002 · Domain 4: CI/CD and Automation Workflows · 10% of the exam
Task 4.2: Understand deployment strategies
Running Terraform in automation: TF_IN_AUTOMATION and other environment variables, the CLI configuration file, plugin caching, locking in shared runners, and stale locks.
Study it
Rolling change through environments without downtime
Automation settings: environment variables, CLI configuration and stale locks
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
A CI image exports TF_CLI_ARGS_plan="-parallelism=5". One job runs terraform plan -parallelism=20. What parallelism does that plan use?
A5, because environment variables always override the flags that are typed on the command line
BAn error, because the same flag appears twice in one command
C10, the default, because conflicting values cancel each other out
D20, because TF_CLI_ARGS values are inserted before the flags typed on the command line
Show the answer and why
A5, because environment variables always override the flags that are typed on the command line
Incorrect
It is the other way round: the environment arguments are placed before the typed flags so that typed flags win.
BAn error, because the same flag appears twice in one command
Incorrect
TF_CLI_ARGS values are inserted into the command line as if typed; repeating the flag is not an error.
C10, the default, because conflicting values cancel each other out
Incorrect
Conflicting values do not reset the setting to the default; the later flag is the one that takes effect.
D20, because TF_CLI_ARGS values are inserted before the flags typed on the command line
Correct
Terraform inserts the environment arguments right after the subcommand and before command-line flags, which ensures typed flags take precedence.
TF_CLI_ARGS affects every command and TF_CLI_ARGS_name only the named one. Both are inserted ahead of the typed flags, so a job can still override a default set in the image.
A runner crashed while holding a lock on a local terraform.tfstate. An engineer in a second session runs terraform force-unlock with the lock ID. What does the force-unlock reference say?
AIt also rolls back the changes the crashed run made
BLocal locks are lifted automatically after 15 minutes
CLocal state files cannot be unlocked by another process
DIt works only with -force, which removes every lock in the backend
Show the answer and why
AIt also rolls back the changes the crashed run made
Incorrect
force-unlock does not modify infrastructure.
BLocal locks are lifted automatically after 15 minutes
Incorrect
No such timeout is documented.
CLocal state files cannot be unlocked by another process
Correct
Lock behavior depends on the backend, and a local state file cannot be unlocked by another process.
DIt works only with -force, which removes every lock in the backend
Incorrect
-force only skips the confirmation prompt.
Use force-unlock only when automatic unlocking failed, and only with the ID of the lock you know is stale.
A team wants every Terraform command in its runners to fail rather than prompt for a missing variable, without editing each command line. What should it set?
ATF_IN_AUTOMATION=1
BTF_CLI_ARGS=-auto-approve
CTF_VAR_input=false
DTF_INPUT=0
Show the answer and why
ATF_IN_AUTOMATION=1
Incorrect
That only adjusts output hints.
BTF_CLI_ARGS=-auto-approve
Incorrect
That skips approvals; plan does not even accept it.
CTF_VAR_input=false
Incorrect
That sets a variable named input.
DTF_INPUT=0
Correct
Set to false or 0, it makes commands behave as if -input=false were specified.
Combine it with complete variable files so that missing values surface as errors early.
Build agents must use a CLI configuration with a network mirror, without touching each agent's home directory. Which environment variable points Terraform at that file?
ATF_CLI_CONFIG_FILE, naming a file such as ci.tfrc
BTF_DATA_DIR, naming the mirror's directory
CTF_PLUGIN_CACHE_DIR, naming the mirror's URL
DTF_CLI_ARGS_init with the file's path
Show the answer and why
ATF_CLI_CONFIG_FILE, naming a file such as ci.tfrc
Correct
TF_CLI_CONFIG_FILE sets the CLI configuration file's location, and the file should follow the *.tfrc naming pattern.
BTF_DATA_DIR, naming the mirror's directory
Incorrect
TF_DATA_DIR moves per-working-directory data.
CTF_PLUGIN_CACHE_DIR, naming the mirror's URL
Incorrect
That sets a local plugin cache, not a configuration file.
DTF_CLI_ARGS_init with the file's path
Incorrect
That adds command-line arguments, not CLI configuration.
Ship the .tfrc file with the agent image and set the variable at the job level.
A provider_installation block has a network_mirror with include = ["example.com/*/*"] and exclude = ["example.com/corp/*"]. Where can example.com/corp/db come from through that method?
AFrom the mirror; include wins for exact host matches
BNot from the mirror: exclusion patterns take priority
CFrom the mirror, as the later rule overrides the earlier one
DFrom the mirror only when the lock file lists it
Show the answer and why
AFrom the mirror; include wins for exact host matches
Incorrect
Exclusion patterns take priority over inclusion.
BNot from the mirror: exclusion patterns take priority
Correct
When both include and exclude are set for a method, the exclusion patterns take priority.
CFrom the mirror, as the later rule overrides the earlier one
Incorrect
Order in the block does not decide this.
DFrom the mirror only when the lock file lists it
Incorrect
The lock file does not change installation method matching.
Pair the mirror with a direct block or another method that includes the excluded providers, or installation of them fails.