Practice for the HashiCorp Certified Terraform Associate 004 exam with 20 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are using the CLI and want your local Terraform configuration to run in HCP Terraform and store state there. How sho. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- You are using the CLI and want your local Terraform configuration to run in HCP Terraform and store state the…
- Which method below ensures sensitive information is not stored in the state file?
- A developer wants to interactively test how a Terraform expression and a built-in function will evaluate usin…
- You have a Terraform workspace managing Azure infrastructure as shown in the exhibit below. You run terraform…
- You have a Terraform configuration file defining resources to deploy on VMware, yet there is no related state…
- What built-in tool or command can you use to easily format Terraform code to meet the recommended canonical f…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are using the CLI and want your local Terraform configuration to run in HCP Terraform and store state there. How should you configure this in your code?
Answer: D. Add a cloud block inside the terraform block that sets the HCP Terraform organization and workspace to use for this working directory.
The cloud block inside the terraform configuration connects local directories to HCP Terraform for remote execution and state management. Provider and backend blocks are incorrect because they handle external APIs or legacy state storage.
Q2. Which method below ensures sensitive information is not stored in the state file?
Answer: D. none of the above
Terraform stores all resource attributes in plaintext in the state file, meaning none of these methods can prevent sensitive data from being saved. To protect credentials, you must strictly secure the state file itself.
Q3. A developer wants to interactively test how a Terraform expression and a built-in function will evaluate using the current state and variable values before adding the expression to a configuration. Which command should the developer use?
Answer: D. terraform console
The terraform console command opens an interactive shell to test expressions and functions using current state and variables. Other commands like plan, show, or output only display generalized state or planned changes without interactive testing.
Q4. You have a Terraform workspace managing Azure infrastructure as shown in the exhibit below. You run terraform destroy. In what order will Terraform destroy these resources? resource "azurerm_resource_group" "main" { name = "production-bk"…
Answer: C. Terraform will follow the dependency chain: subnet, virtual network, resource group
Terraform determines destruction order by analyzing resource dependencies, destroying children before parents. The subnet is destroyed first, followed by the virtual network, and finally the resource group.
Q5. You have a Terraform configuration file defining resources to deploy on VMware, yet there is no related state file. You have successfully run terraform init already. What happens when you run a terraform apply?
Answer: C. Terraform will create the resources defined in the configuration file and write a new state file.
Without a prior state file, Terraform safely assumes the infrastructure does not exist and creates everything defined in the configuration. It then writes a new state file tracking those newly created resources.
Q6. What built-in tool or command can you use to easily format Terraform code to meet the recommended canonical formatting and style?
Answer: C. terraform fmt
The terraform fmt command automatically formats code to canonical standards, ensuring consistency across your configuration files. Plan and validate evaluate configuration logic, while env manages workspaces.
Q7. True or False? A remote backend configuration is required for using Terraform.
Answer: B. False
Terraform uses a local backend by default if a remote backend is not explicitly configured. Remote backends are optional and primarily enhance collaboration, security, and remote state management.
Q8. Given the configuration below, which expression correctly references the EC2 instance created for the frontend application? resource "aws_instance" "svc_apps" { for_each = { "auth" = "security" "billing" = "finance" "frontend" = "ui" "work…
Answer: A. aws_instance.svc_apps["frontend"]
When using the for_each meta-argument, Terraform creates a map of resources. You must reference the specific resource using the map key inside brackets, such as aws_instance.svc_apps["frontend"].
Q9. You are reviewing a Terraform workspace set up by another team member. You want to quickly count the number of resources currently being managed without scrolling through pages of detailed configuration and attribute information. Which com…
Answer: B. terraform state list
The terraform state list command provides a concise list of resource addresses managed in the current state. Options like terraform show or state show dump detailed configurations, making them unsuitable for a quick resource count.
