HashiCorp Certified Terraform Associate 004 Practice Test – 254 Free Exam Questions with Answers

Correct answer: A. True

The terraform destroy command requires interactive confirmation by default to prevent accidental infrastructure deletion. You can bypass this safety prompt using the dash dash auto-approve flag during automation workflows.

Correct answer: B. TF_VAR_

Environment variables intended to set Terraform inputs must use the TF_VAR_ prefix followed by the variable name. The other prefixes are invalid because Terraform strictly matches this specific pattern when populating the root module variables.

Correct answer: C. terraform plan -refresh-only

The plan with refresh-only flag updates state to match current real-world values without proposing infrastructure changes. Apply would attempt to modify infrastructure, which violates the requirement.

Correct answer: D. It provides a common workflow and reusable modules, enabling consistent CI/CD and policy across clouds.

A single declarative tool provides a standard workflow using reusable modules across different providers. Do not assume it eliminates cloud-specific APIs or credentials; it simply standardizes the deployment process.

Correct answer: B. Add a validation block that checks the variable equals 2 and provides an error message if it does not.

A variable validation block actively enforces business logic by failing the plan if the input does not equal two. Simply setting a default value does not prevent users from overriding it.

Correct answer: C. terraform init -reconfigure

The -reconfigure flag forces Terraform to ignore the previous backend configuration and prevents any automatic state migration. Use -migrate-state instead if you actually want to copy state.

Correct answer: D. The network module did not define an output block that exports the VPC ID, resulting in the error.

Child module resources are hidden from the parent unless an output block explicitly exports them. The other options are invalid because module outputs are referenceable during plan and require no data blocks or root variables.

Correct answer: B. the Terraform public registry

Using a source string with the namespace, name, and provider format points directly to the public Terraform Registry. The other options are incorrect because local paths use absolute or relative file references, not slash-separated registry identifiers.

Correct answer: A. The EC2 instance labeled web_server

Referencing an attribute from another resource creates an implicit dependency that Terraform automatically resolves in the graph. The S3 bucket is an explicit dependency created by the depends_on argument, not an implicit one.

Correct answer: A. a read-only construct that queries provider APIs and returns attributes for use elsewhere in the configuration

A data source is a read-only construct that queries provider APIs to fetch existing infrastructure attributes for use elsewhere. It does not create resources, persist variables, or cache values between runs.

Correct answer: A. length(var.subnet_cidrs)

The length function returns the total number of elements contained within a given list or string. The contains function checks for a specific value, while keys and values target map objects rather than simple lists.

Correct answer: A. No changes. Block order doesn't affect the plan because Terraform parses all .tf files in a module together during execution.

Terraform parses all configuration files within a module together, making resource block order completely irrelevant to the execution plan. Distractors suggesting replacements or minor changes confuse Terraform with imperative scripting languages.

Correct answer: A. Terraform uses declarative configuration to describe the desired end state and generates a plan of action before applying changes.

Infrastructure as Code relies on declarative configuration to describe the desired end state rather than imperative step-by-step logic. Terraform does not automatically update resources later without an explicit apply process.

Correct answer: B. Real infrastructure has changed outside Terraform and no longer matches the desired state.

Drift means real infrastructure has changed outside Terraform and no longer matches the desired state. The other options describe pure configuration or backend changes, which do not represent infrastructure drift.

Correct answer: B. HCP Terraform private registry

The private registry allows you to securely publish and maintain custom modules restricted to your organization. Public registry modules are visible to everyone, and VCS integrations only link source code.

Correct answer: C. Terraform can no longer track the resources it manages, so the next plan or apply might attempt to create duplicate resources.

Deleting local state severs Terraform's tracking of managed resources, causing the next apply to attempt creating duplicates. Terraform cannot magically reconstruct state from variables or provider APIs.

Correct answer: C. to automatically queue a new run in one workspace after another workspace applies successfully

Run triggers automatically queue a workspace run immediately after another specified workspace applies successfully. They orchestrate dependencies between workspaces, whereas credentials or approvals use different features.

Correct answer: D. The .terraform/ directory stores Terraform's local working data, including installed provider and module plugins and backend metadata.

This directory stores local working data like installed provider and module plugins plus backend metadata. Terraform downloads these during initialization, whereas sensitive state and credentials are stored elsewhere.

Correct answer: B. it retrieves the VPC's ID and creates an implicit dependency

Referencing the VPC resource retrieves its ID and creates an implicit dependency, ensuring correct creation order. Terraform handles resource dependencies automatically through these references instead of manual ordering.

Correct answer: D. add an output block to the subnet module and pass the value for the load balancer module using module.subnets.subnet_id

You must add an output block in the child module to expose the subnet ID, then reference it in the root module. Resources created inside a module are hidden from the root configuration unless explicitly exported as outputs.

Correct answer: D. on HCP Terraform infrastructure with results streamed back to your terminal

In a CLI-driven workflow, plan operations execute remotely on HashiCorp infrastructure with results streamed to your terminal. Local execution is bypassed entirely to ensure consistent runs and enable collaboration features.

Correct answer: B. True

Referencing resource attributes creates implicit dependencies that dictate execution order. The attachment block references both the volume and instance identifiers, so Terraform automatically waits for them.

Correct answer: C. run terraform apply bk-project.tfplan to execute the saved plan

Applying a saved plan file executes the exact changes that were reviewed and approved. Without a plan file, Terraform recalculates the diff, bypassing your change management process.

Correct answer: B. Define the provider in required_providers and add a matching provider block in the configuration.

The required_providers block specifies source addresses and versions for providers. Terraform downloads them during initialization, whereas manual binary placement is unsupported.

Correct answer: B. Run terraform init to install the module into the current working directory.

Running initialization downloads modules from their configured sources and caches them locally. Terraform never downloads modules automatically during a plan.

Correct answer: A. to pin a specific module release and avoid unexpected upgrades

Pinning the version prevents unexpected breaking changes when module authors publish new releases. This argument constrains the module code, not the Terraform CLI or provider versions.

Correct answer: D. Terraform is an immutable, declarative Infrastructure as Code language based on HashiCorp Configuration Language or JSON.

Terraform uses a declarative syntax where you define the desired end state. Distractors mentioning imperative or mutable workflows describe traditional configuration management tools.

Correct answer: C. terraform fmt

The formatting command rewrites configuration files to canonical style in a single pass. Validation checks syntax, while initialization downloads plugins.

Correct answer: A. terraform plan

The plan command generates an execution plan showing proposed changes before deployment. This allows teams to catch errors before any infrastructure is modified.

Correct answer: D. prevents concurrent runs from writing to the same state at the same time to avoid state corruption.

State locking prevents concurrent operations from corrupting the state file. It ensures serial execution, while caching and encryption are separate backend features.

Correct answer: C. TF_LOG

Setting the log environment variable activates verbose output for troubleshooting. The other variables are not recognized by Terraform for this purpose.

