Practice for the HashiCorp Certified Terraform Associate 004 exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You need to authenticate your local Terraform CLI to run plans against an HCP Terraform workspace. According to HashiCor. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the HashiCorp Certified Terraform Associate 004 practice test →
What you will practice
- You need to authenticate your local Terraform CLI to run plans against an HCP Terraform workspace. According…
- True or False? HCP Terraform automatically stores state files remotely and provides state locking to prevent…
- You run terraform plan on your configuration that uses a remote backend with state locking. What happens with…
- During terraform apply, you notice Terraform is using version 5.0.0 of the AWS provider, but you know version…
- You are using Terraform to manage some of your GCP infrastructure. You notice that a new version of the provi…
- True or False? The `terraform state list` and `terraform show` commands modify the state file when executed…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You need to authenticate your local Terraform CLI to run plans against an HCP Terraform workspace. According to HashiCorp, what is the correct way to set up authentication?
Answer: C. Run terraform login, generate a user API token in the browser, and let Terraform store that token in ~/.terraform.d/credentials.tfrc.json for future commands.
The terraform login command opens a browser to generate an API token and stores it locally in the credentials dot tfrc dot json file. Committing access keys to source control is a severe security anti-pattern and does not authenticate the command line interface.
Q2. True or False? HCP Terraform automatically stores state files remotely and provides state locking to prevent concurrent operations by multiple users from corrupting the state.
Answer: B. True
HCP Terraform provides fully managed remote state storage that includes automatic state locking. This locking mechanism prevents concurrent operations from corrupting the state file, ensuring safe team collaboration without requiring manual backend configuration.
Q3. You run terraform plan on your configuration that uses a remote backend with state locking. What happens with the state lock during this operation?
Answer: C. Terraform acquires a lock to prevent state modification
Terraform acquires a state lock during the plan operation to prevent state modifications by concurrent runs. This ensures the state file does not change while the plan is being generated.
Q4. During terraform apply, you notice Terraform is using version 5.0.0 of the AWS provider, but you know version 5.31.0 is available and includes a bug fix you need. The current provider version constraint is ~> 5.0. What command should you r…
Answer: D. run terraform init -upgrade to update providers to the newest version matching the constraints
Running terraform init with the upgrade flag updates providers to the newest version matching your configured constraints. The dependency lock file pins provider versions, so a standard initialization alone will not bypass it.
Q5. You are using Terraform to manage some of your GCP infrastructure. You notice that a new version of the provider now includes additional functionality you want to take advantage of. What command do you need to run to upgrade the provider?
Answer: D. terraform init -upgrade
Running terraform init with the upgrade flag updates your providers to the newest compatible version. The dependency lock file pins specific versions, so standard initialization ignores newer releases.
Q6. True or False? The `terraform state list` and `terraform show` commands modify the state file when executed, so you should always create a backup before running them during incident investigation.
Answer: B. False
The state list and show commands are strictly read-only operations. They safely inspect resources during troubleshooting without modifying the state file, unlike destructive subcommands such as state remove or state move.
Q7. What is the purpose of the .terraform.lock.hcl file in a Terraform project?
Answer: A. It locks provider versions and checksums to ensure consistent installs.
The .terraform.lock.hcl file locks provider versions and checksums to ensure consistent installs across environments. It does not cache plans, store state, or record variable defaults.
Q8. You have a module block definition using version = "2.1.0". The module publisher releases version 2.1.5 with bug fixes. You update your module block to version = "~> 2.1.0". What command must you run to update to the latest version?
Answer: A. terraform init -upgrade
Running terraform init -upgrade updates dependencies to the latest allowed versions, including modules. The standard terraform init command will not override the locked version if it is already present in the lock file.
Q9. What is the primary purpose of Terraform state?
Answer: B. to track the mapping between resources in your configuration and real-world infrastructure
Terraform state tracks the mapping between resources in your configuration and real-world infrastructure. It is not a backup mechanism, syntax validator, or encryption tool for sensitive values.
Q10. When running a terraform plan, how can you save the plan so it can be applied at a later time?
Answer: D. use the -out flag
The -out flag saves the generated plan to a file for later application with terraform apply. There are no -save or -file flags, and saving plans is a core automation feature.
