Practice for the HashiCorp Certified Terraform Associate 004 exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization requires that no security group within your public cloud environment should list 0.0.0.0/0 as a source. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- Your organization requires that no security group within your public cloud environment should list 0.0.0.0/0…
- You're creating an Azure VM that needs to be placed in an existing Virtual Network that was created outside o…
- You're reviewing a colleague's Terraform configuration for a VMware vSphere deployment and notice the formatt…
- You have a Terraform configuration file with no defined resources. However, there is a related state file for…
- You manage a Kubernetes cluster with Terraform that includes many different deployments, services, and variou…
- True or False? After modifying the backend configuration in your terraform block (such as changing the S3 buc…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization requires that no security group within your public cloud environment should list 0.0.0.0/0 as a source of network traffic. How can you proactively enforce this policy and block the execution of Terraform configurations co…
Answer: D. Create a Sentinel or OPA policy that checks for the string and denies the terraform apply if the string exists.
Sentinel and Open Policy Agent integrate with Terraform to enforce custom governance rules. These policy-as-code tools evaluate configurations before apply and actively block execution if a restricted string is detected.
Q2. You're creating an Azure VM that needs to be placed in an existing Virtual Network that was created outside of Terraform. You've added a data source to query it. Which expression below can be used to reference the VNet ID for use in your V…
Answer: B. data.azurerm_virtual_network.existing.id
Data sources retrieve information about existing infrastructure using the data prefix. You access their exported attributes the same way you do for managed resources by appending the desired attribute to the reference.
Q3. You're reviewing a colleague's Terraform configuration for a VMware vSphere deployment and notice the formatting is inconsistent. You decide to run `terraform fmt` on this file. What changes will the command make? “`hcl resource "vsphere_…
Answer: C. it will align the equals signs and fix indentation to follow Terraform style conventions
The formatting command applies canonical Terraform style and conventions. It adjusts spacing by aligning the equals signs and fixes indentation, but it never evaluates logic or adds missing arguments.
Q4. You have a Terraform configuration file with no defined resources. However, there is a related state file for resources that were created on AWS. What happens when you run a `terraform apply`?
Answer: C. Terraform will destroy all of the resources
Terraform reconciles your state file with the active configuration to determine desired infrastructure state. If a resource exists in state but is absent from the configuration, Terraform assumes you intended to delete it.
Q5. You manage a Kubernetes cluster with Terraform that includes many different deployments, services, and various configmaps. Your team decides to migrate to a new cluster, and you need to completely tear down the old cluster. After running `…
Answer: B. The state file remains, but no longer contains any resources
The destroy command removes all real world infrastructure tracked by the configuration. While those resources vanish from state, the state file itself is safely retained by Terraform and is left completely empty.
Q6. True or False? After modifying the backend configuration in your terraform block (such as changing the S3 bucket name), you must run `terraform init` again for the changes to take effect.
Answer: A. True
The initialization command is responsible for preparing the working directory and configuring the backend. Whenever backend settings change, you must run init again so Terraform migrates state to the new target.
Q7. You are refactoring your Terraform configuration and want to rename your resources to adhere to a new naming standard. How can you update the Terraform state to reflect the new names without affecting the resources themselves?
Answer: D. use a moved block to indicate that the resource has been relocated to the new resource block
A moved block declaratively tells Terraform that a resource has a new address. During the next plan, Terraform updates the state to reflect the new name without destroying or recreating the underlying infrastructure.
Q8. Which of the following commands can be used to detect configuration drift?
Answer: C. terraform plan -refresh-only
The command terraform plan -refresh-only detects configuration drift by refreshing the state without staging changes. Other commands like init or fmt do not compare state against real-world infrastructure.
Q9. Your team wants to use HashiCorp Vault to manage database credentials for Terraform-managed resources. You need Terraform to authenticate to Vault and retrieve secrets dynamically. What is required in your Terraform configuration to enable…
Answer: A. configure the Vault provider with credentials and use Vault data sources to retrieve secrets
Configuring the Vault provider with credentials and using its data sources lets Terraform securely retrieve dynamic secrets. Hardcoding tokens in variables or tfvars files violates security best practices and is not the intended provider integration.
