5 exercises — practise answering Terraform Platform Engineer interview questions in professional technical English.
0 / 10 completed
1 / 10
The interviewer asks: "Your Terraform state file for a production environment was accidentally corrupted. How would you recover, and how do you prevent this from happening again?" Which answer best demonstrates Terraform Platform Engineer expertise?
Option B is strongest because it uses proper state backup and versioning to recover safely, reconciles drift methodically, and fixes root causes like missing state locking and uncontrolled local applies. Option A risks Terraform destroying and recreating real production resources it can no longer track correctly, causing an outage. Option C is extremely risky and error-prone, since hand-editing state easily introduces further corruption or drift. Option D causes a full production outage and potential data loss for stateful resources like databases, which is a drastic overreaction to a recoverable problem.
2 / 10
The interviewer asks: "How do you structure Terraform code so that a change to a shared networking module does not risk accidentally breaking every environment that depends on it?" Which answer best demonstrates Terraform Platform Engineer expertise?
Option B is strongest because it isolates blast radius through per-environment state and explicit version pinning, with a progressive, validated rollout process and clear changelog communication. Option A creates a single point of failure where any mistake affects every environment simultaneously with no isolation. Option C means every environment silently picks up unreviewed changes the moment they land on main, which is exactly the uncontrolled propagation risk the question describes. Option D avoids the propagation risk but creates massive duplication and drift, making consistent updates across environments far harder to manage safely.
3 / 10
The interviewer asks: "How do you prevent a Terraform plan from being approved and applied that would destroy and recreate a production database, when that was not the developer's intent?" Which answer best demonstrates Terraform Platform Engineer expertise?
Option B is strongest because it uses lifecycle protections, automated policy-as-code detection, and explicit approval gates specifically for destructive actions, rather than relying on manual vigilance alone. Option A is exactly the failure mode described in the question — a human missed it under review pressure. Option C is not an actionable fix, just a restatement of hoping people are more careful. Option D removes the primary safety mechanism, plan review, entirely, which drastically increases risk rather than reducing it.
4 / 10
The interviewer asks: "Your organization has dozens of teams writing their own Terraform, leading to inconsistent tagging, naming, and security configurations across cloud resources. How would you address this at a platform level?" Which answer best demonstrates Terraform Platform Engineer expertise?
Option B is strongest because it makes compliance the path of least resistance through well-designed shared modules, backed by automated policy enforcement as a safety net, and treats the modules as an adopted product rather than an unenforced mandate. Option A relies purely on voluntary compliance with a document, which is exactly the kind of inconsistency the question describes already happening. Option C creates a central bottleneck that does not scale across dozens of teams and slows every team down. Option D is impractical since different teams legitimately have different infrastructure needs, and a rigid one-size-fits-all template will be worked around rather than adopted.
5 / 10
The interviewer asks: "How do you manage secrets, like database passwords or API keys, that Terraform needs to provision infrastructure without exposing them in state files or version control?" Which answer best demonstrates Terraform Platform Engineer expertise?
Option B is strongest because it sources secrets from a dedicated secrets manager at apply time, encrypts and restricts access to state since state itself can contain sensitive values, and avoids having Terraform handle raw secret values where out-of-band generation is possible. Option A commits plaintext secrets directly to version control history, which is a severe and hard-to-reverse security exposure. Option C leaves secrets in shell history and process lists, and still does not solve the state file exposure problem. Option D ignores that Terraform state itself commonly contains secret values in plaintext, which is the harder and more important part of the problem to solve.
6 / 10
Sarah (Senior DevOps Engineer) sends you this Slack message: 'Hey, the new web server deployment is failing – Terraform keeps returning an error about 'Invalid AMI ID'. I've tried restarting the provisioner, but it's still happening. It's impacting our staging environment.'
Which of the following actions should you take FIRST to troubleshoot this issue?
