configuration that utilizes the `hashicorp/aws` provider. They need to ensure that the configuration is compatible with any version of the provider that is at least version 5.0.0 but less than 6.0.0. Which version constraint string correctly expresses this requirement?

Accepted Answer

"~> 5.0"

Answer

">= 5.0.0"

Answer

"~> 5.0.0"

Answer

"5.x"

Question 5

You are developing a Terraform module that creates an S3 bucket. You want to validate that the bucket name passed via the input variable `bucket_name` meets AWS naming requirements: it must be between 3 and 63 characters long and must start with a lowercase letter or number. You decide to use a `validation` block within the variable declaration. Which configuration correctly implements this?

Accepted Answer

variable "bucket_name" {
type = string
validation {
condition = length(var.bucket_name) >= 3 && length(var.bucket_name) <= 63 && can(regex("^[a-z0-9]", var.bucket_name))
error_message = "Bucket name must be 3-63 chars and start with a lowercase letter or number."
}
}

Answer

variable "bucket_name" {
type = string
validation {
assert = length(var.bucket_name) >= 3
error_message = "Invalid name."
}
}

Answer

variable "bucket_name" {
type = string
check "name_valid" {
condition = can(regex("^[a-z0-9]", var.bucket_name))
}
}

Answer

variable "bucket_name" {
type = string
validation {
condition = regex("^[a-z0-9]", var.bucket_name)
error_message = "Invalid start char."
}
}

Question 6

You are creating a reusable Terraform module for an AWS VPC. The module must accept a list of subnet objects, where each object has a `cidr` (string) and an optional `tags` (map of strings). If `tags` is omitted, it should default to an empty map. Which type constraint correctly defines this input variable using Terraform's optional object attributes feature?

Accepted Answer

type = list(object({
cidr = string
tags = optional(map(string), {})
}))

Answer

type = list(object({
cidr = string
tags = map(string) | optional
}))

Answer

type = list(object({
cidr = string
tags = map(string)
}))
default = []

Answer

type = list(object({
cidr = string
tags = optional(map(string))
}))

Question 7

During a `terraform apply`, you encounter a provider error related to API rate limiting. You need to gather more detailed information about the HTTP requests being made by the AWS provider to debug the issue. Which environment variable should you set to enable the most verbose logging specifically for Terraform core and providers?

Accepted Answer

TF_LOG=TRACE

Answer

TF_DEBUG=1

Answer

AWS_DEBUG=true

Answer

TF_LOG_LEVEL=VERBOSE

Question 8

You are managing a Terraform configuration that uses a local backend. You have been tasked with migrating this state to an S3 backend with DynamoDB locking. After configuring the `backend "s3"` block in your `terraform.tf` file, what is the next command you must run to successfully migrate the existing state data to the new backend?

Accepted Answer

terraform init -migrate-state

Answer

terraform state push

Answer

terraform apply

Answer

terraform force-unlock

Top vendors

Top exams

Free TAO-Pro sample questions

A team is using a Terraform configuration that utilizes the `hashicorp/aws` provider. They need to ensure that the configuration is compatible with any version of the provider that is at least version 5.0.0 but less than 6.0.0. Which version constraint string correctly expresses this requirement?

9 more free samples are waiting