Practice for the HashiCorp Certified Terraform Associate 004 exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You have a resource in your public cloud that was deployed manually, but you want to reference its attributes throughout. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- You have a resource in your public cloud that was deployed manually, but you want to reference its attributes…
- You have a workspace that deploys a VPC and subnets, and another workspace that deploys applications into tha…
- Which statement best describes the primary purpose of Infrastructure as Code (IaC)?
- Your AWS infrastructure configuration deploys a load balancer and several EC2 instances. Your security team w…
- You want to use the new features available in Terraform 1.12.0 and change the required_version constraint in…
- One of your team members manually deleted an EC2 instance through the AWS console that Terraform was managing…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You have a resource in your public cloud that was deployed manually, but you want to reference its attributes throughout your configuration without hardcoding values. How can you achieve this?
Answer: C. Add a data block to your configuration to query the existing resource. Use the available exported attributes of that resource type as needed throughout your configuration to get the values you need.
Data blocks query existing cloud resources to read their exported attributes dynamically. Hardcoding IDs in variables is discouraged, and attempting to import into a resource block is meant for taking over management, not just reading attributes.
Q2. You have a workspace that deploys a VPC and subnets, and another workspace that deploys applications into that VPC. You want the application workspace to automatically run a plan whenever the networking workspace completes a successful app…
Answer: B. use run triggers that connect the networking workspace to the application workspace
Run triggers connect HCP Terraform workspaces to automatically queue a speculative plan in a downstream workspace. They trigger the application workspace automatically after the upstream networking workspace successfully applies.
Q3. Which statement best describes the primary purpose of Infrastructure as Code (IaC)?
Answer: C. Define and provision infrastructure using code for consistent, repeatable deployments.
Infrastructure as Code defines cloud resources using high-level configuration files to ensure consistent, repeatable deployments. This eliminates manual configuration errors and directly supports automated provisioning workflows.
Q4. Your AWS infrastructure configuration deploys a load balancer and several EC2 instances. Your security team wants to audit which resources were created and obtain their IDs for documentation. You're deciding whether to add output blocks to…
Answer: C. output blocks provide a way to expose specific resource attributes for use without requiring others to parse the entire state file.
Output blocks expose specific resource attributes like IDs without requiring users to parse the entire state file. Terraform automatically tracks resources in state regardless of outputs, which eliminates the other options.
Q5. You want to use the new features available in Terraform 1.12.0 and change the required_version constraint in your configuration to ~> 1.12.0. After committing and pushing the change, your HCP Terraform run fails with an error stating that…
Answer: A. The Terraform version setting in HCP Terraform workspace is still set to an older version and needs to be updated to 1.12.0 or later.
HCP Terraform workspace settings dictate the exact Terraform version used for execution. If the workspace is pinned to an older version, the required_version constraint will fail until the workspace setting is manually updated.
Q6. One of your team members manually deleted an EC2 instance through the AWS console that Terraform was managing. What happens when you run terraform plan?
Answer: D. Terraform detects the missing instance and shows that it will recreate the resource
Terraform reconciles the current state file against your configuration and the real infrastructure. When a managed resource is deleted manually, the plan detects the drift and proposes recreating it to match your code.
Q7. Assuming default settings, which statement best describes how the local backend is used?
Answer: B. Terraform writes state to a file named terraform.tfstate in the current working directory.
By default, the local backend writes state to a file named terraform dot tfstate in the current working directory. It does not provide remote collaboration, encryption, or cloud-based locking.
Q8. Your team manages infrastructure with Terraform. A colleague manually modified a security group in the AWS console to allow emergency access last night. This morning, you run terraform plan without making any changes to your configuration…
Answer: D. the security group will show as needing updates to revert the manual changes and match your configuration
Terraform plan compares your desired configuration against the real infrastructure, detecting any drift. The plan will propose changes to revert the manual security group edits and match your code.
Q9. After successfully deploying resources for your test application, you decide to share it with users to gather feedback. You add a new module block to create a DNS record. What command do you need to run before Terraform can create the new…
Answer: C. terraform init
Whenever you add a new module block, you must run terraform init to download the module and its providers. Plan and apply will fail if the working directory is not initialized first.
Q10. You must destroy and recreate only one database server managed by Terraform without editing the configuration. Which command should you run?
Answer: D. terraform apply -replace="aws_instance.database"
The terraform apply -replace flag forces the destruction and recreation of a specific resource without altering its configuration. Avoid manual destroy commands or targets, because they can disrupt dependency ordering and leave the configuration out of sync.