Correct answer: C. During terraform validate or terraform plan, before attempting to create any resources

Variable validation blocks are evaluated during the planning phase to ensure that assigned values meet the configured conditions before any changes are applied. The initialization command only downloads providers and modules, so validation errors are correctly reported during validation or planning commands.

Correct answer: C. builds a graph of dependencies to perform create/update/destroy operations from it

Terraform builds a dependency graph to determine the correct order of operations for creating, updating, and destroying resources. The configuration does not execute resources based on file ordering, nor does it rely on cloud provider APIs to manage dependencies during a run.

Correct answer: C. terraform validate

The terraform validate command checks general syntax and internal consistency without accessing cloud APIs. Avoid confusing it with terraform fmt, which only rewrites files to canonical formatting.

Correct answer: B. The .terraform/providers directory in the current working directory

Terraform stores downloaded provider plugins in the hidden .terraform/providers directory inside your current working directory. This local cache keeps dependencies isolated to your specific workspace.

Correct answer: D. Use the import block to import the existing resources under Terraform management.

The import block safely brings manually created cloud resources into Terraform state without causing downtime. Manually deleting or recreating them violates the requirement to avoid disruption.

Correct answer: B. alias

The alias meta-argument is required to define multiple configurations for the same provider within a module. Without alias, Terraform throws a duplicate provider configuration error.

Correct answer: D. Run terraform init so Terraform downloads the plugin for the newly added provider.

Running terraform init downloads the necessary plugins whenever new providers are added to a configuration. Plan will fail until initialization completes because the local binaries are missing.

Correct answer: C. In each directory (/dev, /staging, and /prod) since each is a separate working directory.

Terraform initializes the current working directory, so you must run terraform init inside each environment directory separately. Initialization cannot cascade automatically across subdirectories.

Correct answer: C. HCP Terraform only stores and syncs the workspace's state file, while you run plan and apply locally on your own machine.

Local execution mode restricts HCP Terraform to only storing and syncing the workspace state file. Plan and apply operations execute locally on your machine, eliminating remote execution while preserving remote state management.

Correct answer: D. these are module-specific inputs that are passed into the child module used for resource creation

These arguments are module-specific inputs passed into the child module for resource creation. Variables declared inside the child module must be set by the calling root module, whereas outputs flow outward.

Correct answer: C. No, the version argument is optional, but it is recommended to ensure consistent and reproducible deployments

The version argument in a module block is optional, though specifying it is strongly recommended to guarantee consistent and reproducible deployments. Without a version constraint, Terraform defaults to the latest available version, which introduces the risk of unexpected infrastructure changes when the module is updated.

Correct answer: B. Remove the database and backup resource blocks from your configuration, then run terraform apply.

The most standard method to decommission resources is removing their blocks and running terraform apply. However, the removed block feature is also a valid option, making this question slightly ambiguous.

Correct answer: C. terraform apply -replace=<address>

The terraform apply dash replace command targets a specific resource address and forces Terraform to destroy and recreate it. The dash refresh dash only flag only syncs state with reality, and standard apply commands will ignore resources lacking configuration drift.

Correct answer: C. Infrastructure as Code allows infrastructure to be described using a configuration syntax that can be versioned, reused, and shared.

Infrastructure as Code uses declarative configuration files that can be versioned, shared, and reused. Manual approaches lack this repeatable structure, and Terraform still relies on cloud APIs to provision resources.

Correct answer: D. A validation block on cluster_endpoint requires a non-empty value when create_cluster=false, so input evaluation failed and Terraform cannot produce a plan.

Custom variable validation rules evaluate before the execution plan is generated. If an input fails a validation condition, Terraform stops immediately, distinguishing this from a resource precondition which evaluates later.

Correct answer: A. add a lifecycle block with create_before_destroy = true

Setting create_before_destroy to true inside a lifecycle block forces Terraform to provision the replacement resource first. This avoids downtime, whereas prevent_destroy would block the required recreation entirely.

Correct answer: A. Logging will show you the detailed interactions between Terraform and the provider API and help you identify where the unexpected behavior occurs

Enabling debug logging exposes the detailed API requests and responses between Terraform and the provider. This reveals how the provider interprets configuration, whereas logs cannot fix syntax or back up state automatically.

Correct answer: C. terraform fmt -check

The terraform fmt -check command tests whether files are properly formatted without modifying them. The -diff option shows proposed changes, but only -check exits with an error code for CI pipelines when formatting is incorrect.

Correct answer: D. provider

Terraform providers act as plugins that interact with external APIs to manage infrastructure resources. Modules, backends, and variables are configuration components but do not serve as the executable plugins required for provisioning.

Correct answer: B. terraform validate

The terraform validate command checks if your configuration is syntactically valid and internally consistent without accessing remote services. The fmt command only formats code, while apply modifies real infrastructure.

Correct answer: A. run tasks

HCP Terraform run tasks integrate external tools like security scanners between the plan and apply phases. Run triggers simply chain workspaces together, and health assessments evaluate infrastructure against specific policies.

Correct answer: B. Define the S3 backend in the terraform block using a backend block – run terraform init to migrate your local state.

Configuring the S3 backend inside the terraform block and running terraform init automatically migrates local state to the remote bucket. The init command sets up backends, whereas variables cannot be used in backend configurations.

Correct answer: D. add a postcondition in the lifecycle block of the instance resource

Postconditions are evaluated after a resource is created or updated, making them ideal for verifying expected attributes like a public IP address. Preconditions are evaluated before the resource action, while check blocks and generic validation blocks do not operate within the resource lifecycle.

Correct answer: B. var.metadata["build-tag"]

Map elements whose keys contain hyphens must be accessed using bracket notation with quoted strings. The dot syntax is reserved for valid identifiers, making option B the correct choice.

Correct answer: B. The .terraform.lock.hcl file is a dependency lock file used by Terraform. It is created or updated every time you run terraform init.

The .terraform.lock.hcl file is a dependency lock file that ensures consistent provider versions across your team. Terraform creates or updates this file automatically whenever you run the terraform init command.

Correct answer: D. run terraform plan followed by terraform apply to import the resource

The modern config-driven approach uses import blocks to declaratively manage existing resources. After adding the block, you run terraform plan to preview the import, followed by terraform apply to execute it.

Correct answer: D. Convert the hard-coded values to input variables and provide environment-specific settings via tfvars or variable sets at plan/apply.

Input variables allow you to parameterize a module so it can be reused across different environments without altering the source code. You then provide environment-specific values using variable definitions files or variable sets.

Correct answer: B. the resource will be updated in place

A tilde in the plan output indicates that Terraform will update the resource in place. A plus sign means creation, a minus sign means destruction, and a plus-minus indicates replacement.

Correct answer: B. False

Terraform automatically builds a resource graph by analyzing implicit dependencies from expression references. The depends_on argument is only needed as an override when no implicit resource reference exists in the configuration.

