Practice for the HashiCorp Certified Terraform Associate 004 exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A provider alias is used for what purpose in a Terraform configuration file?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- A provider alias is used for what purpose in a Terraform configuration file?
- Your teammate wants you to use terraform import to bring an existing Google Cloud Storage bucket under Terraf…
- Which feature of HCP Terraform can be used to enforce fine-grained policies to enforce standardization and co…
- A developer writes a new Terraform configuration to create a virtual machine. They run terraform validate and…
- You open the terraform.tfstate file in a text editor to inspect it. What format is the file, and what type of…
- You have a root module with a variable defined, as shown in the exhibit below. Inside a child module, you wri…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A provider alias is used for what purpose in a Terraform configuration file?
Answer: D. defining multiple configurations of the same provider and binding resources to them
A provider alias allows you to define multiple configurations for the same provider, such as deploying resources to different AWS regions. You then bind specific resources to these alternate configurations using the provider meta-argument.
Q2. Your teammate wants you to use terraform import to bring an existing Google Cloud Storage bucket under Terraform management. They expected that after running the import, the Terraform configuration file would automatically be populated wit…
Answer: D. Importing only adds the resource to Terraform state and you need to add the resource block to match the existing bucket settings.
The terraform import command only maps the existing real-world resource into your Terraform state file. It does not automatically generate the corresponding HCL configuration, which you must manually write to match the imported resource.
Q3. Which feature of HCP Terraform can be used to enforce fine-grained policies to enforce standardization and cost controls before resources are provisioned with Terraform?
Answer: D. Sentinel and OPA
HCP Terraform integrates with policy-as-code frameworks like Sentinel and Open Policy Agent. These tools evaluate your Terraform plan before execution, allowing you to enforce security, compliance, and cost guardrails.
Q4. A developer writes a new Terraform configuration to create a virtual machine. They run terraform validate and it reports "Success! The configuration is valid." However, when the developer runs terraform apply, the command fails with an err…
Answer: C. The terraform validate command checks for syntactic correctness but does not communicate with the provider's API to validate resource-specific values.
The validate command checks syntax and internal consistency without connecting to cloud provider APIs. Provider-specific arguments like instance types are only validated during the plan or apply phases when Terraform queries the actual provider.
Q5. You open the terraform.tfstate file in a text editor to inspect it. What format is the file, and what type of information does it contain?
Answer: A. JSON format containing resource metadata, attributes, dependencies, and potentially sensitive values in plaintext
The local terraform.tfstate file uses JSON format to store resource metadata, attributes, and dependencies. This state file may also contain sensitive values in plaintext if they are not explicitly marked as sensitive by the provider.
Q6. You have a root module with a variable defined, as shown in the exhibit below. Inside a child module, you write name = var.environment as part of an expression when creating a resource. What will happen when you run terraform plan? variabl…
Answer: B. Terraform will return an error stating that var.environment is not declared in the child module
Variables defined in the root module are not automatically inherited by child modules. You must explicitly declare the variable inside the child module and pass the value using the module block arguments, or Terraform will return an error.
Q7. Your team deployed an Azure SQL Database last week. Now you need to create a new web app that connects to this database. The database's connection string is automatically generated by Azure during deployment. How should you pass the connec…
Answer: D. reference the database resource's connection string attribute in the web app configuration
You should directly reference the database resource attribute to pass the dynamically generated connection string. This creates an implicit dependency, ensuring Terraform waits for the database creation to finish before deploying the web app.
Q8. Which characteristics are commonly associated with Infrastructure as Code (IaC) workflows?
Answer: C. managing and provisioning infrastructure using machine-readable definitions stored in version control.
Infrastructure as Code relies on machine-readable definition files stored in version control systems. This enables automated, consistent, and repeatable deployments while avoiding manual configuration drift associated with clicking through graphical interfaces.
Q9. When using HCP Terraform, what is the simplest way to maintain the security and integrity of modules when multiple teams across different projects use them?
Answer: B. Use the HCP Terraform Private Registry to make sure your organization only uses approved modules.
The HCP Terraform Private Registry allows organizations to securely share and manage approved internal modules. Organization permissions alone cannot easily restrict module usage across different projects without this centralized registry.
Q10. You refactored a module and renamed a resource as shown in the code example below. When running terraform plan, Terraform wants to destroy aws_s3_bucket.logs and create aws_s3_bucket.app_logs. How can you make this a config-driven change s…
Answer: B. add a moved block to indicate the address change directly in your configuration
Adding a moved block to your configuration lets Terraform safely update the state address without destroying the resource. The import block is meant for bringing in unmanaged resources, while the replace flag forces resource recreation.