Q11. After running terraform init in a new working directory, Thomas wants a dry run that saves the result for a later apply without creating resources. Which command should he use?
Answer: D. run terraform plan -out=thomas
The terraform plan command with the out flag saves an execution plan to a file for later application. The refresh-only flag merely syncs state with real infrastructure, while show and output simply display existing data.
Q12. You're applying changes to your production Azure infrastructure. When you run terraform apply, the creation of an Azure Virtual Machine succeeds, but the subsequent creation of an Azure Network Security Group fails due to a quota limit. Wh…
Answer: D. The VM exists in Azure and is recorded in state, but the NSG does not exist. You can run apply again to create the NSG.
Terraform writes successfully created resources to the state file immediately during an apply. It does not roll back partial deployments, so the virtual machine remains tracked while the security group is simply skipped.
Q13. You are configuring remote state and must keep backend credentials out of both the .terraform directory and any saved plan files. Which method will meet this requirement?
Answer: C. supply the credentials using environment variables on the machine executing plan/apply
Supplying credentials via environment variables keeps them completely out of configuration files and the local directory. Passing secrets through backend config files risks writing them to disk, and standard variables might be saved inside plan files.
Q14. You clone a Terraform repo, adjust a variable, and immediately run terraform apply. The command fails before planning, complaining about missing provider plugins. Which core workflow step should have happened first?
Answer: C. Run terraform init to set up the working directory and install providers.
The initialization command prepares the working directory by downloading required provider plugins and configuring the backend. Skipping this step prevents Terraform from recognizing providers, so always initialize your directory before planning or applying changes.
Q15. Steve needs to gather detailed information about an EC2 instance that he deployed earlier in the day. What command can Steve use to view this detailed information?
Answer: C. terraform state show aws_instance.frontend
The state show command displays detailed attributes for a specific resource tracked in the current state. The general show command requires a state file path, while state list merely outputs resource addresses without attributes.
Q16. You have decided to move your state file to an Amazon S3 remote backend. You configure Terraform as shown below. What command should be run in order to complete the state migration while copying the existing state to the new backend? terra…
Answer: B. terraform init -migrate-state
Running initialization with the migrate state flag transfers existing local state to a newly configured remote backend. Plan and apply commands cannot execute backend migrations, making initialization mandatory when changing state storage locations.
Q17. Your AWS provider configuration is shown in the exhibit below. When running a terraform plan, the region is set to us-west-2 in the provider block, but the AWS_REGION environment variable is set to eu-west-1. Which region will the provider…
Answer: B. us-west-2 from the provider block configuration
Explicit arguments defined in a Terraform provider block always take precedence over default provider environment variables. The AWS provider will use the us-west-2 region because explicit configuration overrides the AWS_REGION environment variable.
Q18. In your Terraform configuration, you have created a terraform.tfvars file that sets the value of a variable named region to us-central1. You also have a default value on the variable block, setting it to us-east1. Which value takes effect?
Answer: B. us-central1
Variable values defined in a terraform.tfvars file automatically override default values declared in a variable block. The file provides explicit variable assignments, ensuring us-central1 is used.
Q19. A platform team manages multiple HCP Terraform workspaces across various environments, each configured for a different repository. They want to define cloud credentials and common tags once, store them in a single location, and have those…
Answer: B. create a variable set in HCP Terraform and assign it to all workspaces so shared credentials are updated
Variable sets allow you to define variables and credentials once and share them across multiple HCP Terraform workspaces. You can update shared values centrally without manually editing individual workspaces.
Q20. Your company uses AWS for production and Azure for development, and currently uses CloudFormation for AWS and ARM templates for Azure. What is the main benefit of switching to Terraform for both cloud platforms?
Answer: A. teams can use the same workflow and configuration language for both clouds
Terraform provides a unified workflow and a single configuration language for managing multiple cloud providers. It does not abstract away provider-specific resources, but it standardizes your deployment process.
Q21. By default, where does Terraform download and store modules referenced in a configuration?
Answer: B. in the .terraform/modules subdirectory in the current working directory
During initialization, Terraform downloads referenced modules into the hidden dot-terraform subdirectory. This local cache allows Terraform to reuse the modules for subsequent operations without downloading them again.
Q22. A team needs identical environments across regions that have a history of version control. What practice solves this most directly?
Answer: C. Use Infrastructure as Code to declare resources and automate reproducible provisioning.
Infrastructure as Code uses declarative configuration files to automate provisioning and ensure environments are reproducible. Version control integration directly satisfies the requirement for history and identical deployments across multiple regions.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.