Correct answer: A. providers are released on a separate schedule from Terraform itself; therefore, a newer version could introduce breaking changes

Providers are downloaded and updated independently from the Terraform CLI. Pinning provider versions prevents unexpected breaking changes or updates from altering your infrastructure state. The versions do not inherently match the CLI or application versions.

Correct answer: B. False

Not all remote backends support state locking natively. Always verify the locking capabilities of your specific backend to prevent race conditions. State locking is heavily dependent on the underlying remote storage service.

Correct answer: A. in the current working directory in a file named terraform.tfstate

Terraform stores state locally in a file named terraform dot t f state when no backend is configured. This local file serves as the baseline for future runs until a remote backend is initialized.

Correct answer: C. Terraform compares the desired state in the configuration with the current state in the state file to build the plan

Terraform builds an execution plan by comparing your desired configuration files against the current state file. It then determines what create, update, or destroy actions are required to reach the desired state.

Correct answer: C. Declare variable "env" {} in the child module and pass it from root using env = var.env

Child modules do not automatically inherit variables from the root module. You must explicitly declare the variable in the child module and pass its value using the module block arguments in the root module.

Correct answer: B. merge(var.common_tags, local.resource_tags)

The merge function takes multiple maps and combines them into a single map. This is the correct method for combining multiple tag sets, whereas flatten and concat are reserved for working with sequences and lists.

Correct answer: C. run terraform validate

The validate command checks your configuration files for syntax and internal consistency without accessing cloud providers. Running a plan would also check syntax but requires cloud credentials and takes longer to execute.

Correct answer: D. the output of another module

The value for vpc underscore security underscore group underscore ids comes from an output of another module, specifically the vpc module. Prefacing an address with the module keyword followed by a name indicates that the value originates from a module output rather than a variable.

Correct answer: A. False

Moved blocks must remain in the configuration long enough for all users and automation to process the state migration successfully. Removing them prematurely causes Terraform to view the new address as an untracked resource, triggering an unexpected destroy and recreate operation.

Correct answer: C. required_providers

The required_providers block specifies provider source addresses and version constraints. Distractors like provider or backend handle different configuration needs, while required_version targets the Terraform binary itself.

Correct answer: A. To bring the database under Terraform management so future changes can be tracked and managed through your IaC workflow.

Terraform import brings manually created resources under state management so future updates follow your code workflow. It does not automatically write code, validate compliance, or optimize performance.

Correct answer: B. Only values passed to it via the module block since root variables are not automatically accessible inside the module.

Child modules must explicitly receive variables through their module block. Terraform isolates module scopes, so root variables and locals are not inherited automatically, ensuring modules remain reusable and self-contained.

Correct answer: D. terraform.tfstate

The state file tracks real infrastructure and sensitive data, so it must be excluded from version control. Configuration files and the lock file belong in Git to ensure consistent provider versions across the team.

Correct answer: B. Terraform creates an execution plan and determines what changes are required to achieve the desired state in the configuration files.

The terraform plan command creates an execution plan by comparing the current state to the desired configuration. The apply command executes changes, while plan simply determines what changes are required.

Correct answer: A. True

Marking an output as sensitive only masks the value in the command line output and logs. Sensitive values are still stored in plaintext within the state file, requiring strict access controls.

Correct answer: D. Use Terraform state commands terraform state show to match the tracked VM's ID with the list of active VMs.

Inspecting the state with terraform state list or terraform state show correctly identifies tracked resources without making changes. Manually updating configurations or deleting untracked VMs risks unintended infrastructure modifications.

Correct answer: C. define the backend block with only the type, then pass the bucket and region values using -backend-config flag during terraform init

Partial backend configuration allows you to define the backend type in code while passing sensitive arguments dynamically during terraform init using the -backend-config flag. Variable definitions and environment variables are not evaluated during backend initialization.

Correct answer: B. update the Terraform configuration file to include new resource blocks that match the resources you want to import

Before importing an existing resource, you must write a matching resource block in your configuration. While newer Terraform versions support declarative import blocks, the traditional imperative terraform import command explicitly requires the resource block first.

Correct answer: A. terraform state list

The terraform state list command provides a high-level list of all resources tracked in the state file. The terraform show command displays detailed attributes, which is unnecessary if you only need resource addresses.

Correct answer: A. Second – google_compute_attached_disk.data

The attached disk resource references the compute instance name, creating an implicit dependency. Terraform uses this graph to determine operation order, ensuring the compute instance is created before the disk attachment.

Correct answer: D. use a data block to reference the existing VNet, then create your VM resources that use attributes from the data source

Use a data block to reference existing infrastructure managed outside your configuration. This allows you to retrieve attributes like a VNet ID without taking ownership of the resource, leaving the network team responsible for its lifecycle.

Correct answer: B. True

A single Terraform configuration can declare and use multiple providers. This allows you to orchestrate multi-cloud environments or manage resources across different services within the same set of files.

Correct answer: C. Configure different enforcement levels for each policy set and apply them to the appropriate workspaces or projects.

Policy sets in HCP Terraform can be assigned specific enforcement levels like advisory or mandatory, and scoped to particular workspaces or projects. Run triggers handle dependencies between workspaces and cannot enforce compliance or selectively apply policy rules.

Correct answer: B. 1

An HCP Terraform workspace can only be linked to a single VCS repository. This ensures that infrastructure deployments are strictly tied to one central source of truth for configuration tracking.

Correct answer: B. applies the changes required in the target infrastructure in order to reach the desired configuration

The terraform apply command executes the actions proposed in the execution plan to reach the desired configuration state. This differs from terraform plan, which only proposes changes, and init, which prepares the directory.

Correct answer: B. source = "./modules/btk-cluster" · E. main.tf is the root (calling) module

The main.tf file acts as the root calling module, and the source path points to a local child module on disk. Terraform does not download local modules from the public registry, and the servers argument is an input variable, not an output.

Correct answer: D. a plugin that Terraform uses to translate the API interactions with the service or provider

A provider acts as a plugin that allows Terraform to interact with external services by translating configuration into API interactions. The other options define resources, modules, and variables, which are core configuration components rather than the providers themselves.

Correct answer: D. defining multiple configurations of the same provider and binding resources to them

A provider alias allows you to define multiple configurations for the same provider, such as deploying resources to different AWS regions. You then bind specific resources to these alternate configurations using the provider meta-argument.

Correct answer: D. Importing only adds the resource to Terraform state and you need to add the resource block to match the existing bucket settings.

The terraform import command only maps the existing real-world resource into your Terraform state file. It does not automatically generate the corresponding HCL configuration, which you must manually write to match the imported resource.

Correct answer: D. Sentinel and OPA

HCP Terraform integrates with policy-as-code frameworks like Sentinel and Open Policy Agent. These tools evaluate your Terraform plan before execution, allowing you to enforce security, compliance, and cost guardrails.

Correct answer: C. The terraform validate command checks for syntactic correctness but does not communicate with the provider's API to validate resource-specific values.

