Practice for the HashiCorp Certified Terraform Associate 004 exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You need to search across all workspaces in your HCP Terraform organization to identify which workspaces manage the AWS . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- You need to search across all workspaces in your HCP Terraform organization to identify which workspaces mana…
- Your team has a CI/CD pipeline that runs terraform fmt -check, then terraform init, terraform validate, and f…
- Which Terraform feature lets you transform, combine, and derive values for use in resource arguments?
- You have recently run terraform apply successfully using the local backend. You notice Terraform has created…
- Your startup is deciding between using local state with manual coordination or migrating to HCP Terraform for…
- What variable type is represented by a pair of curly braces {} containing a series of key/value pairs?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You need to search across all workspaces in your HCP Terraform organization to identify which workspaces manage the AWS S3 bucket named production-data-lake. Which HCP Terraform feature provides this search capability?
Answer: A. Explorer
The HCP Terraform Explorer feature allows users to search across all workspaces within an organization to identify specific managed resources. The other listed utilities do not exist as built-in platform features.
Q2. Your team has a CI/CD pipeline that runs terraform fmt -check, then terraform init, terraform validate, and finally terraform plan. A developer commits code with a typo in an argument name and writes instance_typo instead of instance_type…
Answer: B. terraform validate
The terraform validate command checks configuration files for syntax errors, including incorrect argument names like an instance type typo. The format command only checks stylistic spacing, while plan evaluates against the provider schema.
Q3. Which Terraform feature lets you transform, combine, and derive values for use in resource arguments?
Answer: B. expressions with built-in functions
Expressions with built-in functions allow you to transform, combine, and derive values for resource arguments in Terraform. While variables hold raw inputs, functions provide the required data manipulation capabilities.
Q4. You have recently run terraform apply successfully using the local backend. You notice Terraform has created a new file called terraform.tfstate.backup in your working directory. What is the purpose of this file?
Answer: A. It contains the previous state before the most recent apply, allowing manual recovery if the current state becomes corrupted
The terraform.tfstate.backup file stores the previous state before the most recent apply operation. This serves as a manual recovery point if the primary state file becomes corrupted.
Q5. Your startup is deciding between using local state with manual coordination or migrating to HCP Terraform for remote state management. Which advantage does HCP Terraform offer to address team collaboration challenges?
Answer: A. automatic state locking, centralized state storage, state versioning, and audit logs for compliance
HCP Terraform provides centralized state storage, automatic locking, versioning, and audit logs. Local backends lack these built-in collaboration and security features, eliminating the distractors.
Q6. What variable type is represented by a pair of curly braces {} containing a series of key/value pairs?
Answer: B. maps and objects
Curly braces containing key-value pairs represent map and object types in Terraform. Lists and tuples use square brackets, while strings and numbers use basic literal syntax.
Q7. After running terraform apply, you notice some odd behavior and need to investigate. Which of the following environment variables will configure Terraform to write more detailed logs to assist with troubleshooting?
Answer: C. TF_LOG=TRACE
Setting the TF underscore LOG environment variable to TRACE enables verbose logging for troubleshooting. The other variables either do not exist or incorrectly attempt to assign log levels.
Q8. You're creating three GCP Compute Engine instances that must be placed in the same subnet. The subnet was created by another resource in your configuration. What's the correct approach to ensure all three instances use the same subnet?
Answer: C. reference the subnet ID attribute in each instance's network interface block
You should reference the subnet resource's ID attribute within each instance configuration. This establishes explicit dependencies, whereas hardcoding values creates configuration drift and should be avoided.
Q9. True or False? You can continue using your local Terraform CLI to execute terraform plan and terraform apply operations while using HCP Terraform as the backend.
Answer: B. True
HCP Terraform can function as a standard remote backend for local execution. While it also supports a remote operations mode that runs the CLI in the cloud, configuring it as a backend does not prevent you from executing plan and apply locally.
Q10. Given the variable below, which expression returns the string r2d2? variable "robots" { type = list(string) default = ["jarvis", "data", "r2d2", "ultron", "glaDOS"] }
Answer: B. var.robots[2]
Terraform uses zero-based indexing for lists, meaning the first element is zero. The string r2d2 is the third item in the list, so it is accessed using the index two.
