Practice for the HashiCorp Certified Terraform Associate 004 exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your team maintains a map of common tags to apply to all resources. Each individual resource also needs its own specific. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- Your team maintains a map of common tags to apply to all resources. Each individual resource also needs its o…
- You're refactoring a large Terraform configuration, splitting a monolithic file into multiple smaller files a…
- In the snippet below, where does the value for vpc_security_group_ids come from? module "ec2_instances" { sou…
- True or False? After successfully applying a moved block to refactor your resources, you should immediately r…
- In the top-level terraform block, which setting specifies a provider's source and version constraints?
- Your team has been using Terraform to manage infrastructure. A colleague manually created a database in the c…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your team maintains a map of common tags to apply to all resources. Each individual resource also needs its own specific tags. To accomplish this, you have var.common_tags containing shared tags and local.resource_tags containing resource-…
Answer: B. merge(var.common_tags, local.resource_tags)
The merge function takes multiple maps and combines them into a single map. This is the correct method for combining multiple tag sets, whereas flatten and concat are reserved for working with sequences and lists.
Q2. You're refactoring a large Terraform configuration, splitting a monolithic file into multiple smaller files and reorganizing resource blocks. Before running terraform plan, what's the fastest way to verify you didn't introduce any syntax e…
Answer: C. run terraform validate
The validate command checks your configuration files for syntax and internal consistency without accessing cloud providers. Running a plan would also check syntax but requires cloud credentials and takes longer to execute.
Q3. In the snippet below, where does the value for vpc_security_group_ids come from? module "ec2_instances" { source = "terraform-aws-modules/ec2-instance/aws" version = "4.3.0" name = "pr0d-east-app" instance_count = 2 ami = "ami-0c5204531f79…
Answer: D. the output of another module
The value for vpc underscore security underscore group underscore ids comes from an output of another module, specifically the vpc module. Prefacing an address with the module keyword followed by a name indicates that the value originates from a module output rather than a variable.
Q4. True or False? After successfully applying a moved block to refactor your resources, you should immediately remove the moved block from your configuration to keep your code clean.
Answer: A. False
Moved blocks must remain in the configuration long enough for all users and automation to process the state migration successfully. Removing them prematurely causes Terraform to view the new address as an untracked resource, triggering an unexpected destroy and recreate operation.
Q5. In the top-level terraform block, which setting specifies a provider's source and version constraints?
Answer: C. required_providers
The required_providers block specifies provider source addresses and version constraints. Distractors like provider or backend handle different configuration needs, while required_version targets the Terraform binary itself.
Q6. Your team has been using Terraform to manage infrastructure. A colleague manually created a database in the console for urgent troubleshooting and testing. The database is now needed permanently as part of your production environment. What…
Answer: A. To bring the database under Terraform management so future changes can be tracked and managed through your IaC workflow.
Terraform import brings manually created resources under state management so future updates follow your code workflow. It does not automatically write code, validate compliance, or optimize performance.
Q7. A root module includes several variables in terraform.tfvars. You add a child module as shown below. What values can the child module access by default? module "web" { source = "./modules/web" }
Answer: B. Only values passed to it via the module block since root variables are not automatically accessible inside the module.
Child modules must explicitly receive variables through their module block. Terraform isolates module scopes, so root variables and locals are not inherited automatically, ensuring modules remain reusable and self-contained.
Q8. Which of the following Terraform files should be ignored by Git when committing code to a repo?
Answer: D. terraform.tfstate
The state file tracks real infrastructure and sensitive data, so it must be excluded from version control. Configuration files and the lock file belong in Git to ensure consistent provider versions across the team.
Q9. You've updated a module and run terraform plan with default settings against the workspace's remote state. What happens when the command is executed?
Answer: B. Terraform creates an execution plan and determines what changes are required to achieve the desired state in the configuration files.
The terraform plan command creates an execution plan by comparing the current state to the desired configuration. The apply command executes changes, while plan simply determines what changes are required.
Q10. True or False? Marking an output as sensitive does not prevent its value from being stored in the Terraform state file.
Answer: A. True
Marking an output as sensitive only masks the value in the command line output and logs. Sensitive values are still stored in plaintext within the state file, requiring strict access controls.
Q11. Rahul deployed multiple VMs outside the Terraform workflow, and now your team is unsure which VM is managed by Terraform. What approach would best help you identify the Terraform-managed VM without making any changes to the infrastructure?