The validate command checks syntax and internal consistency without connecting to cloud provider APIs. Provider-specific arguments like instance types are only validated during the plan or apply phases when Terraform queries the actual provider.

Correct answer: A. JSON format containing resource metadata, attributes, dependencies, and potentially sensitive values in plaintext

The local terraform.tfstate file uses JSON format to store resource metadata, attributes, and dependencies. This state file may also contain sensitive values in plaintext if they are not explicitly marked as sensitive by the provider.

Correct answer: B. Terraform will return an error stating that var.environment is not declared in the child module

Variables defined in the root module are not automatically inherited by child modules. You must explicitly declare the variable inside the child module and pass the value using the module block arguments, or Terraform will return an error.

Correct answer: D. reference the database resource's connection string attribute in the web app configuration

You should directly reference the database resource attribute to pass the dynamically generated connection string. This creates an implicit dependency, ensuring Terraform waits for the database creation to finish before deploying the web app.

Correct answer: C. managing and provisioning infrastructure using machine-readable definitions stored in version control.

Infrastructure as Code relies on machine-readable definition files stored in version control systems. This enables automated, consistent, and repeatable deployments while avoiding manual configuration drift associated with clicking through graphical interfaces.

Correct answer: B. Use the HCP Terraform Private Registry to make sure your organization only uses approved modules.

The HCP Terraform Private Registry allows organizations to securely share and manage approved internal modules. Organization permissions alone cannot easily restrict module usage across different projects without this centralized registry.

Correct answer: B. add a moved block to indicate the address change directly in your configuration

Adding a moved block to your configuration lets Terraform safely update the state address without destroying the resource. The import block is meant for bringing in unmanaged resources, while the replace flag forces resource recreation.

Correct answer: D. Using declarative IaC and immutable infrastructure allows you to define the desired state in code, easily replace resources, and version everything.

Infrastructure as Code uses declarative configurations to define desired state and supports immutable infrastructure patterns. This reduces configuration drift and allows straightforward rollbacks by versioning and deploying entirely new resources.

Correct answer: D. update all previously installed plugins and modules to the newest version that complies with the configuration's version constraints

The terraform init -upgrade command updates all previously installed plugins and modules to the newest available versions. It disregards the dependency lock file while still strictly honoring the version constraints defined in your configuration.

Correct answer: C. data.aws_vpc.production.id

To reference attributes from a data source, you must prefix the expression with the data keyword followed by the type and name. Therefore, the correct reference for the VPC identifier is data dot aws_vpc dot production dot id.

Correct answer: C. It will install the newest provider version that matches the ~> 6.0.0 constraint, which is 6.0.5.

The upgrade command honors your configured version constraints while grabbing the newest allowed release. The pessimistic constraint tilde greater than six point zero point zero restricts updates to patch releases, meaning it selects six point zero point five.

Correct answer: C. An object type defines a fixed structure with specific attribute names and types, while a map allows any keys with values of the same type.

An object type defines a fixed structure with specific named attributes and their individual types, while a map requires all values to share the same type. Option D is incorrect because objects and maps enforce completely different structural constraints and are not interchangeable.

Correct answer: D. terraform plan -out=lb.tfplan → terraform apply lb.tfplan

Saving an execution plan to a file with terraform plan -out creates a definitive record of the exact changes. Applying that specific plan file later guarantees Terraform executes only the reviewed actions, eliminating the risk of unreviewed drift.

Correct answer: C. name = join("-", [var.environment, var.region, var.app])

The join function concatenates the elements of a given list into a single string separated by a chosen delimiter. The concat function is the trap here because it combines lists rather than creating a hyphenated string.

Correct answer: D. terraform apply -refresh-only

The terraform apply -refresh-only command reconciles the state file with real-world infrastructure to detect drift. This operation updates the state to reflect manual changes without modifying the actual infrastructure.

Correct answer: B. TF_LOG_PATH

Setting the TF_LOG_PATH environment variable directs Terraform to write its detailed logs to a specific file. The TF_LOG variable simply controls the verbosity level but does not specify the destination file.

Correct answer: B. Infrastructure as Code tools focus on provisioning and managing the lifecycle of infrastructure resources, while configuration management tools focus on installing and managing software on existing servers.

Infrastructure as Code tools like Terraform provision and manage underlying infrastructure resources across their lifecycle. Configuration management tools like Chef install and manage software on those existing servers.

Correct answer: B. 3.2.5

The pessimistic constraint operator limits updates to the newest patch version within the specified minor release. Because three is the minor version, Terraform selects the highest patch within the three dot two range.

Correct answer: D. Add a cloud block inside the terraform block that sets the HCP Terraform organization and workspace to use for this working directory.

The cloud block inside the terraform configuration connects local directories to HCP Terraform for remote execution and state management. Provider and backend blocks are incorrect because they handle external APIs or legacy state storage.

Correct answer: D. none of the above

Terraform stores all resource attributes in plaintext in the state file, meaning none of these methods can prevent sensitive data from being saved. To protect credentials, you must strictly secure the state file itself.

Correct answer: D. terraform console

The terraform console command opens an interactive shell to test expressions and functions using current state and variables. Other commands like plan, show, or output only display generalized state or planned changes without interactive testing.

Correct answer: C. Terraform will follow the dependency chain: subnet, virtual network, resource group

Terraform determines destruction order by analyzing resource dependencies, destroying children before parents. The subnet is destroyed first, followed by the virtual network, and finally the resource group.

Correct answer: C. Terraform will create the resources defined in the configuration file and write a new state file.

Without a prior state file, Terraform safely assumes the infrastructure does not exist and creates everything defined in the configuration. It then writes a new state file tracking those newly created resources.

Correct answer: C. terraform fmt

The terraform fmt command automatically formats code to canonical standards, ensuring consistency across your configuration files. Plan and validate evaluate configuration logic, while env manages workspaces.

Correct answer: B. False

Terraform uses a local backend by default if a remote backend is not explicitly configured. Remote backends are optional and primarily enhance collaboration, security, and remote state management.

Correct answer: A. aws_instance.svc_apps["frontend"]

When using the for_each meta-argument, Terraform creates a map of resources. You must reference the specific resource using the map key inside brackets, such as aws_instance.svc_apps["frontend"].

Correct answer: B. terraform state list

The terraform state list command provides a concise list of resource addresses managed in the current state. Options like terraform show or state show dump detailed configurations, making them unsuitable for a quick resource count.

Correct answer: C. create a new resource block in your configuration for the aws_instance resource in the Terraform configuration file

Terraform requires a matching resource block in your configuration before it can successfully import and manage an existing resource. Data blocks are only for reading attributes, while ignore changes hides drift rather than enabling management.

Correct answer: B. The remaining virtual machine was not created by Terraform; therefore, Terraform is unaware of it and cannot destroy it.