Q10. After adding an import block to your configuration, you see the error shown below. What steps must be taken first to manage this EC2 instance using Terraform? $ terraform apply Error: resource address "aws_instance.web_app_42" does not exi…
Answer: C. create a new resource block in your configuration for the aws_instance resource in the Terraform configuration file
Terraform requires a matching resource block in your configuration before it can successfully import and manage an existing resource. Data blocks are only for reading attributes, while ignore changes hides drift rather than enabling management.
Q11. You have three test VMs running on a new cluster, and you run terraform destroy to remove them. However, Terraform only removes two of the virtual machines, leaving one virtual machine still running. Why would Terraform only remove two of…
Answer: B. The remaining virtual machine was not created by Terraform; therefore, Terraform is unaware of it and cannot destroy it.
Terraform can only destroy resources that it tracks inside its state file. If a virtual machine was created outside of Terraform, the tool remains completely unaware of its existence and safely leaves it running during destruction.
Q12. When running the terraform validate command, which issue will be brought to your attention?
Answer: D. a variable is being used in a resource block but has not been declared
The terraform validate command checks syntax and internal consistency without accessing cloud APIs or existing state. It specifically catches referencing an undeclared variable, whereas configuration drift and missing state require evaluating infrastructure.
Q13. Your team wants Terraform to manage a new SaaS with just a REST API. Which Terraform component defines resource schemas, manages authentication and interactions with the API, and provides resources and data sources for configurations?
Answer: D. Terraform provider
Providers act as the bridge between Terraform and external systems by defining resource schemas and handling API interactions. Provisioners, backends, and modules serve entirely different purposes like bootstrapping scripts, storing state, or organizing configurations.
Q14. True or False? Terraform requires you to run a terraform plan before applying the configuration with terraform apply.
Answer: B. False
Terraform does not mandate running a plan separately because the apply command automatically generates an execution plan and prompts for approval. You only need to run plan manually if you want to review changes without applying them.
Q15. You're writing a backend configuration block for S3. Which of the following can be defined directly inside the backend block?
Answer: B. values like bucket name, key, and region, but not computed values or variables
Backend blocks require static literal values and cannot reference variables, locals, or data sources because Terraform must configure the backend before loading the rest of the configuration.
Q16. Your team is using two HCP Terraform workspaces. The prod-webserver workspace has successfully deployed an Azure VM. You're now working in the prod-dns workspace and need to use the public IP to create a DNS record. The webserver IP keeps…
Answer: B. a tfe_outputs data source that references the prod-webserver workspace
The tfe_outputs data source retrieves output values from another HCP Terraform workspace. Standard variables require manual updates, while dynamic blocks iterate over complex local data and cannot fetch remote state.
Q17. What type of file can be used to set explicit values for the current working directory that will override the default variable values?
Answer: B. .tfvars file
Terraform uses .tfvars files to assign variable values, which automatically override any defaults set in the configuration. Template files are for dynamic generation, while state files store deployed resource data.
Q18. What is the primary function of using HCP Terraform agents?
Answer: A. execute Terraform plans and apply changes to isolated, private, or on-premises infrastructure
HCP Terraform agents execute plans and applies against isolated, private, or on-premises infrastructure from within restricted networks. They do not provide workspace management, remote monitoring, or state file storage capabilities.
Q19. Your team deployed an Azure SQL Database using Terraform and needs to share the connection string with the application team. You create an output block with the sensitive flag set to true. However, a team member reports that they can still…
Answer: A. The sensitive flag only prevents the value from appearing in the CLI output, but it is still stored in plain text in the state file.
The sensitive flag prevents values from displaying in standard CLI output but does not encrypt the state file. Anyone with read access to the state file can view the raw plain text values.
Q20. Given the example code below, where will the S3 buckets named logs and operations be created? provider "aws" { region = "us-east-1" } provider "aws" { alias = "west" region = "us-west-2" } provider "aws" { alias = "eu" region = "eu-west-2"…
Answer: B. operations: us-west-2
Resources use the default provider configuration unless the provider meta-argument specifies an alias. The operations bucket is explicitly set to use the aws.west provider, placing it in us-west-2. The logs bucket lacks an alias and does not have a matching option for its default us-east-1 region.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.