Terraform Basics and CLI: free practice questions

Correct: B. The `-upgrade` flag tells `terraform init` to check for newer provider versions that still satisfy the version constraints in `required_providers`, rather than reusing the version already recorded in `.terraform.lock.hcl`. If a newer valid version is found, it downloads it and updates the lock file. This is how teams intentionally upgrade provider versions in a controlled way. A is wrong — `terraform init -upgrade` does NOT upgrade the Terraform CLI itself; CLI upgrades are done outside of Terraform (e.g., via package manager or manual download). C is wrong — `terraform init -upgrade` does not delete state or destroy resources; it only affects provider and module downloads. D is wrong — there is no `-upgrade` behavior related to state file schema migration; that happens automatically when Terraform reads a state file from an older format.

Correct: C. `terraform fmt` rewrites Terraform configuration files in the current directory to the canonical HCL style (indentation, alignment, spacing) without altering the logical meaning of the configuration. A is wrong — `terraform validate` checks configuration syntax and internal consistency but does NOT reformat files. B is wrong — `terraform lint` is not a built-in Terraform command; third-party tools like `tflint` exist but are not part of the core CLI. D is wrong — `terraform refresh` updates the Terraform state file to match the real-world infrastructure state; it does not touch source files.

Correct: C. The `+` symbol in a Terraform plan output means the resource is planned for creation — it does not currently exist in the Terraform state and will be provisioned when `apply` is executed. A is wrong — removing a resource from state without destroying infrastructure is done with `terraform state rm`, which does not appear as `+` in a plan. B is wrong — destroy-and-recreate is represented by the `-/+` symbol, not `+`. D is wrong — in-place updates to existing resources are represented by the `~` symbol.

Option A is correct: The `~>` (pessimistic constraint) operator with a two-part version like `5.0` allows any version from `5.0.0` up to (but not including) `6.0.0` — it locks the leftmost segment and allows the rightmost to increase. Option B is wrong — `= 5.0.0` would be the exact-version syntax. Option C is wrong — `~>` always introduces an upper bound; `>= 5.0.0` (without `~>`) would have no upper bound. Option D is wrong — that behavior applies when using a three-part version like `~> 5.0.0`, which would allow `5.0.x` only.

Correct: The `-replace` flag (introduced in Terraform 0.15.2) is the modern replacement for `terraform taint`. Running `terraform apply -replace=aws_instance.app` forces Terraform to destroy and re-create the specified resource in a single step. HashiCorp deprecated `terraform taint` in favor of this approach. — Distractor A is wrong because `-taint` is not a valid flag for `terraform apply`. — Distractor B is partially correct in concept (you CAN run `terraform plan -replace=...` and save the plan), but the question asks for the recommended single-step approach, which uses `-replace` directly with `apply`. — Distractor D is wrong because `terraform state mark-replace` is not a valid subcommand.