Terraform can only destroy resources that it tracks inside its state file. If a virtual machine was created outside of Terraform, the tool remains completely unaware of its existence and safely leaves it running during destruction.

Correct answer: D. a variable is being used in a resource block but has not been declared

The terraform validate command checks syntax and internal consistency without accessing cloud APIs or existing state. It specifically catches referencing an undeclared variable, whereas configuration drift and missing state require evaluating infrastructure.

Correct answer: D. Terraform provider

Providers act as the bridge between Terraform and external systems by defining resource schemas and handling API interactions. Provisioners, backends, and modules serve entirely different purposes like bootstrapping scripts, storing state, or organizing configurations.

Correct answer: B. False

Terraform does not mandate running a plan separately because the apply command automatically generates an execution plan and prompts for approval. You only need to run plan manually if you want to review changes without applying them.

Correct answer: B. values like bucket name, key, and region, but not computed values or variables

Backend blocks require static literal values and cannot reference variables, locals, or data sources because Terraform must configure the backend before loading the rest of the configuration.

Correct answer: B. a tfe_outputs data source that references the prod-webserver workspace

The tfe_outputs data source retrieves output values from another HCP Terraform workspace. Standard variables require manual updates, while dynamic blocks iterate over complex local data and cannot fetch remote state.

Correct answer: B. .tfvars file

Terraform uses .tfvars files to assign variable values, which automatically override any defaults set in the configuration. Template files are for dynamic generation, while state files store deployed resource data.

Correct answer: A. execute Terraform plans and apply changes to isolated, private, or on-premises infrastructure

HCP Terraform agents execute plans and applies against isolated, private, or on-premises infrastructure from within restricted networks. They do not provide workspace management, remote monitoring, or state file storage capabilities.

Correct answer: A. The sensitive flag only prevents the value from appearing in the CLI output, but it is still stored in plain text in the state file.

The sensitive flag prevents values from displaying in standard CLI output but does not encrypt the state file. Anyone with read access to the state file can view the raw plain text values.

Correct answer: B. operations: us-west-2

Resources use the default provider configuration unless the provider meta-argument specifies an alias. The operations bucket is explicitly set to use the aws.west provider, placing it in us-west-2. The logs bucket lacks an alias and does not have a matching option for its default us-east-1 region.

Correct answer: C. Add a data block to your configuration to query the existing resource. Use the available exported attributes of that resource type as needed throughout your configuration to get the values you need.

Data blocks query existing cloud resources to read their exported attributes dynamically. Hardcoding IDs in variables is discouraged, and attempting to import into a resource block is meant for taking over management, not just reading attributes.

Correct answer: B. use run triggers that connect the networking workspace to the application workspace

Run triggers connect HCP Terraform workspaces to automatically queue a speculative plan in a downstream workspace. They trigger the application workspace automatically after the upstream networking workspace successfully applies.

Correct answer: C. Define and provision infrastructure using code for consistent, repeatable deployments.

Infrastructure as Code defines cloud resources using high-level configuration files to ensure consistent, repeatable deployments. This eliminates manual configuration errors and directly supports automated provisioning workflows.

Correct answer: C. output blocks provide a way to expose specific resource attributes for use without requiring others to parse the entire state file.

Output blocks expose specific resource attributes like IDs without requiring users to parse the entire state file. Terraform automatically tracks resources in state regardless of outputs, which eliminates the other options.

Correct answer: A. The Terraform version setting in HCP Terraform workspace is still set to an older version and needs to be updated to 1.12.0 or later.

HCP Terraform workspace settings dictate the exact Terraform version used for execution. If the workspace is pinned to an older version, the required_version constraint will fail until the workspace setting is manually updated.

Correct answer: D. Terraform detects the missing instance and shows that it will recreate the resource

Terraform reconciles the current state file against your configuration and the real infrastructure. When a managed resource is deleted manually, the plan detects the drift and proposes recreating it to match your code.

Correct answer: B. Terraform writes state to a file named terraform.tfstate in the current working directory.

By default, the local backend writes state to a file named terraform dot tfstate in the current working directory. It does not provide remote collaboration, encryption, or cloud-based locking.

Correct answer: D. the security group will show as needing updates to revert the manual changes and match your configuration

Terraform plan compares your desired configuration against the real infrastructure, detecting any drift. The plan will propose changes to revert the manual security group edits and match your code.

Correct answer: C. terraform init

Whenever you add a new module block, you must run terraform init to download the module and its providers. Plan and apply will fail if the working directory is not initialized first.

Correct answer: D. terraform apply -replace="aws_instance.database"

The terraform apply -replace flag forces the destruction and recreation of a specific resource without altering its configuration. Avoid manual destroy commands or targets, because they can disrupt dependency ordering and leave the configuration out of sync.

Correct answer: D. run terraform plan -out=thomas

The terraform plan command with the out flag saves an execution plan to a file for later application. The refresh-only flag merely syncs state with real infrastructure, while show and output simply display existing data.

Correct answer: D. The VM exists in Azure and is recorded in state, but the NSG does not exist. You can run apply again to create the NSG.

Terraform writes successfully created resources to the state file immediately during an apply. It does not roll back partial deployments, so the virtual machine remains tracked while the security group is simply skipped.

Correct answer: C. supply the credentials using environment variables on the machine executing plan/apply

Supplying credentials via environment variables keeps them completely out of configuration files and the local directory. Passing secrets through backend config files risks writing them to disk, and standard variables might be saved inside plan files.

Correct answer: C. Run terraform init to set up the working directory and install providers.

The initialization command prepares the working directory by downloading required provider plugins and configuring the backend. Skipping this step prevents Terraform from recognizing providers, so always initialize your directory before planning or applying changes.

Correct answer: C. terraform state show aws_instance.frontend

The state show command displays detailed attributes for a specific resource tracked in the current state. The general show command requires a state file path, while state list merely outputs resource addresses without attributes.

Correct answer: B. terraform init -migrate-state

Running initialization with the migrate state flag transfers existing local state to a newly configured remote backend. Plan and apply commands cannot execute backend migrations, making initialization mandatory when changing state storage locations.

Correct answer: B. us-west-2 from the provider block configuration

Explicit arguments defined in a Terraform provider block always take precedence over default provider environment variables. The AWS provider will use the us-west-2 region because explicit configuration overrides the AWS_REGION environment variable.

Correct answer: B. us-central1

Variable values defined in a terraform.tfvars file automatically override default values declared in a variable block. The file provides explicit variable assignments, ensuring us-central1 is used.

Correct answer: B. create a variable set in HCP Terraform and assign it to all workspaces so shared credentials are updated

Variable sets allow you to define variables and credentials once and share them across multiple HCP Terraform workspaces. You can update shared values centrally without manually editing individual workspaces.

Correct answer: A. teams can use the same workflow and configuration language for both clouds

Terraform provides a unified workflow and a single configuration language for managing multiple cloud providers. It does not abstract away provider-specific resources, but it standardizes your deployment process.

