Skip to content
Cheat sheets

002 · Domain 3: Infrastructure Lifecycle and Operations · 22% of the exam

Task 3.6: Manage multiple infrastructure environments

Development, staging and production from shared code: separate root modules and backends, CLI workspaces and terraform.workspace, and per-environment variable files.

Study it

  • Environments from shared code: root modules, backends and workspaces

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

One configuration manages dev, staging and production through CLI workspaces in a single S3 backend. An audit requires that engineers who can change dev cannot read or write production state, and that production runs use a different AWS account for state storage. What should the team do?

  1. AKeep the workspaces and set workspace_key_prefix to prod for production runs
  2. BGive each environment its own root configuration and backend that call shared modules
  3. CKeep the workspaces and use terraform.workspace in the configuration to choose a production provider role
  4. DKeep the workspaces and make production plans run with -lock=false to avoid contention
Show the answer and why

  • AKeep the workspaces and set workspace_key_prefix to prod for production runs

    Incorrect

    The prefix only changes object paths in the same backend; the backend and its credentials stay shared.

  • BGive each environment its own root configuration and backend that call shared modules

    Correct

    Separate configurations with separate backends can use different credentials and access controls, which CLI workspaces in one backend cannot provide.

  • CKeep the workspaces and use terraform.workspace in the configuration to choose a production provider role

    Incorrect

    That changes the credentials used for resources, but state for every workspace still lives in the same backend with the same access.

  • DKeep the workspaces and make production plans run with -lock=false to avoid contention

    Incorrect

    Disabling locking adds risk and does nothing for access separation.

CLI workspaces share one backend, so they are not an isolation mechanism. When environments need different credentials or access controls, give each its own root module and backend configuration.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 2 · choose 1

A script creates CLI workspaces named after branch descriptions, such as "fix login/sso". What rule must workspace names follow?

  1. AThey must start with the name of the environment that they serve
  2. BThey must be usable in a URL path segment without escaping
  3. CThey must match a branch in the repository
  4. DThey must be lowercase letters only
Show the answer and why

  • AThey must start with the name of the environment that they serve

    Incorrect

    There is no required prefix.

  • BThey must be usable in a URL path segment without escaping

    Correct

    The name must be valid to use in a URL path segment without escaping, so that every backend stores it correctly and safely.

  • CThey must match a branch in the repository

    Incorrect

    Workspaces are often tied to branches by convention only.

  • DThey must be lowercase letters only

    Incorrect

    The documented rule concerns URL safety, not case.

Normalize branch names, for example to letters, digits and dashes, before using them as workspace names.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 3 · choose 1

An engineer runs terraform workspace delete feature-x, and the workspace still tracks resources. What happens?

  1. ATerraform destroys the resources, then deletes the workspace
  2. BTerraform moves the resources into the default workspace
  3. CThe workspace is deleted, and its resources stay in state
  4. DIt refuses without -force; forcing it leaves dangling resources
Show the answer and why

  • ATerraform destroys the resources, then deletes the workspace

    Incorrect

    workspace delete never destroys infrastructure.

  • BTerraform moves the resources into the default workspace

    Incorrect

    Terraform does not merge states between workspaces.

  • CThe workspace is deleted, and its resources stay in state

    Incorrect

    The state goes with the workspace.

  • DIt refuses without -force; forcing it leaves dangling resources

    Correct

    Terraform refuses unless -force is set, and after a forced delete the remaining resources exist but are no longer managed.

-force deletes the workspace even while it tracks resources; afterwards Terraform can no longer track or manage that infrastructure.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 4 · choose 1

A team moves a local state file, old.terraform.tfstate, into a new CLI workspace named example. Which command does that in one step?

  1. Aterraform workspace new -state=old.terraform.tfstate example
  2. Bterraform workspace new example with no options
  3. Cterraform state push old.terraform.tfstate
  4. Dterraform init -migrate-state -backend-config=workspace=example
Show the answer and why

  • Aterraform workspace new -state=old.terraform.tfstate example

    Correct

    -state copies the given state file into the newly created workspace.

  • Bterraform workspace new example with no options

    Incorrect

    That creates an empty workspace.

  • Cterraform state push old.terraform.tfstate

    Incorrect

    That writes to the current workspace, not a new one.

  • Dterraform init -migrate-state -backend-config=workspace=example

    Incorrect

    -migrate-state moves state between backends; it does not create a CLI workspace from a file.

Check the result with terraform state list after switching to the new workspace.

HashiCorp documentation

Task 3.6Report a problem with this question

Question 5 · choose 1

A pipeline must switch to a per-branch workspace, creating it on the first run and reusing it afterward. Which single command fits?

  1. Aterraform workspace new on every single run
  2. Bterraform workspace show
  3. Cterraform workspace select -or-create
  4. Dterraform workspace list
Show the answer and why

  • Aterraform workspace new on every single run

    Incorrect

    new fails when the workspace already exists.

  • Bterraform workspace show

    Incorrect

    show prints the current workspace only.

  • Cterraform workspace select -or-create

    Correct

    -or-create creates the workspace when the one being selected does not exist.

  • Dterraform workspace list

    Incorrect

    list only shows existing workspaces.

select -or-create makes the step idempotent across runs.

HashiCorp documentation

Task 3.6Report a problem with this question

Practice domain 3 →Practice all domains →