Skip to content
Cheat sheets

004 · Domain 3: Core Terraform workflow · 13% of the exam

Task 3.6: Destroy Terraform-managed infrastructure

terraform destroy and plan -destroy: removing everything a configuration manages, reviewing a destroy plan first, and the ways to remove a single object instead.

Study it

  • Destroying infrastructure and the reverse dependency order

    Partly covered by: Topological Sort

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A developer is finished with a temporary environment and wants to see exactly what would be removed before removing everything the configuration manages. Which commands do this?

  1. Aterraform graph to preview, then terraform fmt
  2. Bterraform validate -destroy to preview, then terraform apply
  3. Cterraform show to preview, then delete terraform.tfstate
  4. Dterraform plan -destroy to preview, then terraform destroy
Show the answer and why

  • Aterraform graph to preview, then terraform fmt

    Incorrect

    graph shows dependencies and fmt rewrites files; neither removes anything.

  • Bterraform validate -destroy to preview, then terraform apply

    Incorrect

    validate has no destroy mode, and apply without -destroy keeps the resources.

  • Cterraform show to preview, then delete terraform.tfstate

    Incorrect

    Deleting state leaves every object running and unmanaged.

  • Dterraform plan -destroy to preview, then terraform destroy

    Correct

    plan -destroy shows a speculative destroy plan, and terraform destroy is an alias for apply -destroy that prompts before acting.

Destroy is just a planning mode: preview with plan -destroy, run it with destroy (or apply -destroy).

HashiCorp documentation

Task 3.6Report a problem with this question

Question 2 · choose 1

A configuration has a network, a subnet inside it, and an instance in the subnet. In which order does terraform destroy remove them?

  1. AThe instance, then the subnet, then the network
  2. BThe network, then the subnet, then the instance
  3. CAll three at once, since destroy ignores dependencies
  4. DIn alphabetical order of resource type
Show the answer and why

  • AThe instance, then the subnet, then the network

    Correct

    Destruction follows dependencies in reverse, so objects that depend on others go first.

  • BThe network, then the subnet, then the instance

    Incorrect

    The network cannot be removed while the subnet and instance depend on it.

  • CAll three at once, since destroy ignores dependencies

    Incorrect

    Destroy respects the dependency graph.

  • DIn alphabetical order of resource type

    Incorrect

    Type names do not decide order.

Create in dependency order, destroy in reverse.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 3 · choose 1

Before an instance is destroyed, a script must deregister it from an external inventory system. Which Terraform feature runs the script at the right moment?

  1. AA local-exec provisioner with on_failure = continue
  2. BA depends_on argument from the instance to the script file in the repository
  3. CA check block that runs the script during destroy
  4. DA provisioner with when = destroy in the instance's block
Show the answer and why

  • AA local-exec provisioner with on_failure = continue

    Incorrect

    on_failure controls failure behavior, not when the provisioner runs.

  • BA depends_on argument from the instance to the script file in the repository

    Incorrect

    depends_on orders resources; it does not run scripts.

  • CA check block that runs the script during destroy

    Incorrect

    Check blocks assert conditions; they do not run scripts.

  • DA provisioner with when = destroy in the instance's block

    Correct

    Destroy-time provisioners run before the resource is destroyed; they must stay in the configuration to run.

when = destroy runs a provisioner just before destruction; use it sparingly.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 4 · choose 1

A nightly job tears down a sandbox environment with no person present. Which command removes everything without waiting at a prompt?

  1. Aterraform destroy -input=true
  2. Bterraform destroy -auto-approve
  3. Cterraform plan -destroy -auto-approve
  4. Dterraform apply -compact-warnings
Show the answer and why

  • Aterraform destroy -input=true

    Incorrect

    That asks for input, which a job cannot give.

  • Bterraform destroy -auto-approve

    Correct

    destroy accepts most of apply's options, including -auto-approve to skip interactive approval.

  • Cterraform plan -destroy -auto-approve

    Incorrect

    plan never makes changes, so it has no approval to skip.

  • Dterraform apply -compact-warnings

    Incorrect

    That only shortens warnings, and apply still waits for approval.

For disposable environments, destroy -auto-approve is the unattended clean-up.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 5 · choose 1

After a successful terraform destroy, what remains in the configuration's state?

  1. AThe destroyed resources, each marked as deleted so the history is kept
  2. BNothing, and the configuration files are deleted as well
  3. CNo resource instances; destroy mode leaves an empty state
  4. DOnly data sources, which destroy cannot remove
Show the answer and why

  • AThe destroyed resources, each marked as deleted so the history is kept

    Incorrect

    State tracks current bindings, not history.

  • BNothing, and the configuration files are deleted as well

    Incorrect

    destroy never touches configuration files.

  • CNo resource instances; destroy mode leaves an empty state

    Correct

    Destroy mode creates a plan whose goal is to destroy all remote objects that currently exist, leaving an empty Terraform state.

  • DOnly data sources, which destroy cannot remove

    Incorrect

    Destroy leaves no managed resources; data sources are read again on demand.

An empty state, an intact configuration: running apply again would rebuild everything.

HashiCorp documentation

Task 3.6Report a problem with this question

Practise domain 3 →Practise all domains →