Correct answer: B. in the .terraform/modules subdirectory in the current working directory

During initialization, Terraform downloads referenced modules into the hidden dot-terraform subdirectory. This local cache allows Terraform to reuse the modules for subsequent operations without downloading them again.

Correct answer: C. Use Infrastructure as Code to declare resources and automate reproducible provisioning.

Infrastructure as Code uses declarative configuration files to automate provisioning and ensure environments are reproducible. Version control integration directly satisfies the requirement for history and identical deployments across multiple regions.

Correct answer: A. Explorer

The HCP Terraform Explorer feature allows users to search across all workspaces within an organization to identify specific managed resources. The other listed utilities do not exist as built-in platform features.

Correct answer: B. terraform validate

The terraform validate command checks configuration files for syntax errors, including incorrect argument names like an instance type typo. The format command only checks stylistic spacing, while plan evaluates against the provider schema.

Correct answer: B. expressions with built-in functions

Expressions with built-in functions allow you to transform, combine, and derive values for resource arguments in Terraform. While variables hold raw inputs, functions provide the required data manipulation capabilities.

Correct answer: A. It contains the previous state before the most recent apply, allowing manual recovery if the current state becomes corrupted

The terraform.tfstate.backup file stores the previous state before the most recent apply operation. This serves as a manual recovery point if the primary state file becomes corrupted.

Correct answer: A. automatic state locking, centralized state storage, state versioning, and audit logs for compliance

HCP Terraform provides centralized state storage, automatic locking, versioning, and audit logs. Local backends lack these built-in collaboration and security features, eliminating the distractors.

Correct answer: B. maps and objects

Curly braces containing key-value pairs represent map and object types in Terraform. Lists and tuples use square brackets, while strings and numbers use basic literal syntax.

Correct answer: C. TF_LOG=TRACE

Setting the TF underscore LOG environment variable to TRACE enables verbose logging for troubleshooting. The other variables either do not exist or incorrectly attempt to assign log levels.

Correct answer: C. reference the subnet ID attribute in each instance's network interface block

You should reference the subnet resource's ID attribute within each instance configuration. This establishes explicit dependencies, whereas hardcoding values creates configuration drift and should be avoided.

Correct answer: B. True

HCP Terraform can function as a standard remote backend for local execution. While it also supports a remote operations mode that runs the CLI in the cloud, configuring it as a backend does not prevent you from executing plan and apply locally.

Correct answer: B. var.robots[2]

Terraform uses zero-based indexing for lists, meaning the first element is zero. The string r2d2 is the third item in the list, so it is accessed using the index two.

Correct answer: A. True

The terraform graph command outputs a visual dependency graph using the DOT language. It helps you understand resource relationships in either your current configuration or a saved execution plan.

Correct answer: A. run terraform init to download the newly required AWS provider

The terraform init command initializes the working directory and downloads any newly required provider plugins. Providers are not downloaded automatically during plan or apply, making initialization the required next step.

Correct answer: B. True

Terraform allows you to migrate state between supported backends at any time by updating the configuration and running terraform init. The tool automatically detects the changes and prompts you to migrate the existing state file.

Correct answer: A. False

A module block only accepts the version argument a single time, meaning you cannot declare it multiple times. To satisfy multiple conditions, combine the constraints using comma-separated operators within a single string.

Correct answer: B. Terraform reports the check failure as a warning but continues with the plan

Precondition and check block failures during a plan are reported as warnings rather than hard errors. This allows Terraform to output the proposed execution plan so you can review and correct the issue.

Correct answer: C. Define multiple provider blocks with different alias attributes and reference them in resources.

Provider aliases let one configuration target multiple subscriptions or regions. Option D is a valid operational workaround, but the question asks how to handle it in a single configuration, which eliminates separate directories.

Correct answer: A. False

By default, the format command only processes files in the current working directory. It ignores subdirectories unless you explicitly provide the recursive flag, ensuring standard code formatting without unexpected widespread changes.

Correct answer: A. Terraform automatically queries the real infrastructure to refresh state data before generating the plan, but doesn't save the refreshed state to the file

A standard plan automatically queries real infrastructure to refresh state data in memory before generating the plan. This ensures accuracy, but the state file is only updated during apply.

Correct answer: A. True

Linked HCP Terraform workspaces automatically trigger speculative plans on pull requests to preview changes. The trap option is false, which assumes manual intervention is required for previews.

Correct answer: A. True

Running apply on an import block adds the resource to Terraform state, linking it to your configuration. You can safely delete the import block after the apply completes because the resource management link is now persistent.

Correct answer: A. module "vnet" { · B. source = "Azure/network/azurerm" · C. version = "~> 5.0" · D. name = var.name · E. address_space = var.address_space · F. }

The required module block uses the registry source, the tilde greater than constraint for the major version, and unquoted variable expressions. The distractors use local paths or incorrect syntax that violates these registry rules.

Correct answer: F. since the variable was declared within the module, it cannot be referenced outside of the module

Variables declared inside a module are scoped locally and cannot be referenced by the parent configuration. The parent fails because the variable is undeclared at its root scope.

Correct answer: A. in the terraform.tfstate file in the current working directory using the local backend

Terraform CLI defaults to the local backend, storing state in a file named terraform dot t f state in your current working directory. The dot terraform directory only holds plugins and modules, not the active state file.

Correct answer: C. use a map to satisfy this requirement

A map is the correct variable type for storing key-value pairs. Lists and arrays provide sequential indexed collections, whereas a string only holds a single text value.

Correct answer: C. aws_subnet.app["private"].id

When a resource uses for_each with a map, Terraform creates a map of resources that you index by their string keys. Options relying on dot notation or numeric indexes fail because the resource is a map, not a list or object.

Correct answer: B. terraform import google_compute_instance.my_instance my-instance

The terraform import command maps existing infrastructure into your Terraform state. You must provide the resource address first, followed by the cloud provider's specific resource identifier, so apply and init are incorrect here.

Correct answer: B. the official Terraform public registry

Terraform resolves provider sources from the public registry by default, using the namespace and name as the address. It does not pull source code directly from GitHub or a local execution directory.

Correct answer: C. in the modules subdirectory in the current working directory where Terraform is being executed

A module source starting with dot slash indicates a local path relative to your current working directory. This tells Terraform to read the module directly from your local file system instead of fetching it from a registry.

Correct answer: A. export TF_VAR_user=dbadmin01

Terraform automatically reads environment variables prefixed with TF underscore VAR to populate input variables. Generic variables or TF underscore INPUT prefixes do not map to variable definitions in your configuration.

Correct answer: A. add a depends_on = [google_storage_bucket.data] to the IAM binding resource block

Use the depends on argument inside the IAM binding resource to force Terraform to create the bucket first. Lifecycle blocks only manage resource replacement behavior, and splitting applies breaks infrastructure as code management.

