Practice for the HashiCorp Certified Terraform Associate 004 exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which Terraform command will force a resource to be destroyed and recreated even if there are no configuration changes t. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- Which Terraform command will force a resource to be destroyed and recreated even if there are no configuratio…
- Management wants to understand how adopting Infrastructure as Code with Terraform differs from your current m…
- What is preventing you from producing a plan based on the error below? $ terraform plan Planning failed. Terr…
- You have a SQL Database that's currently in production with live data. You need to change the database's pric…
- You are troubleshooting an issue where Terraform is modifying certain resource attributes during apply operat…
- Your team wants to enforce consistent formatting across all Terraform files before merging code into the main…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which Terraform command will force a resource to be destroyed and recreated even if there are no configuration changes that would require it?
Answer: C. terraform apply -replace=<address>
The terraform apply dash replace command targets a specific resource address and forces Terraform to destroy and recreate it. The dash refresh dash only flag only syncs state with reality, and standard apply commands will ignore resources lacking configuration drift.
Q2. Management wants to understand how adopting Infrastructure as Code with Terraform differs from your current method of using the console and CLI to deploy and manage infrastructure. Which statement correctly identifies a major difference?
Answer: C. Infrastructure as Code allows infrastructure to be described using a configuration syntax that can be versioned, reused, and shared.
Infrastructure as Code uses declarative configuration files that can be versioned, shared, and reused. Manual approaches lack this repeatable structure, and Terraform still relies on cloud APIs to provision resources.
Q3. What is preventing you from producing a plan based on the error below? $ terraform plan Planning failed. Terraform encountered an error while generating this plan. ╷ │ Error: Invalid value for variable │ │ on variables.tf line 7: │ 7: vari…
Answer: D. A validation block on cluster_endpoint requires a non-empty value when create_cluster=false, so input evaluation failed and Terraform cannot produce a plan.
Custom variable validation rules evaluate before the execution plan is generated. If an input fails a validation condition, Terraform stops immediately, distinguishing this from a resource precondition which evaluates later.
Q4. You have a SQL Database that's currently in production with live data. You need to change the database's pricing tier, but the change requires destroying and recreating the database. You want to ensure the new database is created before th…
Answer: A. add a lifecycle block with create_before_destroy = true
Setting create_before_destroy to true inside a lifecycle block forces Terraform to provision the replacement resource first. This avoids downtime, whereas prevent_destroy would block the required recreation entirely.
Q5. You are troubleshooting an issue where Terraform is modifying certain resource attributes during apply operations that you didn't expect. You suspect the provider is interpreting your configuration differently than expected. What is the pr…
Answer: A. Logging will show you the detailed interactions between Terraform and the provider API and help you identify where the unexpected behavior occurs
Enabling debug logging exposes the detailed API requests and responses between Terraform and the provider. This reveals how the provider interprets configuration, whereas logs cannot fix syntax or back up state automatically.
Q6. Your team wants to enforce consistent formatting across all Terraform files before merging code into the main branch. You're setting up a CI/CD pipeline and need a command that checks whether files are properly formatted without making cha…
Answer: C. terraform fmt -check
The terraform fmt -check command tests whether files are properly formatted without modifying them. The -diff option shows proposed changes, but only -check exits with an error code for CI pipelines when formatting is incorrect.
Q7. Which of the following is considered a Terraform plugin?
Answer: D. provider
Terraform providers act as plugins that interact with external APIs to manage infrastructure resources. Modules, backends, and variables are configuration components but do not serve as the executable plugins required for provisioning.
Q8. Bryan is drafting new Terraform code and wants to verify that the configuration is syntactically valid and internally consistent without contacting any remote services. Which command should he run?
Answer: B. terraform validate
The terraform validate command checks if your configuration is syntactically valid and internally consistent without accessing remote services. The fmt command only formats code, while apply modifies real infrastructure.
Q9. Your organization wants to ensure that third-party security scanning tools can review Terraform plans before any infrastructure changes are applied. Which HCP Terraform feature allows you to integrate external tools into the workflow betwe…
Answer: A. run tasks
HCP Terraform run tasks integrate external tools like security scanners between the plan and apply phases. Run triggers simply chain workspaces together, and health assessments evaluate infrastructure against specific policies.
Q10. You're moving a project to a remote backend so the state is stored in Amazon S3. How do you correctly configure and initialize the backend?
Answer: B. Define the S3 backend in the terraform block using a backend block – run terraform init to migrate your local state.
Configuring the S3 backend inside the terraform block and running terraform init automatically migrates local state to the remote bucket. The init command sets up backends, whereas variables cannot be used in backend configurations.
