Practice for the HashiCorp Certified Terraform Associate 004 exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: By default, where does Terraform CLI store its state about the resources it is managing?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- By default, where does Terraform CLI store its state about the resources it is managing?
- Which Terraform variable type should you use to store key-value pairs such as environment-specific configurat…
- Your AWS configuration creates multiple subnets using for_each, and you need to launch an EC2 instance in a s…
- You have an existing Google Cloud Compute Engine instance with ID my-instance that was created manually. Now…
- A coworker gave you a Terraform configuration file containing the code snippet below. Where will Terraform do…
- Based on the code snippet below, what does the source argument indicate about where Terraform will find this…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. By default, where does Terraform CLI store its state about the resources it is managing?
Answer: A. in the terraform.tfstate file in the current working directory using the local backend
Terraform CLI defaults to the local backend, storing state in a file named terraform dot t f state in your current working directory. The dot terraform directory only holds plugins and modules, not the active state file.
Q2. Which Terraform variable type should you use to store key-value pairs such as environment-specific configuration settings?
Answer: C. use a map to satisfy this requirement
A map is the correct variable type for storing key-value pairs. Lists and arrays provide sequential indexed collections, whereas a string only holds a single text value.
Q3. Your AWS configuration creates multiple subnets using for_each, and you need to launch an EC2 instance in a specific subnet, as shown in the exhibit below. Which expression correctly references the private subnet's ID for your EC2 instance…
Answer: C. aws_subnet.app["private"].id
When a resource uses for_each with a map, Terraform creates a map of resources that you index by their string keys. Options relying on dot notation or numeric indexes fail because the resource is a map, not a list or object.
Q4. You have an existing Google Cloud Compute Engine instance with ID my-instance that was created manually. Now, you want to manage this resource using Terraform. How can you import the existing instance into your Terraform state using the co…
Answer: B. terraform import google_compute_instance.my_instance my-instance
The terraform import command maps existing infrastructure into your Terraform state. You must provide the resource address first, followed by the cloud provider's specific resource identifier, so apply and init are incorrect here.
Q5. A coworker gave you a Terraform configuration file containing the code snippet below. Where will Terraform download the referenced provider from? terraform { required_providers { kubernetes = { source = "hashicorp/kubernetes" version = "2…
Answer: B. the official Terraform public registry
Terraform resolves provider sources from the public registry by default, using the namespace and name as the address. It does not pull source code directly from GitHub or a local execution directory.
Q6. Based on the code snippet below, what does the source argument indicate about where Terraform will find this module? module "vm_deployment" { source = "./modules/vsphere_vm" datacenter = data.vsphere_datacenter.dc.name datastore = data.vsp…
Answer: C. in the modules subdirectory in the current working directory where Terraform is being executed
A module source starting with dot slash indicates a local path relative to your current working directory. This tells Terraform to read the module directly from your local file system instead of fetching it from a registry.
Q7. Which command correctly sets a Terraform input variable named user to the value dbadmin01 using an environment variable?
Answer: A. export TF_VAR_user=dbadmin01
Terraform automatically reads environment variables prefixed with TF underscore VAR to populate input variables. Generic variables or TF underscore INPUT prefixes do not map to variable definitions in your configuration.
Q8. You're creating a GCP configuration that requires creating a storage bucket first, then creating an IAM binding that grants access to it. The problem is that the IAM binding doesn't directly reference the bucket resource, so it's being cre…
Answer: A. add a depends_on = [google_storage_bucket.data] to the IAM binding resource block
Use the depends on argument inside the IAM binding resource to force Terraform to create the bucket first. Lifecycle blocks only manage resource replacement behavior, and splitting applies breaks infrastructure as code management.
Q9. In your Terraform configuration, you need to set a variable value based on another variable. If var.environment equals prod, you want to set the instance count to 5, otherwise set it to 2. Which expression correctly implements this logic?
Answer: D. instance_count = var.environment == "prod" ? 5 : 2
The conditional expression in Terraform uses the format condition question mark true value colon false value. The other options are invalid syntax because Terraform does not support if then else statements or a lookup function with four arguments.
Q10. Your team uses Terraform CLI to manage infrastructure that hosts multiple applications, and multiple team members need to make updates to these resources. What Terraform feature prevents conflicts when multiple team members attempt to modi…
Answer: B. state locking
State locking prevents concurrent modifications by ensuring only one user can update infrastructure at a given time. Version control tracks code changes but does not lock live infrastructure deployments, while local backends and provisioners serve entirely different operational purposes.