Correct answer: D. instance_count = var.environment == "prod" ? 5 : 2

The conditional expression in Terraform uses the format condition question mark true value colon false value. The other options are invalid syntax because Terraform does not support if then else statements or a lookup function with four arguments.

Correct answer: B. state locking

State locking prevents concurrent modifications by ensuring only one user can update infrastructure at a given time. Version control tracks code changes but does not lock live infrastructure deployments, while local backends and provisioners serve entirely different operational purposes.

Correct answer: B. run triggers between the two workspaces

Run triggers allow you to automatically start a new run in a downstream workspace whenever an upstream workspace successfully applies changes. Remote state data sources only read data passively, and run tasks execute external integrations rather than chaining workspace executions.

Correct answer: B. Remote backends provide state locking to prevent concurrent modifications and centralized storage for team collaboration.

Remote backends provide state locking and centralized storage, which are essential for safe team collaboration. The local backend can manage AWS resources, and state is always stored in JSON format regardless of the backend used.

Correct answer: A. downloads plugins and retrieves the source code for referenced modules

The terraform init command initializes a working directory by downloading necessary provider plugins and retrieving the source code for referenced modules. Formatting, validation, and state comparisons are handled by the fmt, validate, and plan commands respectively.

Correct answer: A. terraform fmt

The terraform fmt command automatically formats Terraform configuration files to canonical standards and alignments. The init command sets up the environment, while workspace and state commands manage multiple deployments and existing infrastructure mappings.

Correct answer: A. Variables are local to each module, and child modules can only access parent values when passed to them.

Input variables are scoped locally to each specific module and must be explicitly passed to child modules. Parent variables are never automatically visible to children, ensuring strict isolation and preventing unintended configuration overrides.

Correct answer: C. moved block

The moved block informs Terraform that a resource has changed its location within the configuration without altering the real infrastructure. This updates the state file safely to prevent Terraform from destroying and recreating the resource during the next apply.

Correct answer: A. The sensitive argument redacts values from CLI output and the HCP Terraform UI, but still stores them in state and plan files.

Marking a variable or output as sensitive redacts its values from command line output and graphical user interfaces. However, it does not prevent the values from being stored in plain text within state and plan files, which still require secure backend protection.

Correct answer: C. The dependency lock file still references 6.0.0, and terraform init without the -upgrade flag respects the lock file.

The dependency lock file ensures consistent provider versions are used across environments by locking them to specific versions. To upgrade past a locked version, you must run terraform init with the upgrade flag, regardless of the version constraint updates.

Correct answer: B. run terraform validate in the module directory after running terraform init

The terraform validate command checks syntax and configuration validity without contacting cloud APIs. You must run terraform init first to initialize the backend and download the necessary providers.

Correct answer: C. allow only patch releases within version 3.0.x, like 3.0.1 but not 3.1.0

The pessimistic constraint tilde 3.0.0 allows patch updates like 3.0.1 but blocks minor version upgrades like 3.1.0. This safely pulls bug fixes while avoiding breaking changes.

Correct answer: D. HCP Terraform runs a speculative plan and posts the results as a comment on the pull request

HCP Terraform automatically triggers a speculative plan during a pull request to preview changes. The results post directly to the pull request as a comment for review without modifying infrastructure.

Correct answer: A. False

Terraform always requires a state file to map configuration to real-world resources and track metadata. Even for simple deployments, state is generated automatically to maintain dependencies and track attributes.

Correct answer: C. configure a remote backend that supports locking and access control

Remote backends are the recommended way to share state because they provide state locking and support access controls. Committing state to version control is a security risk, and local files cannot be safely shared.

Correct answer: C. Terraform will create the subnet in the existing shared network without modifying the network itself

A data block reads information from an existing resource without managing it. Terraform will create the subnetwork but will leave the existing network completely unmodified.

Correct answer: C. module.storage.storage_account_name

To access values from a child module in the root module, use the syntax module dot module name dot output name. Var is strictly for input variables, while outputs is not a valid attribute.

Correct answer: B. version

Specifying the version argument constrains the module to a known release, preventing unexpected breaking changes. Without it, Terraform might pull the latest version and alter your infrastructure unexpectedly.

Correct answer: D. output block

An output block exports values from a child module so the parent module can reference them. Data blocks are only for reading existing resources, and resource blocks do not inherently expose attributes.

Correct answer: B. True

Terraform uses specific providers to interact with each unique platform via its API. Because each cloud or service has distinct endpoints, you must install the appropriate provider plugin for every platform you manage.

Correct answer: B. Terraform shows an error and requires you to run the command terraform init -upgrade

The lock file pins the provider version, so running plan will fail until you update it. To download the new version and update the lock file, you must run terraform init with the upgrade flag.

Correct answer: D. terraform init

The core Terraform workflow begins with init to initialize the directory and download required providers. You cannot run plan or apply successfully until this initialization step downloads the necessary plugins.

Correct answer: B. var.aws_region

Input variables are referenced using the var prefix. Distractors using variable fail because that block defines a variable but does not access its value at runtime.

Correct answer: A. False

HCP Terraform drift detection identifies differences between actual infrastructure and desired configuration, but it cannot automatically fix the detected drift. Users must manually review the drift report and apply necessary changes.

Correct answer: C. Terraform runs are managed and executed on HCP Terraform infrastructure

Remote operations in HCP Terraform execute runs on managed infrastructure rather than your local machine. This centralizes execution, providing consistent logs and controlled access to state and secrets.

Correct answer: A. Store credentials in an external secrets manager such as HashiCorp Vault and reference them in Terraform using data sources.

Best practice is to retrieve sensitive credentials from an external secrets manager like HashiCorp Vault. Hardcoding secrets or merely ignoring tfvars files is insecure because variables are still exposed in state files.

Correct answer: D. eliminates API communication to the target platform

Infrastructure as Code tools rely entirely on API communication to provision and manage resources. Distractors mentioning self-documenting infrastructure, code sharing, and versioning are all valid benefits.

Correct answer: D. terraform show

The terraform show command provides a human-readable output of the current state or a plan file. This allows you to inspect managed resources and their attributes directly from the CLI.

Correct answer: C. use the command terraform force-unlock <lock-id> to manually release the stuck lock

The terraform force-unlock command manually releases a stuck state lock using the specific lock ID. Deleting the state file or bypassing the lock introduces severe data corruption risks.

Correct answer: B. False

Enabling TF_LOG strictly adjusts verbosity for troubleshooting without altering workflow phases. Terraform safely maintains its standard initialization, planning, and applying execution steps.

Correct answer: B. place each team-related workspace into a team project

HCP Terraform projects let you group related workspaces to simplify organization and manage team access. Creating multiple organizations is excessive for a single company, while tags and variable sets do not enforce access controls.

Correct answer: A. Terraform will generate a new plan that may differ from the first one if any state or configuration changes occurred

Running terraform plan always evaluates the current configuration and state, generating a fresh plan. A previously saved plan file is not automatically reused unless explicitly passed to apply, so any external changes will yield a new plan.

