Skip to content
Cheat sheets

002 · Domain 2: Terraform State and Backend Operations · 13% of the exam

Task 2.2: Manage state and remediate drift

Finding and fixing drift: refresh-only plans and applies, when to accept a change into state and when to overwrite it, and how backend reinitialization and plan options affect what Terraform compares.

Study it

  • Drift: refresh-only plans and deciding which side wins

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 2

During an incident, an engineer raised an autoscaling group's maximum size from 6 to 10 in the cloud console and also added a temporary debug tag. The team decides that 10 is the new standard and that the tag must go. Which two actions achieve both outcomes? (Choose TWO.)

  1. AChange the maximum size in the configuration to 10
  2. BRun terraform apply -refresh-only, which records the new maximum size and the added tag and keeps both
  3. CRun a normal plan and apply, which proposes removing the tag added outside Terraform
  4. DAdd lifecycle { ignore_changes = [tags] } to the autoscaling group
  5. ERun terraform plan -refresh=false to revert the tag without touching the size
Show the answer and why

  • AChange the maximum size in the configuration to 10

    Correct

    With the configuration matching the new size, a normal plan no longer proposes changing the size back.

  • BRun terraform apply -refresh-only, which records the new maximum size and the added tag and keeps both

    Incorrect

    A refresh-only apply writes the console changes into state and never changes the group, so the debug tag stays in place.

  • CRun a normal plan and apply, which proposes removing the tag added outside Terraform

    Correct

    A normal plan refreshes the object and proposes updating it to match the configuration, which removes the tag Terraform does not declare.

  • DAdd lifecycle { ignore_changes = [tags] } to the autoscaling group

    Incorrect

    That keeps the debug tag forever, the opposite of what the team wants.

  • ERun terraform plan -refresh=false to revert the tag without touching the size

    Incorrect

    The plan then compares the configuration with the stored state only, which holds neither the tag nor the new size, so it proposes nothing for either.

Decide per attribute: write the values you keep into the configuration, and let a normal plan and apply revert the rest. Refresh-only mode reconciles state with reality but never changes the remote objects.

HashiCorp documentation

Task 2.2Report a problem with this question

Question 2 · choose 1

An on-call runbook says to run terraform refresh whenever someone changes infrastructure outside Terraform. A reviewer asks for terraform apply -refresh-only instead. Which risk is the reviewer avoiding?

  1. Aterraform refresh auto-approves; with wrong credentials it can drop every object from state unprompted
  2. Bterraform refresh changes the real infrastructure to match the configuration while it refreshes state
  3. Cterraform refresh ignores state locking and lets two runs write the state at the same time
  4. Dterraform refresh rewrites the configuration files to match remote objects, which loses edits
Show the answer and why

  • Aterraform refresh auto-approves; with wrong credentials it can drop every object from state unprompted

    Correct

    refresh is an alias for apply -refresh-only -auto-approve, and HashiCorp warns that misconfigured credentials can make Terraform remove all tracked objects without confirmation.

  • Bterraform refresh changes the real infrastructure to match the configuration while it refreshes state

    Incorrect

    refresh never modifies remote objects; it only updates state to match them.

  • Cterraform refresh ignores state locking and lets two runs write the state at the same time

    Incorrect

    refresh accepts the same locking options as apply and locks state like any other operation that writes it.

  • Dterraform refresh rewrites the configuration files to match remote objects, which loses edits

    Incorrect

    No refresh command edits configuration files; it works on state only.

The refresh command is deprecated. apply -refresh-only shows the detected changes and asks for confirmation before writing them to state.

HashiCorp documentation

Task 2.2Report a problem with this question

Question 3 · choose 1

After a manual change to a security group, an engineer runs terraform plan -refresh-only. Besides resource attributes in state, what else can this plan update when it is applied?

  1. ARoot module output values
  2. BThe remote objects, which it changes back to match the configuration
  3. CThe configuration files, which it rewrites to match reality
  4. DThe dependency lock file's provider selections
Show the answer and why

  • ARoot module output values

    Correct

    Refresh-only mode updates the state and any root module output values to match changes made outside Terraform.