Q11. Your team manages long-lived VMs with a configuration management tool, but drift and rollbacks are frequent. You're evaluating alternatives. Which option best reflects an IaC advantage over traditional configuration management?
Answer: D. Using declarative IaC and immutable infrastructure allows you to define the desired state in code, easily replace resources, and version everything.
Infrastructure as Code uses declarative configurations to define desired state and supports immutable infrastructure patterns. This reduces configuration drift and allows straightforward rollbacks by versioning and deploying entirely new resources.
Q12. What function does the terraform init -upgrade command perform?
Answer: D. update all previously installed plugins and modules to the newest version that complies with the configuration's version constraints
The terraform init -upgrade command updates all previously installed plugins and modules to the newest available versions. It disregards the dependency lock file while still strictly honoring the version constraints defined in your configuration.
Q13. You have an existing VPC in your account and have added the data block to your configuration, as shown below. How would you reference the id of the VPC? data "aws_vpc" "production" { tags = { Name = "prod" } }
Answer: C. data.aws_vpc.production.id
To reference attributes from a data source, you must prefix the expression with the data keyword followed by the type and name. Therefore, the correct reference for the VPC identifier is data dot aws_vpc dot production dot id.
Q14. A project is using version 6.0.2 of the hashicorp/aws provider. The configuration's version constraint is set to ~> 6.0.0. Two newer versions are available, 6.0.5 and 6.1.0. What is the effect of running terraform init -upgrade?
Answer: C. It will install the newest provider version that matches the ~> 6.0.0 constraint, which is 6.0.5.
The upgrade command honors your configured version constraints while grabbing the newest allowed release. The pessimistic constraint tilde greater than six point zero point zero restricts updates to patch releases, meaning it selects six point zero point five.
Q15. Your team is debating whether to use a map(string) or an object type for storing AWS instance configuration. A team member suggests using object because it provides better structure. What is the key difference between these two types?
Answer: C. An object type defines a fixed structure with specific attribute names and types, while a map allows any keys with values of the same type.
An object type defines a fixed structure with specific named attributes and their individual types, while a map requires all values to share the same type. Option D is incorrect because objects and maps enforce completely different structural constraints and are not interchangeable.
Q16. You've updated a production load balancer using Terraform. Before making changes, you must (a) preview the exact set of actions as a dry run and (b) ensure that the same reviewed actions are applied later without drift. Which commands meet…
Answer: D. terraform plan -out=lb.tfplan → terraform apply lb.tfplan
Saving an execution plan to a file with terraform plan -out creates a definitive record of the exact changes. Applying that specific plan file later guarantees Terraform executes only the reviewed actions, eliminating the risk of unreviewed drift.
Q17. You want to dynamically create a server name by combining three string variables with hyphens to produce prod-us-east-web. Which of the following expressions would accomplish this?
Answer: C. name = join("-", [var.environment, var.region, var.app])
The join function concatenates the elements of a given list into a single string separated by a chosen delimiter. The concat function is the trap here because it combines lists rather than creating a hyphenated string.
Q18. All your infrastructure is managed by Terraform, but engineers occasionally make small updates directly on the target platform. Which Terraform command can identify changes to the actual infrastructure and reflect them in the Terraform sta…
Answer: D. terraform apply -refresh-only
The terraform apply -refresh-only command reconciles the state file with real-world infrastructure to detect drift. This operation updates the state to reflect manual changes without modifying the actual infrastructure.
Q19. Your team needs to capture Terraform logs for a production deployment. You want the logs saved to a file rather than displayed in the terminal so you can review with senior engineers. Which environment variable should you set to specify th…
Answer: B. TF_LOG_PATH
Setting the TF_LOG_PATH environment variable directs Terraform to write its detailed logs to a specific file. The TF_LOG variable simply controls the verbosity level but does not specify the destination file.
Q20. Your organization uses Chef to configure application settings and install software packages on existing servers. The DevOps team is evaluating whether to adopt Terraform alongside Chef. Which statement best explains how Infrastructure as C…
Answer: B. Infrastructure as Code tools focus on provisioning and managing the lifecycle of infrastructure resources, while configuration management tools focus on installing and managing software on existing servers.
Infrastructure as Code tools like Terraform provision and manage underlying infrastructure resources across their lifecycle. Configuration management tools like Chef install and manage software on those existing servers.
Q21. Your configuration uses a module stored on a private registry that is configured with this version argument: version = "~> 3.2.0". The registry has versions 3.2.0, 3.2.5, 3.3.0, and 4.0.0 available for this module. Which version will Terra…
Answer: B. 3.2.5
The pessimistic constraint operator limits updates to the newest patch version within the specified minor release. Because three is the minor version, Terraform selects the highest patch within the three dot two range.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.