Q10. You have three S3 buckets that were manually created with names app-data-dev, app-data-staging, and app-data-prod. You want to manage them in Terraform using a single resource block with for_each as shown in the exhibit below. How should y…
Answer: B. Create a single import block with for_each = toset(["dev", "staging", "prod"]), to = aws_s3_bucket.app_data[each.key], and id = "app-data-${each.key}
A single import block can use for_each to import multiple resources into a for_each resource block. The target must reference the specific instance using the each key, and the id must uniquely identify the real-world object.
Q11. You need to define a variable that contains subnet configuration data, including an IP address (string) and a subnet mask (number). What type of variable should you use?
Answer: C. type = object()
Using an object type variable allows you to define a structured input containing multiple attributes of different types. Simple types like string or bool cannot group related fields together.
Q12. You have a Kubernetes deployment managed by Terraform. You need to replace a specific pod deployment because a critical security patch requires recreating resources, but you want to keep all other resources unchanged. Your configuration is…
Answer: C. terraform apply -replace=kubernetes_deployment.api
The terraform apply command with the replace flag forces Terraform to taint and recreate a specific resource. Using the target flag would only limit the scope of the operation, whereas replace explicitly destroys and recreates the chosen deployment without affecting others.
Q13. You want to use an AWS VPC module from the public registry, but ensure you only accept patch updates automatically, never minor or major version updates. Your current version is 5.1.2. Which version should you add to the module block to me…
Answer: D. version = "~> 5.1.2"
The pessimistic constraint operator allows the rightmost specified version segment to increment. Specifying the version as five dot one dot two permits patch updates like five dot one dot three, but prevents minor updates to five dot two dot zero.
Q14. You enabled verbose logging to troubleshoot an issue. After resolving the problem, what should you do to disable Terraform logging for subsequent operations?
Answer: A. unset the TF_LOG environment variable
Unsetting the TF_LOG environment variable is the correct way to disable Terraform logging for subsequent operations. Removing the environment variable causes Terraform to revert to its default behavior, whereas setting it to OFF or NONE are invalid values.
Q15. You have run terraform apply, and midway through provisioning resources, your network connection drops, and the command fails. When connectivity is restored, you run terraform plan to assess the status of the infrastructure. What will the…
Answer: D. only the resources that failed to create or were not yet attempted will show as needing to be created
Terraform updates the state file incrementally as resources are successfully provisioned during an apply operation. A dropped connection triggers a partial failure, so the subsequent plan only shows the incomplete or unattempted resources instead of recreating the successfully deployed ones.
Q16. What type of dependency does the depends_on argument create? resource "aws_instance" "eCommerce" { ami = "ami-3256b422" instance_type = "m6a.large" depends_on = [aws_s3_bucket.customer_data] }
Answer: C. explicit dependency
The depends_on argument creates an explicit dependency between resources. Terraform builds implicit dependencies automatically from expressions, but depends_on manually forces the order of operations.
Q17. Which of the following best describes the default local backend in Terraform?
Answer: C. Terraform stores state in a file named terraform.tfstate in the current working directory and uses system APIs for state locking
The default local backend stores state in a local file named terraform dot tfstate within the current working directory. It uses system APIs for state locking to prevent concurrent operations from corrupting the state.
Q18. When running Terraform, you are confused about the source of certain values used within a resource. How can you enable more logging to help with troubleshooting?
Answer: B. Set the environment variable TF_LOG=TRACE in your shell environment.
Setting the TF_LOG environment variable to TRACE provides highly detailed output for troubleshooting. The log path variable only dictates where logs are written, so setting TRACE is required to actually increase verbosity.
Q19. You are adding a new resource block and notice it doesn't specify a provider argument. How does Terraform determine which provider configuration to use?
Answer: A. Terraform selects the provider configuration with a matching type in the same module.
Terraform automatically infers the correct provider configuration by matching the resource type prefix in the same module. Explicit provider arguments are only required when using multiple configurations of the same provider, such as targeting different regions.
Q20. You have a list variable var.vm_ids containing three VM IDs. You need to access the second VM ID in the list. Which expression retrieves this value?
Answer: A. image = var.vm_ids[1]
Terraform list indices are zero-based, so index one accesses the second element in a list. Option D uses index two, which would incorrectly retrieve the third item in your list of virtual machine identifiers.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.