Skip to content
Cheat sheets

004 · Domain 3: Core Terraform workflow · 13% of the exam

Task 3.5: Apply changes to infrastructure with Terraform

terraform apply: approving a fresh plan or applying a saved one, automation with -auto-approve, forcing replacement with -replace, parallelism, and what happens to state when an apply fails half way.

Study it

  • terraform apply: approval, saved plans, -replace and failures part way

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 2

A pipeline runs terraform plan -out=tfplan, waits for a person to approve the printed plan, and then runs terraform apply tfplan. Which two statements about the apply step are true? (Choose TWO.)

  1. AIt runs a new plan and applies that instead if the configuration has changed
  2. BIt does not ask for confirmation, because passing the plan file counts as approval
  3. CIt needs -auto-approve, or it waits for input that the pipeline cannot give
  4. DIt cannot take extra planning options such as -var or -replace
  5. EIt reads variable values again from terraform.tfvars at apply time
Show the answer and why

  • AIt runs a new plan and applies that instead if the configuration has changed

    Incorrect

    A saved plan is applied as saved; Terraform does not silently re-plan.

  • BIt does not ask for confirmation, because passing the plan file counts as approval

    Correct

    When you pass a saved plan file, apply takes its actions without prompting; -auto-approve is ignored with a plan file.

  • CIt needs -auto-approve, or it waits for input that the pipeline cannot give

    Incorrect

    The saved plan is the approval, so no prompt appears.

  • DIt cannot take extra planning options such as -var or -replace

    Correct

    With a saved plan you cannot specify additional planning modes or options; the plan file already contains the final decisions.

  • EIt reads variable values again from terraform.tfvars at apply time

    Incorrect

    Input variables are stored in the plan file; apply does not re-read them.

The two-step workflow separates deciding (plan) from doing (apply), and the saved plan carries every decision with it.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 2 · choose 1

What happens when terraform apply runs with no plan file and no extra options?

  1. AIt applies the most recently saved plan file found in the directory
  2. BIt applies the changes immediately without showing them
  3. CIt fails, because apply always needs a saved plan
  4. DIt creates a plan, shows it and asks for approval
Show the answer and why

  • AIt applies the most recently saved plan file found in the directory

    Incorrect

    Apply uses a plan file only when you pass it.

  • BIt applies the changes immediately without showing them

    Incorrect

    That needs -auto-approve.

  • CIt fails, because apply always needs a saved plan

    Incorrect

    The one-step apply is the default.

  • DIt creates a plan, shows it and asks for approval

    Correct

    Without a saved plan, apply creates a plan as if you ran plan, prompts you to approve it, and then takes the actions.

One-step apply plans and asks; two-step apply runs a saved plan.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 3 · choose 1

During large applies a provider's API returns rate-limit errors. The team wants Terraform to run fewer operations at once. Which option controls this, and what is its default?

  1. A-lock-timeout=n; by default it waits 10 seconds between operations
  2. B-parallelism=n; up to 10 operations at once by default
  3. C-compact-warnings; by default 10 warnings at once
  4. D-target=n; by default 10 resources per run
Show the answer and why

  • A-lock-timeout=n; by default it waits 10 seconds between operations

    Incorrect

    -lock-timeout controls waiting for the state lock.

  • B-parallelism=n; up to 10 operations at once by default

    Correct

    -parallelism limits concurrent operations as Terraform walks the graph; the default is 10.

  • C-compact-warnings; by default 10 warnings at once

    Incorrect

    That option only shortens warning output.

  • D-target=n; by default 10 resources per run

    Incorrect

    -target selects resources by address, not by count.

Parallelism is a graph-walk setting; lowering it is an advanced fix for rate limits.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 4 · choose 1

During apply, a new instance is created but its creation-time remote-exec provisioner fails. What does Terraform do with the instance by default?

  1. ADeletes it at once and rolls back the rest of the apply
  2. BKeeps it as is and reruns only the provisioner on every later plan
  3. CMarks it as tainted so the next apply destroys and re-creates it
  4. DRemoves it from state and leaves it running
Show the answer and why

  • ADeletes it at once and rolls back the rest of the apply

    Incorrect

    Terraform does not roll back; the instance stays, tainted.

  • BKeeps it as is and reruns only the provisioner on every later plan

    Incorrect

    The default is taint and replace, not provisioner-only retries.

  • CMarks it as tainted so the next apply destroys and re-creates it

    Correct

    When a creation-time provisioner fails, Terraform taints the resource so that it is replaced on the next apply, unless on_failure = continue.

  • DRemoves it from state and leaves it running

    Incorrect

    The instance stays in state, marked tainted.

A failed creation-time provisioner leaves a tainted resource, which the next apply replaces.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 5 · choose 1

A repository keeps each environment's root module in its own directory, such as envs/prod. A wrapper script runs from the repository root and must apply the prod configuration. Which command does this?

  1. Aterraform -chdir=envs/prod apply
  2. Bterraform apply envs/prod
  3. Cterraform apply -target=envs/prod
  4. Dterraform apply -var-file=envs/prod
Show the answer and why

  • Aterraform -chdir=envs/prod apply

    Correct

    The global -chdir option makes Terraform switch to the given directory before running the subcommand, for all commands.

  • Bterraform apply envs/prod

    Incorrect

    Passing a directory to apply was removed in Terraform v0.15; the argument now has to be a saved plan file.

  • Cterraform apply -target=envs/prod

    Incorrect

    -target takes resource addresses, not directories.

  • Dterraform apply -var-file=envs/prod

    Incorrect

    -var-file reads variable values from a file; it does not change the root module.

-chdir goes before the subcommand and works the same for init, plan and apply.

HashiCorp documentation

Task 3.5Report a problem with this question

Question 6 · choose 1

A configuration has an output for a load balancer's DNS name. When does a successful terraform apply show its value?

  1. AOnly after running terraform refresh separately to load the outputs into state
  2. BOnly in the plan, never after apply
  3. CAt the end of the apply, after the changes are made
  4. DNever; outputs are only for child modules
Show the answer and why

  • AOnly after running terraform refresh separately to load the outputs into state

    Incorrect

    Outputs are printed by apply itself; no extra command is needed.

  • BOnly in the plan, never after apply

    Incorrect

    The plan may show the value as unknown; apply prints the final one.

  • CAt the end of the apply, after the changes are made

    Correct

    Root module outputs are printed after a successful apply and are stored in state for terraform output.

  • DNever; outputs are only for child modules

    Incorrect

    Root outputs are shown by the CLI.

Apply ends by printing root outputs; terraform output can show them again later.

HashiCorp documentation

Task 3.5Report a problem with this question

Practise domain 3 →Practise all domains →