Cert prep · Terraform Authoring and Operations Pro · AWS DevOps Engineer Pro (DOP-C02)

Lifecycle guardrails, dynamic configuration, modules and reusable IaC

Practice self-check. Answers stay in this page so you can grade yourself. This is not a scored exam.

Ten questions. Objectives: Terraform Pro 2 and 4; DOP-C02 tasks 2.1 and 2.3. Companion lab: Terraform lab 01, lifecycle guardrails.

Lab download. Starter is the tree you edit. Worked answer is a separate file; open it after the starter passes. Terraform exactly 1.10.5. terraform init downloads hashicorp/aws 6.71.0 once, pinned by the shipped lock file. The checker uses a mock provider: no AWS account, no credentials, and no cloud spend. All lab requirements.

Q1 · Terraform Pro objective 2, dynamic configuration

A module for the edge supervisor declares variable "max_restarts" with a validation block whose condition is var.max_restarts >= 1 && var.max_restarts <= 3 and a clear error_message. A teammate runs terraform plan -var max_restarts=5 in CI. What happens?

Answer: C. When a variable validation condition evaluates to false, Terraform returns an error containing the error_message and halts the operation instead of producing a plan. Validation failures are errors rather than warnings, Terraform never adjusts a caller's value to fit the condition, and the check runs during plan, before any resource is created.
Source: Validate your configuration, input variable validation - https://developer.hashicorp.com/terraform/language/validate

Q2 · Terraform Pro objective 2, dynamic configuration

A root module must name the audit-ledger table "${var.service}-${var.environment}-ledger" and reuse that name in several resources. A teammate proposes making table_name an input variable whose default is that interpolated string. What is the correct approach?

Answer: A. Local values name an expression so it can be reused within a module, and a variable default must be a literal that cannot reference other variables. Variable defaults are not evaluated against other variables, outputs expose values to callers and cannot be referenced as output.name inside the module, and a data source is unnecessary for a simple string expression.
Source: variable block reference (default requires a literal value) - https://developer.hashicorp.com/terraform/language/block/variable ; Use locals to reuse expressions - https://developer.hashicorp.com/terraform/language/values/locals

Q3 · Terraform Pro objective 2, dynamic configuration

The edge ingress aws_security_group has name = "edge-ingress" and lifecycle { create_before_destroy = true }. Changing its description forces a replacement, and the apply fails because a group with that name already exists in the VPC. What is the best fix?

Answer: D. With create_before_destroy the new object is created while the old one still exists, so a resource that requires a unique name needs a generated or prefixed name to avoid a conflict. depends_on only orders dependencies and does nothing about two groups needing the same name, prevent_destroy makes the plan error instead of avoiding the clash, and ignoring name does not remove the need to create a second group with a distinct name.
Source: The lifecycle Meta-Argument - https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle

Q4 · Terraform Pro objective 2, dynamic configuration

The audit-ledger aws_dynamodb_table has lifecycle { prevent_destroy = true }. A reviewer asks what this setting guarantees. Which statement is accurate?

Answer: B. Terraform documents that prevent_destroy makes any plan that would destroy the object fail, and that it does not protect the object if the resource block is removed from the configuration entirely. The setting is a Terraform-side check only, so it does not stop out-of-band deletion or survive removal of the block, and it also blocks replacements that would destroy the object, not only a destroy command.
Source: The lifecycle Meta-Argument, prevent_destroy - https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle

Q5 · Terraform Pro objective 2, dynamic configuration

An external autoscaler adjusts read_capacity and write_capacity on the provisioned audit-ledger table, and every terraform plan now shows a diff that would reset them. The team still wants plans to detect drift in every other argument, such as tags. Which configuration is best?

Answer: B. ignore_changes accepts a list of specific attributes, so Terraform ignores changes to the externally managed capacity values while still planning changes to everything else. ignore_changes = all would also hide drift in tags and other arguments, prevent_destroy does not affect in-place argument diffs, and skipping refresh does not stop the configured values from differing from the real ones.
Source: The lifecycle Meta-Argument - https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle

Q6 · Terraform Pro objective 4, modules

A child module edge_sg declares variable "ingress_cidrs" as list(string) with a validation block using alltrue([for c in var.ingress_cidrs : can(cidrnetmask(c))]). A caller passes ["10.0.0.0/33"]. When and how is the problem reported?

Answer: D. Type constraints and validation blocks on a module's input variables are evaluated when the configuration is planned, so a bad caller value fails fast with the author's message. Waiting for the EC2 API defeats the purpose of validation, and variable validation works in child modules without any duplicate check in the root module.
Source: variable block reference, validation - https://developer.hashicorp.com/terraform/language/block/variable

Q7 · Terraform Pro objective 4, modules

The root module currently manages aws_security_group.edge. The team moves it into a new child module called edge whose resource is named aws_security_group.this. They want terraform plan to show no destroy and recreate. What should they add?

Answer: A. A moved block records the old address as from and the new module address as to, so Terraform updates state and treats it as the same object. Reversing from and to describes the wrong direction, replace_triggered_by forces replacement rather than preventing it, and a removed block either plans the old group for destruction or, with destroy = false, only forgets it, so the module would still create a second group.
Source: Refactoring, moved blocks - https://developer.hashicorp.com/terraform/language/modules/develop/refactoring ; removed block reference - https://developer.hashicorp.com/terraform/language/block/removed

Q8 · DOP-C02 task 2.1, reusable IaC components

A platform team wants every application team to build the edge ingress security group with the approved ports, tagging and logging settings. Today teams copy a template from a wiki and edit it, and the copies have diverged. Which approach best embeds the governance in a reusable component?

Q9 · DOP-C02 task 2.1, reusable IaC components

A pull request changes the TableName property of the audit-ledger AWS::DynamoDB::Table in a CloudFormation template. The change process requires that engineers confirm whether a stack update will replace any resource before it runs. What should the pipeline do?

Answer: D. A change set previews the proposed stack changes, including whether each resource's Replacement value is true, before the update is executed. Running the update first and inspecting afterward gives no preview, drift detection reports out-of-band changes rather than planned replacements, and termination protection only guards against deleting the whole stack.
Source: Update CloudFormation stacks using change sets - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html

Q10 · DOP-C02 task 2.3, automation at scale

A fleet of EC2 instances running the edge service must keep an agent configuration file at an approved state. Engineers occasionally edit the file by hand, and the team wants the approved state reapplied automatically every 30 minutes without logging in. Which solution fits?