Practice for the HashiCorp Certified Terraform Associate 004 exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: True or False? By default, the terraform destroy command will prompt the user for confirmation before proceeding.. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- True or False? By default, the terraform destroy command will prompt the user for confirmation before proceed…
- When assigning a value to a Terraform input variable through an environment variable, which prefix string is…
- A resource was changed manually outside of Terraform. You don't want to make any changes yet, but you want to…
- Why is using a single tool like Terraform for multi-cloud deployments more beneficial than using separate too…
- Your team is building a reusable Terraform module for web servers. The module must always create exactly two…
- You've decided to change your backend configuration from S3 to HCP Terraform. After updating the backend bloc…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. True or False? By default, the terraform destroy command will prompt the user for confirmation before proceeding.
Answer: A. True
The terraform destroy command requires interactive confirmation by default to prevent accidental infrastructure deletion. You can bypass this safety prompt using the dash dash auto-approve flag during automation workflows.
Q2. When assigning a value to a Terraform input variable through an environment variable, which prefix string is necessary?
Answer: B. TF_VAR_
Environment variables intended to set Terraform inputs must use the TF_VAR_ prefix followed by the variable name. The other prefixes are invalid because Terraform strictly matches this specific pattern when populating the root module variables.
Q3. A resource was changed manually outside of Terraform. You don't want to make any changes yet, but you want to see how the state would be updated to match the current real-world values. Which command should you run?
Answer: C. terraform plan -refresh-only
The plan with refresh-only flag updates state to match current real-world values without proposing infrastructure changes. Apply would attempt to modify infrastructure, which violates the requirement.
Q4. Why is using a single tool like Terraform for multi-cloud deployments more beneficial than using separate tools and workflows for each cloud?
Answer: D. It provides a common workflow and reusable modules, enabling consistent CI/CD and policy across clouds.
A single declarative tool provides a standard workflow using reusable modules across different providers. Do not assume it eliminates cloud-specific APIs or credentials; it simply standardizes the deployment process.
Q5. Your team is building a reusable Terraform module for web servers. The module must always create exactly two instances, and you want Terraform to fail if a caller tries to use any other value during plan or apply. Which approach should you…
Answer: B. Add a validation block that checks the variable equals 2 and provides an error message if it does not.
A variable validation block actively enforces business logic by failing the plan if the input does not equal two. Simply setting a default value does not prevent users from overriding it.
Q6. You've decided to change your backend configuration from S3 to HCP Terraform. After updating the backend block, you run terraform init. Which flag should you use to reconfigure the backend without copying the existing state?
Answer: C. terraform init -reconfigure
The -reconfigure flag forces Terraform to ignore the previous backend configuration and prevents any automatic state migration. Use -migrate-state instead if you actually want to copy state.
Q7. You are calling a child module named network from your root module. In your root module, you attempt to reference the VPC ID as displayed below. When you run terraform plan, Terraform returns an error that vpc_id is not a valid attribute f…
Answer: D. The network module did not define an output block that exports the VPC ID, resulting in the error.
Child module resources are hidden from the parent unless an output block explicitly exports them. The other options are invalid because module outputs are referenceable during plan and require no data blocks or root variables.
Q8. You are performing a code review of a colleague's Terraform code and see the following code. Where is this module stored? module "vault-aws-tgw" { source = "terraform-aws-modules/transit-gateway/aws" version = "3.0.3" client_id = var.bk_cl…
Answer: B. the Terraform public registry
Using a source string with the namespace, name, and provider format points directly to the public Terraform Registry. The other options are incorrect because local paths use absolute or relative file references, not slash-separated registry identifiers.
Q9. Your colleague provided the code snippet below and is looking for assistance in identifying the implicit dependency. What is the implicit dependency in this code? resource "aws_eip" "public_ip" { vpc = true instance = aws_instance.web_serv…
Answer: A. The EC2 instance labeled web_server
Referencing an attribute from another resource creates an implicit dependency that Terraform automatically resolves in the graph. The S3 bucket is an explicit dependency created by the depends_on argument, not an implicit one.
Q10. Which statement best describes a Terraform data source?
Answer: A. a read-only construct that queries provider APIs and returns attributes for use elsewhere in the configuration
A data source is a read-only construct that queries provider APIs to fetch existing infrastructure attributes for use elsewhere. It does not create resources, persist variables, or cache values between runs.
Q11. You have a variable containing subnet CIDR blocks as a list: ["10.0.5.0/24", "10.0.0.0/24", "10.0.2.0/24"]. You need to determine how many subnets are in the list to use. Which function returns the number of elements?