  • BThe remote objects, which it changes back to match the configuration

    Incorrect

    Refresh-only mode never changes remote objects.

  • CThe configuration files, which it rewrites to match reality

    Incorrect

    Terraform does not edit configuration files in any planning mode.

  • DThe dependency lock file's provider selections

    Incorrect

    Provider selections change only during init.

A refresh-only plan lists the detected drift and any changes to outputs; applying it records both without touching infrastructure.

HashiCorp documentation

Task 2.2Report a problem with this question

Question 4 · choose 1

During an incident an engineer created an extra CloudWatch alarm by hand. The team wants Terraform to manage that alarm from now on without recreating it. A colleague proposes terraform apply -refresh-only. What should the team do instead?

  1. ARun apply -refresh-only, which adds the new alarm to state
  2. BWrite a resource block for the alarm and import it to that address
  3. CRun plan -refresh=false, so that the next apply leaves the alarm alone
  4. DAdd the alarm's ID to the depends_on list of a related resource
Show the answer and why

  • ARun apply -refresh-only, which adds the new alarm to state

    Incorrect

    Refresh-only mode updates objects already tracked in state; it does not add an object that has no address in the configuration.

  • BWrite a resource block for the alarm and import it to that address

    Correct

    An object created outside Terraform comes under management once the configuration declares it and an import binds the real object to that address.

  • CRun plan -refresh=false, so that the next apply leaves the alarm alone

    Incorrect

    Skipping refresh ignores external changes for that plan; it does not bring the alarm under management.

  • DAdd the alarm's ID to the depends_on list of a related resource

    Incorrect

    depends_on takes references to objects in the configuration and only orders operations.

Refresh-only mode reconciles state with changes to objects Terraform already tracks. A new object needs a resource block and an import, preferably an import block so the import shows up in a reviewed plan.

HashiCorp documentation

Task 2.2Report a problem with this question

Question 5 · choose 1

An operator changes a remote object outside Terraform, but the change does not invalidate the configuration: Terraform would only need to update state. How does HashiCorp classify this kind of drift?

  1. AConfiguration drift, which drift detection reports as a failed check
  2. BPolicy drift, which only a policy check can find
  3. CProvider drift, fixed by pinning the provider version
  4. DState drift, which drift detection does not report
Show the answer and why

  • AConfiguration drift, which drift detection reports as a failed check

    Incorrect

    Configuration drift is an external change that invalidates the configuration, which this change does not do.

  • BPolicy drift, which only a policy check can find

    Incorrect

    HashiCorp's drift terms are configuration drift and state drift.

  • CProvider drift, fixed by pinning the provider version

    Incorrect

    That is not one of HashiCorp's drift categories.

  • DState drift, which drift detection does not report

    Correct

    State drift is an external change that does not invalidate the configuration; refresh-only mode handles it, and drift detection does not detect it.

Drift detection in HCP Terraform looks for configuration drift. Reconcile state drift with a refresh-only plan and apply.

HashiCorp documentation

Task 2.2Report a problem with this question

Question 6 · choose 1

An engineer suspects a colleague edited an instance in the console and runs terraform plan -refresh-only. Which part of the output shows the drift?

  1. AThe Plan: summary line that closes the output with action counts
  2. BThe warning section that -compact-warnings condenses at the end
  3. CThe note headed "Objects have changed outside of Terraform"
  4. DThe lock file diff that init prints after refreshing
Show the answer and why

  • AThe Plan: summary line that closes the output with action counts

    Incorrect

    The summary counts proposed actions; it does not describe outside changes.

  • BThe warning section that -compact-warnings condenses at the end

    Incorrect

    Warnings are diagnostics, not a report of detected changes.

  • CThe note headed "Objects have changed outside of Terraform"

    Correct

    Terraform prints this note with the detected changes when the refresh finds differences from the last recorded state.

  • DThe lock file diff that init prints after refreshing

    Incorrect

    init reports provider selection changes, not infrastructure drift.

Read the note to see what drifted; applying the refresh-only plan records those changes in state without touching infrastructure.

HashiCorp documentation

Task 2.2Report a problem with this question

Practice domain 2 →Practice all domains →