CDM Infrastructure Automation & Configuration Management 3 — Questions and Answers
Question 1: Which Terraform meta-argument is used to create multiple instances of the same resource using a map variable?
- count
- for_each (Correct answer)
- depends_on
- lifecycle
Correct answer: for_each
`for_each` iterates over a map or set to create one resource instance per element, giving each a unique key-based identifier.
Question 2: What Ansible construct allows you to define and reuse a set of tasks with its own variables, files, and handlers?
- Playbook
- Inventory
- Role (Correct answer)
- Vault
Correct answer: Role
An Ansible role provides a structured directory layout for tasks, handlers, defaults, and files, enabling reuse across multiple playbooks.
Question 3: In the context of IaC security, what does 'policy as code' typically enforce?
- Storing all IaC files in a private repository
- Automated scanning of IaC templates against compliance rules before deployment (Correct answer)
- Requiring two-factor authentication on all cloud provider accounts
- Encrypting Terraform state files using customer-managed keys
Correct answer: Automated scanning of IaC templates against compliance rules before deployment
Policy as code tools like OPA or Sentinel evaluate IaC templates against security and compliance rules in CI/CD pipelines before any resources are provisioned.
Question 4: Which AWS service is commonly used as a remote backend for storing Terraform state files?
- AWS CodePipeline
- Amazon DynamoDB
- Amazon S3 with optional DynamoDB locking (Correct answer)
- AWS Systems Manager Parameter Store
Correct answer: Amazon S3 with optional DynamoDB locking
Amazon S3 stores the Terraform state file while DynamoDB provides state locking to prevent concurrent modifications.
Question 5: In Ansible, what is the function of `ansible-vault encrypt`?
- Validates the syntax of an Ansible playbook
- Encrypts sensitive data files so they can be safely stored in version control (Correct answer)
- Signs playbooks with a GPG key for integrity verification
- Compresses large inventory files to improve performance
Correct answer: Encrypts sensitive data files so they can be safely stored in version control
`ansible-vault encrypt` uses AES-256 to encrypt files containing secrets, allowing them to be committed to source control without exposing plaintext.
Question 6: What is the primary difference between Terraform `plan` and `apply` commands?
- `plan` validates HCL syntax while `apply` checks provider API availability
- `plan` shows a preview of changes without modifying infrastructure; `apply` executes them (Correct answer)
- `plan` runs in dry-run mode against a local state copy; `apply` syncs with remote state
- `plan` is used for new resources only; `apply` handles updates and deletions
Correct answer: `plan` shows a preview of changes without modifying infrastructure; `apply` executes them
`terraform plan` generates an execution plan showing what would change, while `terraform apply` actually provisions or modifies the infrastructure.
Question 7: Which configuration management approach uses a central server that nodes periodically contact to retrieve and apply their desired state?
- Push-based model
- Pull-based model (Correct answer)
- Event-driven model
- Ephemeral model
Correct answer: Pull-based model
In a pull-based model, agents on each node periodically poll a central server (such as Puppet Master or Chef Server) to fetch and enforce the current desired configuration.
CDM Infrastructure Automation & Configuration Management 3
Which Terraform meta-argument is used to create multiple instances of the same resource using a map variable?