Q11. True or False? The terraform graph command can be used to generate a visual representation of a configuration or execution plan.
Answer: A. True
The terraform graph command outputs a visual dependency graph using the DOT language. It helps you understand resource relationships in either your current configuration or a saved execution plan.
Q12. You're working on a Terraform project deploying VMware workloads. You now need to add a public DNS record in Amazon Route53, so you add an aws provider block to your configuration file. After saving the file, what should you do next?
Answer: A. run terraform init to download the newly required AWS provider
The terraform init command initializes the working directory and downloads any newly required provider plugins. Providers are not downloaded automatically during plan or apply, making initialization the required next step.
Q13. True or False? In most cases, you can migrate Terraform state between supported backends at any time, even after running your first terraform apply.
Answer: B. True
Terraform allows you to migrate state between supported backends at any time by updating the configuration and running terraform init. The tool automatically detects the changes and prompts you to migrate the existing state file.
Q14. True or False? You can specify multiple version constraints for a single module by using the version argument multiple times in the module block, such as version = ">= 1.0.0" and version = "< 2.0.0".
Answer: A. False
A module block only accepts the version argument a single time, meaning you cannot declare it multiple times. To satisfy multiple conditions, combine the constraints using comma-separated operators within a single string.
Q15. You add a check block to continuously monitor that your AWS EC2 instances are using encrypted EBS volumes. During terraform plan, the check fails. What happens?
Answer: B. Terraform reports the check failure as a warning but continues with the plan
Precondition and check block failures during a plan are reported as warnings rather than hard errors. This allows Terraform to output the proposed execution plan so you can review and correct the issue.
Q16. You need to deploy resources across two different Azure subscriptions in the same Terraform configuration. How do you configure Terraform to handle this?
Answer: C. Define multiple provider blocks with different alias attributes and reference them in resources.
Provider aliases let one configuration target multiple subscriptions or regions. Option D is a valid operational workaround, but the question asks how to handle it in a single configuration, which eliminates separate directories.
Q17. True or False? Running the terraform fmt command will modify Terraform configuration files in the current working directory and all its subdirectories.
Answer: A. False
By default, the format command only processes files in the current working directory. It ignores subdirectories unless you explicitly provide the recursive flag, ensuring standard code formatting without unexpected widespread changes.
Q18. You run a standard terraform plan (without any flags) on your configuration. During the planning phase, what does Terraform do with the current state?
Answer: A. Terraform automatically queries the real infrastructure to refresh state data before generating the plan, but doesn't save the refreshed state to the file
A standard plan automatically queries real infrastructure to refresh state data in memory before generating the plan. This ensures accuracy, but the state file is only updated during apply.
Q19. True or False? When you create a pull request on the linked repository branch of the workspace using HCP Terraform, it automatically initiates a speculative plan for that workspace.
Answer: A. True
Linked HCP Terraform workspaces automatically trigger speculative plans on pull requests to preview changes. The trap option is false, which assumes manual intervention is required for previews.
Q20. True or False? After successfully importing an existing resource using an import block and running terraform apply, you can immediately delete the import block from your configuration file without affecting Terraform's ability to manage th…
Answer: A. True
Running apply on an import block adds the resource to Terraform state, linking it to your configuration. You can safely delete the import block after the apply completes because the resource management link is now persistent.
Q21. You need to use a public Azure virtual network module from the Terraform registry, keep it on a 5.x release, and pass name and address_space inputs from variables. Which module block meets all requirements?
Answer: A,B,C,D,E,F. module "vnet" { || source = "Azure/network/azurerm" || version = "~> 5.0" || name = var.name || address_space = var.address_space || }
The required module block uses the registry source, the tilde greater than constraint for the major version, and unquoted variable expressions. The distractors use local paths or incorrect syntax that violates these registry rules.
Q22. You have declared a variable named db_connection_string inside of the app module. However, when you run a terraform apply, you get the following error message: Error: Reference to undeclared input variable on main.tf line 35: 35: db_path =…
Answer: F. since the variable was declared within the module, it cannot be referenced outside of the module
Variables declared inside a module are scoped locally and cannot be referenced by the parent configuration. The parent fails because the variable is undeclared at its root scope.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.