Practice for the HashiCorp Certified Terraform Associate 004 exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your team's change management process requires that all Terraform changes be reviewed and approved before execution. You. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- Your team's change management process requires that all Terraform changes be reviewed and approved before exe…
- How do you specify which provider Terraform should install for a configuration?
- You added a new module block to an existing Terraform configuration to reuse infrastructure code from a remot…
- In a Terraform module block that sources a module from a registry, why should you include the version argumen…
- Which of the following statements is the most accurate about the Terraform language?
- After creating several new Terraform configurations, you want to quickly format the files without editing eac…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your team's change management process requires that all Terraform changes be reviewed and approved before execution. You run terraform plan -out=bk-project.tfplan and send the output for review. After approval is granted two hours later, w…
Answer: C. run terraform apply bk-project.tfplan to execute the saved plan
Applying a saved plan file executes the exact changes that were reviewed and approved. Without a plan file, Terraform recalculates the diff, bypassing your change management process.
Q2. How do you specify which provider Terraform should install for a configuration?
Answer: B. Define the provider in required_providers and add a matching provider block in the configuration.
The required_providers block specifies source addresses and versions for providers. Terraform downloads them during initialization, whereas manual binary placement is unsupported.
Q3. You added a new module block to an existing Terraform configuration to reuse infrastructure code from a remote source. What do you need to do so that Terraform downloads the module and makes it available in your working directory?
Answer: B. Run terraform init to install the module into the current working directory.
Running initialization downloads modules from their configured sources and caches them locally. Terraform never downloads modules automatically during a plan.
Q4. In a Terraform module block that sources a module from a registry, why should you include the version argument?
Answer: A. to pin a specific module release and avoid unexpected upgrades
Pinning the version prevents unexpected breaking changes when module authors publish new releases. This argument constrains the module code, not the Terraform CLI or provider versions.
Q5. Which of the following statements is the most accurate about the Terraform language?
Answer: D. Terraform is an immutable, declarative Infrastructure as Code language based on HashiCorp Configuration Language or JSON.
Terraform uses a declarative syntax where you define the desired end state. Distractors mentioning imperative or mutable workflows describe traditional configuration management tools.
Q6. After creating several new Terraform configurations, you want to quickly format the files without editing each one manually. How can you update all the files at once?
Answer: C. terraform fmt
The formatting command rewrites configuration files to canonical style in a single pass. Validation checks syntax, while initialization downloads plugins.
Q7. Aside from traditional code reviews, which Terraform command provides an opportunity for team members to review each other's work before deployment?
Answer: A. terraform plan
The plan command generates an execution plan showing proposed changes before deployment. This allows teams to catch errors before any infrastructure is modified.
Q8. Why is state locking necessary when using a remote backend?
Answer: D. prevents concurrent runs from writing to the same state at the same time to avoid state corruption.
State locking prevents concurrent operations from corrupting the state file. It ensures serial execution, while caching and encryption are separate backend features.
Q9. What environment variable can be set to enable detailed logging for Terraform?
Answer: C. TF_LOG
Setting the log environment variable activates verbose output for troubleshooting. The other variables are not recognized by Terraform for this purpose.
Q10. Your configuration includes a validation block in a variable, as shown in the exhibit below. A user sets instance_count = 15. When does Terraform report the validation error? variable "instance_count" { type = number validation { condition…
Answer: C. During terraform validate or terraform plan, before attempting to create any resources
Variable validation blocks are evaluated during the planning phase to ensure that assigned values meet the configured conditions before any changes are applied. The initialization command only downloads providers and modules, so validation errors are correctly reported during validation or planning commands.
Q11. What is the purpose of Terraform's dependency graph?
Answer: C. builds a graph of dependencies to perform create/update/destroy operations from it
Terraform builds a dependency graph to determine the correct order of operations for creating, updating, and destroying resources. The configuration does not execute resources based on file ordering, nor does it rely on cloud provider APIs to manage dependencies during a run.
Q12. Which Terraform command checks modules, attribute names, and value types to ensure the configuration is syntactically valid and internally consistent?
Answer: C. terraform validate
The terraform validate command checks general syntax and internal consistency without accessing cloud APIs. Avoid confusing it with terraform fmt, which only rewrites files to canonical formatting.
Q13. You run terraform init in a new working directory. The output shows Terraform downloading the aws and time provider plugins. On this machine, where does Terraform store those provider plugins?
Answer: B. The .terraform/providers directory in the current working directory
Terraform stores downloaded provider plugins in the hidden .terraform/providers directory inside your current working directory. This local cache keeps dependencies isolated to your specific workspace.
Q14. Some of your production resources were created manually in the Azure portal. The company requires all production resources to be managed through Terraform. What should you do to bring those existing resources under Terraform management wit…
Answer: D. Use the import block to import the existing resources under Terraform management.
The import block safely brings manually created cloud resources into Terraform state without causing downtime. Manually deleting or recreating them violates the requirement to avoid disruption.
Q15. You configure two aws providers in the same module, as shown below, and Terraform returns Error: Duplicate provider configuration and says to set an additional argument for alternative configurations. Which argument must you add to the sec…
Answer: B. alias
The alias meta-argument is required to define multiple configurations for the same provider within a module. Without alias, Terraform throws a duplicate provider configuration error.
Q16. You added resources from a new provider to an existing configuration, and the next terraform plan returns an error about that provider. What should you do first?
Answer: D. Run terraform init so Terraform downloads the plugin for the newly added provider.
Running terraform init downloads the necessary plugins whenever new providers are added to a configuration. Plan will fail until initialization completes because the local binaries are missing.
Q17. You have a Terraform project with multiple subdirectories: /dev, /staging, and /prod. Each directory contains a separate Terraform configuration for each different environment. Before deploying resources, where do you need to run terraform…
Answer: C. In each directory (/dev, /staging, and /prod) since each is a separate working directory.
Terraform initializes the current working directory, so you must run terraform init inside each environment directory separately. Initialization cannot cascade automatically across subdirectories.
Q18. You have configured a workspace in HCP Terraform to use local execution. In this mode, what does HCP Terraform do?
Answer: C. HCP Terraform only stores and syncs the workspace's state file, while you run plan and apply locally on your own machine.
Local execution mode restricts HCP Terraform to only storing and syncing the workspace state file. Plan and apply operations execute locally on your machine, eliminating remote execution while preserving remote state management.
Q19. In the following Terraform code, what do name, cidr, and azs represent, and what purpose do they serve? module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "5.0.2" name = var.vpc_name cidr = var.vpc_cidr_block azs = var.vpc_a…
Answer: D. these are module-specific inputs that are passed into the child module used for resource creation
These arguments are module-specific inputs passed into the child module for resource creation. Variables declared inside the child module must be set by the calling root module, whereas outputs flow outward.
Q20. You're using a module from the Terraform registry for your infrastructure. When defining the configuration, is it necessary to specify a version argument in the module block?
Answer: C. No, the version argument is optional, but it is recommended to ensure consistent and reproducible deployments
The version argument in a module block is optional, though specifying it is strongly recommended to guarantee consistent and reproducible deployments. Without a version constraint, Terraform defaults to the latest available version, which introduces the risk of unexpected infrastructure changes when the module is updated.
Q21. Your organization manages a Google Cloud project with 50 resources across multiple services. You need to decommission only the Cloud SQL database instance and its backup policy while keeping all other infrastructure running. What is the mo…
Answer: B. Remove the database and backup resource blocks from your configuration, then run terraform apply.
The most standard method to decommission resources is removing their blocks and running terraform apply. However, the removed block feature is also a valid option, making this question slightly ambiguous.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.