Q11. You're deploying a GCP Compute Engine instance and want to verify that the instance receives a public IP address after creation. If it doesn't, you want Terraform to fail with an error. Which validation mechanism should you use?
Answer: D. add a postcondition in the lifecycle block of the instance resource
Postconditions are evaluated after a resource is created or updated, making them ideal for verifying expected attributes like a public IP address. Preconditions are evaluated before the resource action, while check blocks and generic validation blocks do not operate within the resource lifecycle.
Q12. In an expression, how do you correctly reference the build-tag value from the variable declaration below? variable "metadata" { type = map(string) default = { owner = "platform" build-tag = "v5.0.2" service = "billing" } }
Answer: B. var.metadata["build-tag"]
Map elements whose keys contain hyphens must be accessed using bracket notation with quoted strings. The dot syntax is reserved for valid identifiers, making option B the correct choice.
Q13. What is the .terraform.lock.hcl file and when does Terraform create or modify it?
Answer: B. The .terraform.lock.hcl file is a dependency lock file used by Terraform. It is created or updated every time you run terraform init.
The .terraform.lock.hcl file is a dependency lock file that ensures consistent provider versions across your team. Terraform creates or updates this file automatically whenever you run the terraform init command.
Q14. You have an existing Google Cloud Storage bucket that was created manually. You want to bring it under Terraform management using a modern config-driven approach, so you add the following configuration: import { to = google_storage_bucket…
Answer: D. run terraform plan followed by terraform apply to import the resource
The modern config-driven approach uses import blocks to declaratively manage existing resources. After adding the block, you run terraform plan to preview the import, followed by terraform apply to execute it.
Q15. A module creates VMs with the vSphere provider. It includes arguments such as datastore = "DS1", network_label = "VM Network", and a folder = "Dev/Apps". You need the same module to work in Lab, QA, and Prod vCenter environments without co…
Answer: D. Convert the hard-coded values to input variables and provide environment-specific settings via tfvars or variable sets at plan/apply.
Input variables allow you to parameterize a module so it can be reused across different environments without altering the source code. You then provide environment-specific values using variable definitions files or variable sets.
Q16. After executing a terraform plan in your working directory, you notice that a resource has a tilde (~) next to it. What does this indicate?
Answer: B. the resource will be updated in place
A tilde in the plan output indicates that Terraform will update the resource in place. A plus sign means creation, a minus sign means destruction, and a plus-minus indicates replacement.
Q17. True or False? Terraform can only manage dependencies between resources if the depends_on argument is explicitly set for the dependent resources.
Answer: B. False
Terraform automatically builds a resource graph by analyzing implicit dependencies from expression references. The depends_on argument is only needed as an override when no implicit resource reference exists in the configuration.
Q18. Why should a user specify provider version constraints in their Terraform configuration?
Answer: A. providers are released on a separate schedule from Terraform itself; therefore, a newer version could introduce breaking changes
Providers are downloaded and updated independently from the Terraform CLI. Pinning provider versions prevents unexpected breaking changes or updates from altering your infrastructure state. The versions do not inherently match the CLI or application versions.
Q19. True or False? All remote backends in Terraform support state locking by default, so you never need to worry about concurrent modifications when using any remote backend.
Answer: B. False
Not all remote backends support state locking natively. Always verify the locking capabilities of your specific backend to prevent race conditions. State locking is heavily dependent on the underlying remote storage service.
Q20. You have created a brand-new Terraform repo that has no backend block. After successfully running your first terraform apply, where does Terraform store state by default?
Answer: A. in the current working directory in a file named terraform.tfstate
Terraform stores state locally in a file named terraform dot t f state when no backend is configured. This local file serves as the baseline for future runs until a remote backend is initialized.
Q21. You run terraform plan in a workspace that has existing infrastructure. Terraform shows that it will update 3 resources, create 2 new resources, and destroy 1 resource. How does Terraform determine what changes need to be made?
Answer: C. Terraform compares the desired state in the configuration with the current state in the state file to build the plan
Terraform builds an execution plan by comparing your desired configuration files against the current state file. It then determines what create, update, or destroy actions are required to reach the desired state.
Q22. You have a root module that calls the child module modules/web. In modules/web/main.tf, a developer added name = "${var.env}-app". What is the correct way to make this work?
Answer: C. Declare variable "env" {} in the child module and pass it from root using env = var.env
Child modules do not automatically inherit variables from the root module. You must explicitly declare the variable in the child module and pass its value using the module block arguments in the root module.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.