Skip to content
Cheat sheets

004 · Domain 3: Core Terraform workflow · 13% of the exam

Task 3.4: Generate and review an execution plan for Terraform

terraform plan: refresh, compare, propose; reading create, update, replace and destroy markers, saved plan files with -out, planning modes and options, and the dependency graph behind the order.

Study it

  • Reading a plan: actions, saved plans, exit codes and targeting

    Partly covered by: Topological Sort

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A plan shows one resource with the symbol -/+ and the note "forces replacement" next to a changed argument. What will apply do to it?

  1. ADestroy the object and create a new one, as that argument cannot change in place
  2. BUpdate the object in place and keep a backup copy of the old object in the state
  3. CLeave the object alone and change only the value recorded in state
  4. DCreate a second object next to it and keep both
Show the answer and why

  • ADestroy the object and create a new one, as that argument cannot change in place

    Correct

    Some arguments cannot be updated in place; Terraform then plans to destroy and re-create the object, shown as a replace action.

  • BUpdate the object in place and keep a backup copy of the old object in the state

    Incorrect

    An in-place update is shown with ~, and Terraform keeps no backup of remote objects.

  • CLeave the object alone and change only the value recorded in state

    Incorrect

    That would be a refresh-only change, not a replace action.

  • DCreate a second object next to it and keep both

    Incorrect

    Replacement ends with one object; the old one is destroyed.

-/+ marks a replacement; ~ marks an update in place.

HashiCorp documentation

Task 3.4Report a problem with this question

Question 2 · choose 1

A cautious engineer asks whether running terraform plan against production could change any infrastructure. What is the answer?

  1. AYes; plan applies changes that do not need confirmation
  2. BYes; plan deletes resources that are no longer in the configuration
  3. CNo; nothing changes until an apply
  4. DNo, but it locks the infrastructure until an apply runs
Show the answer and why

  • AYes; plan applies changes that do not need confirmation

    Incorrect

    plan never applies anything.

  • BYes; plan deletes resources that are no longer in the configuration

    Incorrect

    Deletions are proposed in the plan and happen only on apply.

  • CNo; nothing changes until an apply

    Correct

    A plan without -out is a speculative description of the effect of the changes, with no intent to apply them.

  • DNo, but it locks the infrastructure until an apply runs

    Incorrect

    Plan may lock state while it runs; it never locks infrastructure afterwards.

Plans are previews. Apply is the only step that changes infrastructure.

HashiCorp documentation

Task 3.4Report a problem with this question

Question 3 · choose 1

A plan output shows a data source with the symbol <= and the word read. What does it mean?

  1. ATerraform will delete the data source's object in the cloud
  2. BThe data source is read during apply, as it depends on unknown values
  3. CThe data source's object is being imported into state as a managed resource
  4. DThe data source failed and will be retried
Show the answer and why

  • ATerraform will delete the data source's object in the cloud

    Incorrect

    Data sources never destroy anything.

  • BThe data source is read during apply, as it depends on unknown values

    Correct

    Data sources are normally read during planning; when their arguments depend on unknown values, the read is deferred to apply and shown in the plan.

  • CThe data source's object is being imported into state as a managed resource

    Incorrect

    Import is a separate action for managed resources.

  • DThe data source failed and will be retried

    Incorrect

    A failure would be an error, not a planned action.

Reading is normally a plan-time step; <= read marks the ones that must wait for apply.

HashiCorp documentation

Task 3.4Report a problem with this question

Question 4 · choose 1

After saving a plan with -out=changes.tf, every later terraform command in the directory fails with syntax errors. Why?

  1. APlan files must always be named tfplan, with no file extension at all
  2. BSaving a plan corrupts the configuration in the same directory
  3. CThe plan file must be deleted before the next plan can run
  4. DFiles ending in .tf are read as configuration, and a plan is not
Show the answer and why

  • APlan files must always be named tfplan, with no file extension at all

    Incorrect

    tfplan is a convention; any name works except configuration suffixes.

  • BSaving a plan corrupts the configuration in the same directory

    Incorrect

    Saving a plan writes only the plan file.

  • CThe plan file must be deleted before the next plan can run

    Incorrect

    Later plans fail only because of the .tf suffix.

  • DFiles ending in .tf are read as configuration, and a plan is not

    Correct

    Plan files may have any name, but a .tf suffix makes Terraform try to interpret the file as configuration.

Name plan files with any suffix that is not a configuration suffix, such as tfplan.

HashiCorp documentation

Task 3.4Report a problem with this question

Question 5 · choose 1

A team wants a script to inspect a saved plan, for example to flag any deletion of a database. How should the script read the plan?

  1. AOpen the plan file directly, since it is stored as plain JSON
  2. BRun terraform output -json on the plan file
  3. CRun terraform show -json on the plan file
  4. DRun terraform validate -json on the plan file
Show the answer and why

  • AOpen the plan file directly, since it is stored as plain JSON

    Incorrect

    Plan files use an opaque format not meant for direct reading.

  • BRun terraform output -json on the plan file

    Incorrect

    output reads output values from state, not plans.

  • CRun terraform show -json on the plan file

    Correct

    terraform show -json prints a saved plan as JSON intended for other programs.

  • DRun terraform validate -json on the plan file

    Incorrect

    validate checks configuration, not plans.

Saved plans are opaque; show -json is their machine-readable view.

HashiCorp documentation

Task 3.4Report a problem with this question

Question 6 · choose 1

In a plan for a new instance, its public IP address appears as (known after apply). What does this mean?

  1. AThe provider assigns it on creation, so the plan cannot show it yet
  2. BThe value is sensitive and is hidden until after apply
  3. CThe plan failed to read the value from the provider, and the apply may fail for the same reason
  4. DThe attribute will be removed from the configuration after apply
Show the answer and why

  • AThe provider assigns it on creation, so the plan cannot show it yet

    Correct

    Some attributes are computed by the provider during apply; the plan marks them as known after apply.

  • BThe value is sensitive and is hidden until after apply

    Incorrect

    Hidden sensitive values are shown as (sensitive value).

  • CThe plan failed to read the value from the provider, and the apply may fail for the same reason

    Incorrect

    Unknown is a normal plan state for computed attributes.

  • DThe attribute will be removed from the configuration after apply

    Incorrect

    Configuration is never changed by apply.

Computed attributes are unknown until the object exists; references to them are resolved during apply.

HashiCorp documentation

Task 3.4Report a problem with this question

Practise domain 3 →Practise all domains →