This scenario requires immediate triage. Rolling back the apply is the fastest way to mitigate the impact of the failed deployment. Checking the AMI ID directly addresses the error message and allows for a quick verification of configuration details—the other options are less effective initial steps that could prolong the outage. It's crucial to focus on resolving the specific error reported.
7 / 10
Mark, a junior developer, submits this PR description for a Terraform module: 'This module creates EC2 instances with some security groups. It's pretty standard.' The code includes no explicit configuration of the security group rules.
What is the MOST important thing you should request Mark to do before merging this PR into production?
While comments and documentation are good practice, the core issue here is the lack of explicit security group configuration. Running `terraform plan` will reveal whether the module is creating any security groups at all, exposing a critical vulnerability. The default configuration could be overly permissive, leading to significant security risks – therefore, ensuring a baseline configuration via `terraform plan` is paramount.
8 / 10
David (Lead Platform Engineer) asks you: 'We're using Terraform to deploy our microservices. We've noticed that developers are frequently applying different versions of the same module, leading to inconsistencies across environments. How do we enforce a single source of truth for these modules?'
Which approach would be MOST effective?
A central repository with versioning is the standard best practice for managing infrastructure as code. This ensures that everyone uses the latest approved module versions and provides a clear audit trail. The other options introduce unnecessary complexity or potential for errors—manual updates are prone to inconsistencies, while feature flags don't address the core problem of version control.
9 / 10
Emily (Terraform Platform Engineer) reports: 'I'm seeing Terraform plans failing with an error related to IAM roles. The role seems to be valid in the console, but Terraform can't seem to assume it.'
What is a likely reason for this issue?
IAM role misconfiguration is the most common cause of this type of issue. Even if a role appears correct in the console, it might lack the necessary permissions to create or modify resources. This could be due to missing policies, incorrect resource ARNs, or insufficient trust relationships – verifying and correcting these roles is crucial for Terraform operation.
10 / 10
Tom (Platform Engineer) sends this API response from a cloud provider's console: `{"status": "error", "message": "Resource 'my-db' does not exist in the specified region."}`. This response is generated by a Terraform provisioner attempting to create a database instance.
What is the MOST appropriate action you should take to resolve this problem?
The API response clearly indicates a resource does not exist in the specified region. The first step is always to verify that the Terraform configuration has the correct database name and region defined. Deleting the resource without confirming this could lead to further errors or data loss—the other options address symptoms rather than the root cause.
What does "Terraform Platform Engineer — IT English Interview Practice" cover?
Practise answering Terraform Platform Engineer interview questions in professional technical English. Covers state management, module versioning, policy-as-code guardrails, and secrets handling.
How many questions are in this interview set?
This set has 10 exercises, each with a full explanation.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do these exercises include model answers?
Yes. Each interview question gives you several possible responses and asks you to pick the one that communicates most clearly and completely — the explanation then breaks down exactly why that answer works, including the specific vocabulary a strong candidate would use.
What if I choose an answer that isn't the strongest one?
You'll see which option was correct and read a full explanation of why it's stronger than the alternatives, plus the key vocabulary and phrasing worth reusing in a real interview.
Can I retry the questions?
Yes — use the "Try again" button on the results screen to reset and go through the set again.
Is this the same as a real technical or behavioural interview?
No — it's focused practice for the language side of interviewing: recognising which phrasing sounds precise and confident versus vague, and knowing the vocabulary interviewers expect for this role. It won't replace mock interviews, but it builds the vocabulary you'll need in one.
Where can I find interview prep for other roles?
Browse the full Interview exercises hub for 170+ modules covering behavioural, technical, and system design rounds across dozens of IT roles, or check the "Next up" link below to continue.
Do I need an account, and is my progress saved?
No account is needed. Progress is tracked only for your current visit — reloading or leaving the page resets the counter.
Who writes these interview questions?
Every question is written by the CoderSlingo team based on real technical interview patterns for this role, then reviewed for accuracy and clarity.