Practice for the HashiCorp Certified Terraform Associate 004 exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: True or False? Under special circumstances, Terraform can be used without state when deploying and managing resources.. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- True or False? Under special circumstances, Terraform can be used without state when deploying and managing r…
- What is the recommended approach for letting teams across your organization securely consume a shared Terrafo…
- You're building a Google Cloud Platform infrastructure and write the following configuration shown in the exh…
- Your child module creates an Azure storage account and defines this output as shown in the exhibit below. out…
- You have decided to use a module from the Terraform registry to deploy resources on your private cloud. What…
- A child module creates a new subnet. Which Terraform block should you define in the child so the root module…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. True or False? Under special circumstances, Terraform can be used without state when deploying and managing resources.
Answer: A. False
Terraform always requires a state file to map configuration to real-world resources and track metadata. Even for simple deployments, state is generated automatically to maintain dependencies and track attributes.
Q2. What is the recommended approach for letting teams across your organization securely consume a shared Terraform state?
Answer: C. configure a remote backend that supports locking and access control
Remote backends are the recommended way to share state because they provide state locking and support access controls. Committing state to version control is a security risk, and local files cannot be safely shared.
Q3. You're building a Google Cloud Platform infrastructure and write the following configuration shown in the exhibit below. What will happen when you run terraform apply? data "google_compute_network" "shared" { name = "bk-company-network" }…
Answer: C. Terraform will create the subnet in the existing shared network without modifying the network itself
A data block reads information from an existing resource without managing it. Terraform will create the subnetwork but will leave the existing network completely unmodified.
Q4. Your child module creates an Azure storage account and defines this output as shown in the exhibit below. output "storage_account_name" { value = azurerm_storage_account.data.name } In your root module, you call this module as shown below…
Answer: C. module.storage.storage_account_name
To access values from a child module in the root module, use the syntax module dot module name dot output name. Var is strictly for input variables, while outputs is not a valid attribute.
Q5. You have decided to use a module from the Terraform registry to deploy resources on your private cloud. What parameter should you include to prevent unexpected issues if the module gets updated?
Answer: B. version
Specifying the version argument constrains the module to a known release, preventing unexpected breaking changes. Without it, Terraform might pull the latest version and alter your infrastructure unexpectedly.
Q6. A child module creates a new subnet. Which Terraform block should you define in the child so the root module can read the subnet ID?
Answer: D. output block
An output block exports values from a child module so the parent module can reference them. Data blocks are only for reading existing resources, and resource blocks do not inherently expose attributes.
Q7. True or False? For each unique platform you create resources on, Terraform requires the use of a different provider/plugin.
Answer: B. True
Terraform uses specific providers to interact with each unique platform via its API. Because each cloud or service has distinct endpoints, you must install the appropriate provider plugin for every platform you manage.
Q8. You are currently using version 4.50.0 of the azurerm provider. You need to provision a few resources that are supported with the latest provider version, so you add the resource blocks and update the required_providers block to version =…
Answer: B. Terraform shows an error and requires you to run the command terraform init -upgrade
The lock file pins the provider version, so running plan will fail until you update it. To download the new version and update the lock file, you must run terraform init with the upgrade flag.
Q9. After many hours of development, you've created a new Terraform configuration from scratch, and now you want to test it. Before provisioning the resources, what is the first command you should run?
Answer: D. terraform init
The core Terraform workflow begins with init to initialize the directory and download required providers. You cannot run plan or apply successfully until this initialization step downloads the necessary plugins.
Q10. You have declared the variable as shown below. How should you reference this variable throughout your configuration? variable "aws_region" { type = string description = "region used to deploy workloads" default = "us-east-1" validation { c…
Answer: B. var.aws_region
Input variables are referenced using the var prefix. Distractors using variable fail because that block defines a variable but does not access its value at runtime.
Q11. True or False? HCP Terraform drift detection can automatically fix detected drift by running terraform apply to bring infrastructure back into compliance with your configuration.
Answer: A. False
HCP Terraform drift detection identifies differences between actual infrastructure and desired configuration, but it cannot automatically fix the detected drift. Users must manually review the drift report and apply necessary changes.
Q12. In HCP Terraform, what does it mean to run Terraform as a remote operation?
Answer: C. Terraform runs are managed and executed on HCP Terraform infrastructure
Remote operations in HCP Terraform execute runs on managed infrastructure rather than your local machine. This centralizes execution, providing consistent logs and controlled access to state and secrets.
Q13. Your organization's Terraform configuration requires AWS access keys to provision infrastructure. The team is concerned about security best practices for managing these credentials. Which approach follows Terraform best practices for manag…
Answer: A. Store credentials in an external secrets manager such as HashiCorp Vault and reference them in Terraform using data sources.
Best practice is to retrieve sensitive credentials from an external secrets manager like HashiCorp Vault. Hardcoding secrets or merely ignoring tfvars files is insecure because variables are still exposed in state files.
Q14. Your team is evaluating Infrastructure as Code (IaC). Which of the following statements is inaccurate regarding the benefits of IaC?
Answer: D. eliminates API communication to the target platform
Infrastructure as Code tools rely entirely on API communication to provision and manage resources. Distractors mentioning self-documenting infrastructure, code sharing, and versioning are all valid benefits.
Q15. What command can be used to display the resources that are being managed by Terraform?
Answer: D. terraform show
The terraform show command provides a human-readable output of the current state or a plan file. This allows you to inspect managed resources and their attributes directly from the CLI.
Q16. A team member ran terraform apply and the operation was interrupted (their laptop crashed), and the state lock wasn't released. Other team members can't run Terraform commands because they get a "state is locked" error. What command should…
Answer: C. use the command terraform force-unlock <lock-id> to manually release the stuck lock
The terraform force-unlock command manually releases a stuck state lock using the specific lock ID. Deleting the state file or bypassing the lock introduces severe data corruption risks.
Q17. True or False? Enabling Terraform logging with TF_LOG will cause Terraform to skip the plan phase and apply changes directly to reduce the amount of logged information.
Answer: B. False
Enabling TF_LOG strictly adjusts verbosity for troubleshooting without altering workflow phases. Terraform safely maintains its standard initialization, planning, and applying execution steps.
Q18. Your organization manages dozens of HCP Terraform workspaces used by different teams. You have been asked to simplify the structure, improve access controls, and group related infrastructure by function. How can you organize these workspac…
Answer: B. place each team-related workspace into a team project
HCP Terraform projects let you group related workspaces to simplify organization and manage team access. Creating multiple organizations is excessive for a single company, while tags and variable sets do not enforce access controls.
Q19. Your teammate runs terraform plan and shares the output showing 15 resources to be created. You review it and approve the changes. However, before applying, your teammate runs terraform plan again. What will happen?
Answer: A. Terraform will generate a new plan that may differ from the first one if any state or configuration changes occurred
Running terraform plan always evaluates the current configuration and state, generating a fresh plan. A previously saved plan file is not automatically reused unless explicitly passed to apply, so any external changes will yield a new plan.
Q20. You are managing multiple resources using Terraform. You want to destroy all the resources except for a single web server, which should remain running but no longer be managed by Terraform. How can you accomplish this?
Answer: B. Add a removed block with from = <address> to stop managing the web server, then run terraform apply followed by terraform destroy
The removed block is the correct way to safely stop managing a resource without destroying it, allowing you to subsequently destroy the rest of the stack. Distractors involving prevent_destroy or -target either fail the destroy step or require complex targeting.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.