Answer: A. length(var.subnet_cidrs)
The length function returns the total number of elements contained within a given list or string. The contains function checks for a specific value, while keys and values target map objects rather than simple lists.
Q12. You have split a large module into multiple .tf files and rearranged several resource blocks without changing any arguments or references. What impact should this have when running a terraform plan?
Answer: A. No changes. Block order doesn't affect the plan because Terraform parses all .tf files in a module together during execution.
Terraform parses all configuration files within a module together, making resource block order completely irrelevant to the execution plan. Distractors suggesting replacements or minor changes confuse Terraform with imperative scripting languages.
Q13. What sets Infrastructure as Code (IaC) apart from managing infrastructure directly instead of making raw API calls or executing CLI commands?
Answer: A. Terraform uses declarative configuration to describe the desired end state and generates a plan of action before applying changes.
Infrastructure as Code relies on declarative configuration to describe the desired end state rather than imperative step-by-step logic. Terraform does not automatically update resources later without an explicit apply process.
Q14. In Terraform, what does "drift" mean in the context of a workspace's state?
Answer: B. Real infrastructure has changed outside Terraform and no longer matches the desired state.
Drift means real infrastructure has changed outside Terraform and no longer matches the desired state. The other options describe pure configuration or backend changes, which do not represent infrastructure drift.
Q15. Which feature of HCP Terraform enables you to publish and maintain a set of custom modules that can only be used within your organization?
Answer: B. HCP Terraform private registry
The private registry allows you to securely publish and maintain custom modules restricted to your organization. Public registry modules are visible to everyone, and VCS integrations only link source code.
Q16. You are using a local backend and accidentally delete the terraform.tfstate file for your workspace. What is the most serious consequence?
Answer: C. Terraform can no longer track the resources it manages, so the next plan or apply might attempt to create duplicate resources.
Deleting local state severs Terraform's tracking of managed resources, causing the next apply to attempt creating duplicates. Terraform cannot magically reconstruct state from variables or provider APIs.
Q17. In HCP Terraform, what is the purpose of using a run trigger?
Answer: C. to automatically queue a new run in one workspace after another workspace applies successfully
Run triggers automatically queue a workspace run immediately after another specified workspace applies successfully. They orchestrate dependencies between workspaces, whereas credentials or approvals use different features.
Q18. You are reviewing Terraform code from a colleague and discover a `.terraform/` directory. What is the purpose of this directory?
Answer: D. The .terraform/ directory stores Terraform's local working data, including installed provider and module plugins and backend metadata.
This directory stores local working data like installed provider and module plugins plus backend metadata. Terraform downloads these during initialization, whereas sensitive state and credentials are stored elsewhere.
Q19. You're deploying AWS infrastructure and writing the configuration as shown below. What does the reference `aws_vpc.main.id` in the subnet configuration accomplish? resource "aws_vpc" "main" { cidr_block = "10.5.0.0/16" tags = { Name = "pro…
Answer: B. it retrieves the VPC's ID and creates an implicit dependency
Referencing the VPC resource retrieves its ID and creates an implicit dependency, ensuring correct creation order. Terraform handles resource dependencies automatically through these references instead of manual ordering.
Q20. You're invoking a module that creates a subnet. The root load balancer module requires that subnet's ID. How should you expose the ID and pass it to the load balancer module? modules/subnets: resource "aws_subnet" "bk" { vpc_id = aws_vpc.b…
Answer: D. add an output block to the subnet module and pass the value for the load balancer module using module.subnets.subnet_id
You must add an output block in the child module to expose the subnet ID, then reference it in the root module. Resources created inside a module are hidden from the root configuration unless explicitly exported as outputs.
Q21. Your team uses HCP Terraform with a CLI-driven workflow. After making changes to your configuration locally, you run terraform plan. Where does the plan operation execute?
Answer: D. on HCP Terraform infrastructure with results streamed back to your terminal
In a CLI-driven workflow, plan operations execute remotely on HashiCorp infrastructure with results streamed to your terminal. Local execution is bypassed entirely to ensure consistent runs and enable collaboration features.
Q22. True or False? In the configuration below, the aws_volume_attachment.attach_data resource has an implicit dependency on both the instance and the volume. resource "aws_instance" "app_core" { ami = "ami-0c55b159cbfafe1f0" instance_type = "t…
Answer: B. True
Referencing resource attributes creates implicit dependencies that dictate execution order. The attachment block references both the volume and instance identifiers, so Terraform automatically waits for them.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.