Q11. You run terraform validate and receive the response: "Success! The configuration is valid." Afterward, you run terraform plan and receive an error: "Error: Invalid provider configuration – The argument 'region' is required." Why did valida…
Answer: A. validate only checks syntax and internal consistency, not provider-specific requirements
The terraform validate command only checks syntax and internal consistency, not provider-specific requirements. The plan command actually connects to providers, revealing missing required arguments like region.
Q12. You're creating a variable for the cloud provider region and want to ensure users only provide valid US regions. You want Terraform to reject invalid values before any resources are created. Where should you add this validation logic?
Answer: B. add a validation block inside the variable declaration
Adding a validation block inside the variable declaration enforces constraints before resources are created. Preconditions and postconditions apply to resource lifecycle phases rather than input variable evaluation.
Q13. You are modifying a Terraform configuration that manages production infrastructure. Before applying the changes, you want to preview exactly what resources will be created, modified, or destroyed without making any actual changes. Which co…
Answer: C. run a terraform plan and validate the changes that will be made
The terraform plan command generates an execution plan that previews exactly which resources will be created, modified, or destroyed. Running validate only checks for syntax errors, and refresh only compares state to real infrastructure without showing config changes.
Q14. What block type allows you to query information about an existing resource for use in your Terraform configuration?
Answer: D. data block
A data block queries information about existing resources without managing or provisioning them. An import block is used to bring existing infrastructure under management, whereas a data block simply reads attributes for use in configuration.
Q15. You need a public module to create a VPC. How do you search and get the value to reference it in your configuration?
Answer: D. Use registry.terraform.io search, open the module page, and copy its source address.
Public modules are discovered on the Terraform Registry, where you can review details and copy the exact source address. Guessing GitHub URLs or copying raw resource examples bypasses the official registry workflow and lacks the proper namespace, name, and provider formatting.
Q16. You successfully imported an existing Azure Virtual Network into Terraform using an import block. The resource is now in your state file. When you run terraform plan immediately after the import, Terraform shows that it wants to modify sev…
Answer: B. The resource block in your configuration does not exactly match all the settings of the existing virtual network, so Terraform wants to update the resource to match your code.
Terraform generates a plan to reconcile differences between your configuration and the current state. The drift occurs because the resource block does not exactly match the existing settings, causing Terraform to propose updates to align the infrastructure with the code.
Q17. In HCP Terraform, what is a change request?
Answer: C. a tracked request that lists planned changes for one or more workspaces so teams can manage a backlog of infrastructure work
A change request in HCP Terraform is a tracked request that lists planned changes for one or more workspaces. It helps teams manage a backlog of infrastructure work by organizing and documenting planned modifications.
Q18. You have a module named prod_subnet that outputs the subnet_id of the subnet created by the module. How would you reference the subnet ID when using it as an input for another module?
Answer: C. subnet = module.prod_subnet.subnet_id
Module outputs are accessed using the module keyword, the module name, and the output name. This standard syntax allows you to pass data between different modules seamlessly.
Q19. Your organization is using HCP Terraform. A new app team group should be able to view state and queue plans across its workspaces, but they must not be allowed to edit variables or change workspace settings. As the admin, what is the most…
Answer: D. Create a new team for the app team, add the users to it, and assign the team the Plan role on its workspaces.
Assigning the team the Plan role on its workspaces allows users to view state and queue runs. This role restricts variable edits and workspace settings, satisfying the least privilege requirement.
Q20. You need to destroy all infrastructure managed by an HCP Terraform workspace. What is the correct way to accomplish this using the CLI-driven workflow?
Answer: A. run terraform destroy in your local terminal while authenticated to HCP Terraform
Running terraform destroy in your local terminal removes all resources defined in the configuration. This uses the standard CLI workflow to communicate the destructive changes directly to the remote workspace.
Q21. You have a tiered module structure for building your infrastructure. Your root module calls a network module, which internally calls a subnet module to retrieve subnet IDs. You also want to use these subnet IDs in the root module. What mus…
Answer: D. The network module must define an output that exposes the subnet IDs from its child subnet module, then the root module can access it via module.network.subnet_ids
Module outputs do not automatically bubble up through nested tiers. An intermediate module must explicitly declare an output block to expose a child module's value to the root configuration.
More HashiCorp Certified Terraform Associate 004 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.