Skip to main content

Module Quiz

Complete this quiz after finishing all concept and practice pages. Save your answers before opening separate quiz calibration. The quiz mixes conceptual interpretation, HCL reading, and incident-style scenarios.

Current Module Questions​

Question 1: Declarative vs Imperative​

Classify each and justify in one sentence.

  • (a) A Bash script that calls aws ec2 run-instances, then aws ec2 create-tags.
  • (b) A resource "aws_instance" "web" {} block in a .tf file.
  • (c) An Ansible playbook with a list of tasks that install, configure, and start nginx.

Question 2: Reading a Plan​

Terraform will perform the following actions:

  # aws_s3_bucket.artifacts will be updated in-place
  ~ resource "aws_s3_bucket" "artifacts" {
      ~ tags = {
          ~ "Env" = "dev" -> "development"
        }
        id   = "acme-artifacts-dev"
    }

  # aws_db_instance.primary must be replaced
-/+ resource "aws_db_instance" "primary" {
      ~ engine_version = "14.10" -> "15.4" # forces replacement
        id             = "db-abc123" -> (known after apply)
      - final_snapshot_identifier = null
    }

Plan: 1 to add, 1 to change, 1 to destroy.

What should a reviewer say? Name three specific concerns and what the safe path is.

Question 3: State Corruption Scenario​

Two engineers on the same team each run terraform apply against envs/prod/ within 60 seconds of each other. The backend is S3 without DynamoDB locking. What can happen, and what is the failure mode?

Question 4: HCL Interpretation​

variable "env" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.env)
    error_message = "env must be one of: dev, staging, prod."
  }
}

locals {
  bucket_name = "acme-${var.env}-artifacts"
  is_prod     = var.env == "prod"
}

resource "aws_s3_bucket" "this" {
  bucket = local.bucket_name

  lifecycle {
    prevent_destroy = local.is_prod
  }
}

What does this code guarantee? What does it not guarantee?

Question 5: moved Block Semantics​

What is the difference between these two approaches to renaming aws_instance.app to aws_instance.api?

Approach A:

moved {
  from = aws_instance.app
  to   = aws_instance.api
}

Approach B:

terraform state mv aws_instance.app aws_instance.api

Question 6: HCL Interpretation​

resource "aws_security_group_rule" "web" {
  for_each          = var.allowed_cidrs
  type              = "ingress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = [each.value]
  security_group_id = aws_security_group.web.id
}

What is the address of each rule, and what happens if you remove one entry from var.allowed_cidrs?

Question 7: Remote State and Outputs​

Team A's Terraform provisions a VPC and emits vpc_id as an output. Team B's Terraform needs vpc_id to provision services. Name three ways to expose the value across codebases and give the main tradeoff of each.

Question 8: Policy as Code​

You ship a Rego policy that forbids public S3 buckets. A team asks for an exception: their bucket hosts a static website and legitimately needs public-read. What is the correct response?

Question 9: Workspaces vs Environments​

A new hire suggests terraform workspace new prod to manage production separately from dev. What is wrong with this suggestion?

Question 10: Drift Detection​

What is drift, and why do terraform plan runs on an unchanged codebase sometimes show changes?

Question 11: Import Block​

resource "aws_s3_bucket" "legacy_logs" {
  bucket = "acme-legacy-logs"
}

import {
  to = aws_s3_bucket.legacy_logs
  id = "acme-legacy-logs"
}

What does terraform plan show, and how do you know the import is "clean"?

Question 12: Blast Radius​

Your root module manages VPC + 3 services + RDS + S3 + CloudFront. An engineer's refactor accidentally inverts a for_each. Running apply would destroy all three services. Name two structural patterns (not review processes) that reduce the blast radius of this class of mistake.

Interleaved Review Questions​

Prior Module Question 1 (S9 M1: Cloud Foundations)​

What is the difference between IAM roles and IAM users, and why does IaC prefer roles for service-to-service access?

Prior Module Question 2 (S7 M5: ADRs and Reviews)​

You write an ADR that says "we will use Terraform for all cloud infrastructure." Later the team wants to use CDK for one service. What changes about the ADR?

Prior Module Question 3 (S1 M2: Unix and CLI)​

What is idempotency in a shell-scripting context, and how does it relate to terraform apply?

Prior Module Question 4 (S6 M-foundations: Git)​

Why does terraform apply in CI need to check out the exact commit being reviewed, not main?

Prior Module Question 5 (S5 Testing)​

Why is a unit test for a Terraform module weaker than an integration test that actually plans against a provider?

Self-Assessment and Remediation​

Mastery Level (90-100% correct):

  • Ready to own Terraform codebases at work. Focus next on policy-as-code in CI and on a real refactor of one monolith root module.

Proficient Level (75-89% correct):

  • Review the concept pages in the cluster where you missed. Most common gap is Cluster 4 (plan review discipline and refactoring).

Developing Level (60-74% correct):

  • Rework Practice 2 (modularity and state) and Practice 3 (refactoring clinic). The most likely symptom is missing state mechanics.

Insufficient Level (below 60% correct):

  • Restart from Cluster 1. The usual underlying gap is treating IaC as "writing YAML"; it is an engineering discipline about state, plans, and blast radius. Produce three ADR-style writeups of past infra incidents before attempting the rest.

Progression boundary​

Quiz performance calibrates retrieval and reasoning. It does not replace runnable work, changed-case transfer, the module assessment or required semester evidence. Consult practice calibration for the additional independent cases.