002 · Domain 3: Infrastructure Lifecycle and Operations · 22% of the exam
Task 3.2: Plan changes to infrastructure
The plan as a review artifact: planning modes, -refresh=false, -target and -exclude, saved plan files, -detailed-exitcode, and reading what a plan proposes to replace.
Study it
Plans as review artifacts: modes, targeting, exclusion and saved plans
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
During an incident an engineer runs terraform plan -target=aws_lb_listener.https on a large configuration. The listener references a target group and a certificate; a monitoring dashboard references the listener. Which objects does the plan consider?
AThe listener and the dashboard that references it, but none of the objects the listener depends on
BOnly the listener, with every other object ignored
CThe listener plus the target group and certificate it depends on, but not the dashboard
DEvery object in the configuration, with only the listener, target group and certificate refreshed
Show the answer and why
AThe listener and the dashboard that references it, but none of the objects the listener depends on
Incorrect
Targeting follows dependencies of the targeted object, not objects that depend on it.
BOnly the listener, with every other object ignored
Incorrect
The selection always grows to include the objects the targeted instances depend on.
CThe listener plus the target group and certificate it depends on, but not the dashboard
Correct
Targeting selects the given instances and extends the selection to everything they depend on directly or indirectly.
DEvery object in the configuration, with only the listener, target group and certificate refreshed
Incorrect
Objects outside the targeted set and its dependencies are left out of the plan entirely.
-target is for exceptional situations such as recovering from mistakes; routine use risks undetected drift. Splitting very large configurations is the recommended long-term answer.
A wrapper script builds terraform plan command lines from user options. Which two combinations does Terraform reject? (Choose TWO.)
Aterraform plan -refresh=false -target=aws_instance.web
Bterraform plan -refresh-only -refresh=false
Cterraform plan -replace=aws_instance.web -replace=aws_instance.api
Dterraform plan -destroy -replace=aws_instance.web
Eterraform plan -destroy -out=teardown.tfplan
Show the answer and why
Aterraform plan -refresh=false -target=aws_instance.web
Incorrect
Skipping refresh and targeting are both normal planning options and can be used together.
Bterraform plan -refresh-only -refresh=false
Correct
-refresh=false cannot be used in refresh-only mode, because it would disable the whole purpose of the plan.
Cterraform plan -replace=aws_instance.web -replace=aws_instance.api
Incorrect
-replace can be given several times to replace several objects in one plan.
Dterraform plan -destroy -replace=aws_instance.web
Correct
-replace cannot be combined with -destroy.
Eterraform plan -destroy -out=teardown.tfplan
Incorrect
A destroy-mode plan can be saved to a file and applied later like any other saved plan.
Planning modes are mutually exclusive, -refresh=false is meaningless in refresh-only mode, and -replace does not combine with destroy mode. Other planning options can be mixed and repeated.
A pipeline wrapper converts each saved plan with terraform show -json and must decide whether to send the plan to an approver for applying. Which field does the JSON output format tell wrapping automation to use as its primary condition?
Aerrored, which must be false
Bresource_changes, which must not be empty
Capplyable, which must be true
Dformat_version, which must match the CLI
Show the answer and why
Aerrored, which must be false
Incorrect
errored says whether planning failed; the documentation names a different flag as the primary condition for applying.
Bresource_changes, which must not be empty
Incorrect
Counting resource changes is not the documented condition, and it misses plans whose only changes are to outputs.
Capplyable, which must be true
Correct
applyable indicates that it would make sense for wrapping automation to try to apply the plan, and automation should use it as its primary condition.
Dformat_version, which must match the CLI
Incorrect
format_version describes the JSON format, not whether the plan can be applied.
The exact definition of applyable may change in later Terraform versions, which is why automation should rely on the flag instead of rebuilding the logic from other fields.