A dynamic block acts much like a for expression, but produces nested blocks instead of a complex typed value. It iterates over a given complex value and generates a nested block for each element of that complex value. You can dynamically construct repeatable nested blocks like setting using a special dynamic block type, which is supported inside resource, data, provider, and provisioner blocks.

WRONG ANSWERS:

* declares a resource of a given type with a given local name = this is the definition of a resource block

* requests that Terraform read from a given data source and export the result under the given local name = this is a data block

* exports a value exported by a module or configuration = this is an output block

https://www.terraform.io/language/expressions/dynamic-blocks

The terraform graph command is used to generate a visual representation of either a configuration or execution plan. The output is in the DOT format, which can be used by GraphViz to generate charts.

https://www.terraform.io/cli/commands/graph

You can change your backend configuration at any time. You can change both the configuration itself as well as the type of backend (for example from "consul" to "s3").

Terraform will automatically detect any changes in your configuration and request a reinitialization. As part of the reinitialization process, Terraform will ask if you'd like to migrate your existing state to the new configuration. This allows you to easily switch from one backend to another.

https://www.terraform.io/language/settings/backends/configuration#changing-configuration

Terraform OSS and Terraform Enterprise are versions of Terraform that can be installed locally on your own servers, therefore giving you the ability to manage both the Terraform binary and the underlying operating system where Terraform runs.

WRONG ANSWERS:

Although Terraform Cloud for Business does offer Cloud Agents that could be used to provision resources on your local infrastructure on-premises, it is a hosted solution and you would NOT have full control over the operating system that runs the Terraform platform.

Terraform Cloud (free) does not meet either of these use cases since you can't deploy to on-premises nor can you manage the underlying operating system since it's a hosted service.

https://www.terraform.io/cloud-docs/overview

https://www.terraform.io/cloud-docs/agents

All resources that are managed by Terraform are referenced in the state file, including detailed information about the resource. Terraform uses the state to map your configuration to the real-world resources that are deployed and managed on the backend platform (AWS, GCP, F5, Infoblox, etc.). You can use the terraform state commands to view and manipulate Terraform state if needed.

terraform state show <resource address> will show you a lot of details on the resource, including things like the ID, IP address, the state of the resource, and lots more.

WRONG ANSWERS:

terraform state list will just show you a list of the resources being managed by Terraform, but it won't show you details on each of those resources

terraform state rm aws_instance.frontend would remove the resource from state. This would not destroy the resource on the public cloud, but it would tell Terraform to stop managing it.

terraform state pull will download the state from its current location, upgrade the local copy to the latest state file version that is compatible with locally-installed Terraform, and output the raw format to stdout

https://www.terraform.io/cli/commands/state/show#example-show-a-resource

https://www.terraform.io/cli/commands/state/rm

The one thing that cannot be guaranteed is that the terraform.tfstate file ALWAYS matches the deployed infrastructure since changes can easily be made outside of Terraform. For example, if you deploy a bunch of resources in GCP and nobody makes any changes, then yes, the terraform.tfstate file does match the current state of those resources. However, if an engineer makes a change in the GCP console or CLI, then the terraform.tfstate would NOT match the infrastructure deployed until you ran a terraform apply -refresh-only command.

This is why the only false statement in this question is: it always matches the infrastructure deployed with Terraform.

WRONG ANSWERS:

The following statements are TRUE about Terraform, which makes them the incorrect choice for this question.

Terraform uses the terraform.tfstate file to store everything it needs to manage the resources it is managing. This includes a ton of information about each resource it provisions and manages. Because of this, HashiCorp recommends that you DO NOT modify the file directly outside of using the Terraform workflow (terraform init, plan, apply, destroy) and terraform state CLI commands.

Many times, you'll need to provide sensitive values to deploy and manage resources, or Terraform may retrieve sensitive values at your request (like data blocks). In that case, these values may get saved to the state file, therefore you should limit who can access the state file to protect this sensitive data.

https://www.terraform.io/language/state

https://www.terraform.io/language/state/sensitive-data

https://www.terraform.io/language/state/purpose

Anytime you need to reference a resource that is NOT part of your Terraform configuration, you need to query that resource using a data block - assuming a data source is available for that resource_type. Once you add the data block to your configuration, you will be able to export attributes from that data block using interpolation like any other resource in Terraform. For example, if you had an AWS S3 bucket, you could get information using a data block that looked like this:

data "aws_s3_bucket" "data_bucket" {

 bucket = "my-data-lookup-bucket-btk"

}

Once you add the data block, you can refer to exported attributes like this: data.aws_s3_bucket.data_bucket.arn

WRONG ANSWERS:

None of the wrong answers would allow you to import or query information so that Terraform can use it through interpolation.

https://learn.hashicorp.com/tutorials/terraform/data-sources

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket

Sort of testing two different things here - a complex map variable plus the for_each argument.

A for_each argument will iterate over a map or set of strings and create a similar instance/resource for each item in the map or set. In our case, the map is the input variable and the "each" would be the higher-level map, so prod and dev. Underneath each value, there are two arguments, both az and ip that you can choose from.

The input variable that is shown in this example is essentially a map of maps.

WRONG ANSWERS:

None of the wrong answers are valid ways to reference the values provided by the input variable.

https://www.terraform.io/language/meta-arguments/for_each

https://learn.hashicorp.com/tutorials/terraform/for-each

These are actually examples of Terraform functions, not expressions. Expressions would be something more in the line of string, number, bool, null, etc.

For the exam, you should go through these and understand what they do at a high level as you could get questions on using a few of them. Check out the built-in functions for Terraform here - https://www.terraform.io/language/functions

To perform a dry-run of your Terraform configuration, you should run a terraform plan. The entire purpose of running a terraform plan is to validate the change(s) to your infrastructure before you apply the change. In this case, Thomas could see what resources would be created without actually deploying the resources and costing him money.

WRONG ANSWERS:

Running a terraform apply -refresh-only would not give you the desired output. This command is used to update the state file for existing resources deployed with Terraform. This would be useful if somebody made a change outside of Terraform, and you needed to reflect that change in the state file.

Using terraform output wouldn't work because this command is used to view any outputs defined in your Terraform code. You can also use terraform output <output name> to view more detailed information about a particular output.

Running a terraform show would not give you what you're looking for here. This command displays the output from a state or plan file.

https://www.terraform.io/cli/commands/plan

https://learn.hashicorp.com/tutorials/terraform/aws-build?in=terraform/aws-get-started

https://www.terraform.io/intro/core-workflow#plan