Q11. Your organization is using HCP Terraform with separate workspaces for networking and application infrastructure. You want the app-tier workspace to automatically start a new run whenever networking-vpc finishes a successful apply so downst…
Answer: B. run triggers between the two workspaces
Run triggers allow you to automatically start a new run in a downstream workspace whenever an upstream workspace successfully applies changes. Remote state data sources only read data passively, and run tasks execute external integrations rather than chaining workspace executions.
Q12. Your team of five engineers is building AWS infrastructure with Terraform. Currently, everyone works with the local backend and shares the terraform.tfstate file via Slack after making changes. What is the primary reason this workflow shou…
Answer: B. Remote backends provide state locking to prevent concurrent modifications and centralized storage for team collaboration.
Remote backends provide state locking and centralized storage, which are essential for safe team collaboration. The local backend can manage AWS resources, and state is always stored in JSON format regardless of the backend used.
Q13. What action does the command terraform init perform in a new working directory?
Answer: A. downloads plugins and retrieves the source code for referenced modules
The terraform init command initializes a working directory by downloading necessary provider plugins and retrieving the source code for referenced modules. Formatting, validation, and state comparisons are handled by the fmt, validate, and plan commands respectively.
Q14. You received a Terraform configuration file from your colleague, but you're having difficulty reading it because the parameters and blocks are misaligned. What command can you run to quickly align the configuration file and make it easier…
Answer: A. terraform fmt
The terraform fmt command automatically formats Terraform configuration files to canonical standards and alignments. The init command sets up the environment, while workspace and state commands manage multiple deployments and existing infrastructure mappings.
Q15. In Terraform, how are input variables scoped with respect to modules?
Answer: A. Variables are local to each module, and child modules can only access parent values when passed to them.
Input variables are scoped locally to each specific module and must be explicitly passed to child modules. Parent variables are never automatically visible to children, ensuring strict isolation and preventing unintended configuration overrides.
Q16. You moved an existing EC2 instance from aws_instance.web to module.servers.aws_instance.web as part of a refactoring project. Now terraform plan wants to destroy and recreate it. Which block should you add to prevent Terraform from recreat…
Answer: C. moved block
The moved block informs Terraform that a resource has changed its location within the configuration without altering the real infrastructure. This updates the state file safely to prevent Terraform from destroying and recreating the resource during the next apply.
Q17. Your team is developing Terraform configurations that require database passwords and API tokens. A developer suggests marking these values as sensitive in variable blocks to prevent them from being stored in state files. What is the behavi…
Answer: A. The sensitive argument redacts values from CLI output and the HCP Terraform UI, but still stores them in state and plan files.
Marking a variable or output as sensitive redacts its values from command line output and graphical user interfaces. However, it does not prevent the values from being stored in plain text within state and plan files, which still require secure backend protection.
Q18. Your team uses the AWS provider that is pinned to version = "6.0.0". The AWS provider is installed from the public Terraform Registry. A critical security patch is released in version 6.0.3. You update the version constraint to version = "…
Answer: C. The dependency lock file still references 6.0.0, and terraform init without the -upgrade flag respects the lock file.
The dependency lock file ensures consistent provider versions are used across environments by locking them to specific versions. To upgrade past a locked version, you must run terraform init with the upgrade flag, regardless of the version constraint updates.
Q19. You're developing a reusable Terraform module for your team. The module creates networking resources and accepts several input variables. Before publishing the module to your private registry, what's the best way to verify the module's con…
Answer: B. run terraform validate in the module directory after running terraform init
The terraform validate command checks syntax and configuration validity without contacting cloud APIs. You must run terraform init first to initialize the backend and download the necessary providers.
Q20. What does the version constraint ~> 3.0.0 mean in a provider requirement?
Answer: C. allow only patch releases within version 3.0.x, like 3.0.1 but not 3.1.0
The pessimistic constraint tilde 3.0.0 allows patch updates like 3.0.1 but blocks minor version upgrades like 3.1.0. This safely pulls bug fixes while avoiding breaking changes.
Q21. Your team uses a VCS-driven workflow in HCP Terraform. When a pull request is opened that includes Terraform changes, what happens automatically in HCP Terraform?
Answer: D. HCP Terraform runs a speculative plan and posts the results as a comment on the pull request
HCP Terraform automatically triggers a speculative plan during a pull request to preview changes. The results post directly to the pull request as a comment for review without modifying infrastructure.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.