Answer: D. Use Terraform state commands terraform state show to match the tracked VM's ID with the list of active VMs.
Inspecting the state with terraform state list or terraform state show correctly identifies tracked resources without making changes. Manually updating configurations or deleting untracked VMs risks unintended infrastructure modifications.
Q12. You're configuring an S3 backend for your Terraform project. You want to keep sensitive values, such as the bucket name and region, out of version control while keeping other backend configuration in your code. Which approach correctly imp…
Answer: C. define the backend block with only the type, then pass the bucket and region values using -backend-config flag during terraform init
Partial backend configuration allows you to define the backend type in code while passing sensitive arguments dynamically during terraform init using the -backend-config flag. Variable definitions and environment variables are not evaluated during backend initialization.
Q13. You want to start managing resources that were not originally provisioned through infrastructure as code. Before you can import the resources, what must you do before running the terraform import command?
Answer: B. update the Terraform configuration file to include new resource blocks that match the resources you want to import
Before importing an existing resource, you must write a matching resource block in your configuration. While newer Terraform versions support declarative import blocks, the traditional imperative terraform import command explicitly requires the resource block first.
Q14. Your team manages infrastructure across multiple AWS regions using Terraform. You want to see a complete list of all resources currently tracked in your Terraform state file, but don't need the detailed attributes of each resource. Which c…
Answer: A. terraform state list
The terraform state list command provides a high-level list of all resources tracked in the state file. The terraform show command displays detailed attributes, which is unnecessary if you only need resource addresses.
Q15. In the example code below, what order will Terraform create these resources? variable "existing_disk" { type = string } resource "google_compute_instance" "web" { name = "btk-web-1" machine_type = "e2-micro" zone = "us-central1-a" boot_dis…
Answer: A. Second – google_compute_attached_disk.data
The attached disk resource references the compute instance name, creating an implicit dependency. Terraform uses this graph to determine operation order, ensuring the compute instance is created before the disk attachment.
Q16. Your company has a centralized network team that manages all Azure Virtual Networks. Your application team needs to deploy virtual machines into the prod-network VNet, which the network team created. What is the correct approach in your Te…
Answer: D. use a data block to reference the existing VNet, then create your VM resources that use attributes from the data source
Use a data block to reference existing infrastructure managed outside your configuration. This allows you to retrieve attributes like a VNet ID without taking ownership of the resource, leaving the network team responsible for its lifecycle.
Q17. True or False? Multiple providers can be declared within a single Terraform configuration file.
Answer: B. True
A single Terraform configuration can declare and use multiple providers. This allows you to orchestrate multi-cloud environments or manage resources across different services within the same set of files.
Q18. Your team has multiple infrastructure projects with different compliance requirements. Some projects require advisory policy checks while others need mandatory enforcement. How should you configure policies in HCP Terraform to meet these v…
Answer: C. Configure different enforcement levels for each policy set and apply them to the appropriate workspaces or projects.
Policy sets in HCP Terraform can be assigned specific enforcement levels like advisory or mandatory, and scoped to particular workspaces or projects. Run triggers handle dependencies between workspaces and cannot enforce compliance or selectively apply policy rules.
Q19. In HCP Terraform, how many VCS repositories can a workspace be mapped to?
Answer: B. 1
An HCP Terraform workspace can only be linked to a single VCS repository. This ensures that infrastructure deployments are strictly tied to one central source of truth for configuration tracking.
Q20. What happens when a terraform apply command is executed?
Answer: B. applies the changes required in the target infrastructure in order to reach the desired configuration
The terraform apply command executes the actions proposed in the execution plan to reach the desired configuration state. This differs from terraform plan, which only proposes changes, and init, which prepares the directory.
Q21. You are reviewing the following Terraform configuration in main.tf. Which statements about this configuration are correct? (select two) module "servers" { source = "./modules/btk-cluster" servers = 5 }
Answer: B,E. source = "./modules/btk-cluster" || main.tf is the root (calling) module
The main.tf file acts as the root calling module, and the source path points to a local child module on disk. Terraform does not download local modules from the public registry, and the servers argument is an input variable, not an output.
Q22. Which of the following best describes a Terraform provider?
Answer: D. a plugin that Terraform uses to translate the API interactions with the service or provider
A provider acts as a plugin that allows Terraform to interact with external services by translating configuration into API interactions. The other options define resources, modules, and variables, which are core configuration components rather than the providers themselves.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.