Correct answer: B. Add a removed block with from = <address> to stop managing the web server, then run terraform apply followed by terraform destroy

The removed block is the correct way to safely stop managing a resource without destroying it, allowing you to subsequently destroy the rest of the stack. Distractors involving prevent_destroy or -target either fail the destroy step or require complex targeting.

Correct answer: C. Run terraform login, generate a user API token in the browser, and let Terraform store that token in ~/.terraform.d/credentials.tfrc.json for future commands.

The terraform login command opens a browser to generate an API token and stores it locally in the credentials dot tfrc dot json file. Committing access keys to source control is a severe security anti-pattern and does not authenticate the command line interface.

Correct answer: B. True

HCP Terraform provides fully managed remote state storage that includes automatic state locking. This locking mechanism prevents concurrent operations from corrupting the state file, ensuring safe team collaboration without requiring manual backend configuration.

Correct answer: C. Terraform acquires a lock to prevent state modification

Terraform acquires a state lock during the plan operation to prevent state modifications by concurrent runs. This ensures the state file does not change while the plan is being generated.

Correct answer: D. run terraform init -upgrade to update providers to the newest version matching the constraints

Running terraform init with the upgrade flag updates providers to the newest version matching your configured constraints. The dependency lock file pins provider versions, so a standard initialization alone will not bypass it.

Correct answer: D. terraform init -upgrade

Running terraform init with the upgrade flag updates your providers to the newest compatible version. The dependency lock file pins specific versions, so standard initialization ignores newer releases.

Correct answer: B. False

The state list and show commands are strictly read-only operations. They safely inspect resources during troubleshooting without modifying the state file, unlike destructive subcommands such as state remove or state move.

Correct answer: A. It locks provider versions and checksums to ensure consistent installs.

The .terraform.lock.hcl file locks provider versions and checksums to ensure consistent installs across environments. It does not cache plans, store state, or record variable defaults.

Correct answer: A. terraform init -upgrade

Running terraform init -upgrade updates dependencies to the latest allowed versions, including modules. The standard terraform init command will not override the locked version if it is already present in the lock file.

Correct answer: B. to track the mapping between resources in your configuration and real-world infrastructure

Terraform state tracks the mapping between resources in your configuration and real-world infrastructure. It is not a backup mechanism, syntax validator, or encryption tool for sensitive values.

Correct answer: D. use the -out flag

The -out flag saves the generated plan to a file for later application with terraform apply. There are no -save or -file flags, and saving plans is a core automation feature.

Correct answer: A. validate only checks syntax and internal consistency, not provider-specific requirements

The terraform validate command only checks syntax and internal consistency, not provider-specific requirements. The plan command actually connects to providers, revealing missing required arguments like region.

Correct answer: B. add a validation block inside the variable declaration

Adding a validation block inside the variable declaration enforces constraints before resources are created. Preconditions and postconditions apply to resource lifecycle phases rather than input variable evaluation.

Correct answer: C. run a terraform plan and validate the changes that will be made

The terraform plan command generates an execution plan that previews exactly which resources will be created, modified, or destroyed. Running validate only checks for syntax errors, and refresh only compares state to real infrastructure without showing config changes.

Correct answer: D. data block

A data block queries information about existing resources without managing or provisioning them. An import block is used to bring existing infrastructure under management, whereas a data block simply reads attributes for use in configuration.

Correct answer: D. Use registry.terraform.io search, open the module page, and copy its source address.

Public modules are discovered on the Terraform Registry, where you can review details and copy the exact source address. Guessing GitHub URLs or copying raw resource examples bypasses the official registry workflow and lacks the proper namespace, name, and provider formatting.

Correct answer: B. The resource block in your configuration does not exactly match all the settings of the existing virtual network, so Terraform wants to update the resource to match your code.

Terraform generates a plan to reconcile differences between your configuration and the current state. The drift occurs because the resource block does not exactly match the existing settings, causing Terraform to propose updates to align the infrastructure with the code.

Correct answer: C. a tracked request that lists planned changes for one or more workspaces so teams can manage a backlog of infrastructure work

A change request in HCP Terraform is a tracked request that lists planned changes for one or more workspaces. It helps teams manage a backlog of infrastructure work by organizing and documenting planned modifications.

Correct answer: C. subnet = module.prod_subnet.subnet_id

Module outputs are accessed using the module keyword, the module name, and the output name. This standard syntax allows you to pass data between different modules seamlessly.

Correct answer: D. Create a new team for the app team, add the users to it, and assign the team the Plan role on its workspaces.

Assigning the team the Plan role on its workspaces allows users to view state and queue runs. This role restricts variable edits and workspace settings, satisfying the least privilege requirement.

Correct answer: A. run terraform destroy in your local terminal while authenticated to HCP Terraform

Running terraform destroy in your local terminal removes all resources defined in the configuration. This uses the standard CLI workflow to communicate the destructive changes directly to the remote workspace.

Correct answer: D. The network module must define an output that exposes the subnet IDs from its child subnet module, then the root module can access it via module.network.subnet_ids

Module outputs do not automatically bubble up through nested tiers. An intermediate module must explicitly declare an output block to expose a child module's value to the root configuration.

Correct answer: D. Create a Sentinel or OPA policy that checks for the string and denies the terraform apply if the string exists.

Sentinel and Open Policy Agent integrate with Terraform to enforce custom governance rules. These policy-as-code tools evaluate configurations before apply and actively block execution if a restricted string is detected.

Correct answer: B. data.azurerm_virtual_network.existing.id

Data sources retrieve information about existing infrastructure using the data prefix. You access their exported attributes the same way you do for managed resources by appending the desired attribute to the reference.

Correct answer: C. it will align the equals signs and fix indentation to follow Terraform style conventions

The formatting command applies canonical Terraform style and conventions. It adjusts spacing by aligning the equals signs and fixes indentation, but it never evaluates logic or adds missing arguments.

Correct answer: C. Terraform will destroy all of the resources

Terraform reconciles your state file with the active configuration to determine desired infrastructure state. If a resource exists in state but is absent from the configuration, Terraform assumes you intended to delete it.

Correct answer: B. The state file remains, but no longer contains any resources

The destroy command removes all real world infrastructure tracked by the configuration. While those resources vanish from state, the state file itself is safely retained by Terraform and is left completely empty.

Correct answer: A. True

The initialization command is responsible for preparing the working directory and configuring the backend. Whenever backend settings change, you must run init again so Terraform migrates state to the new target.

Correct answer: D. use a moved block to indicate that the resource has been relocated to the new resource block

A moved block declaratively tells Terraform that a resource has a new address. During the next plan, Terraform updates the state to reflect the new name without destroying or recreating the underlying infrastructure.

Correct answer: C. terraform plan -refresh-only

The command terraform plan -refresh-only detects configuration drift by refreshing the state without staging changes. Other commands like init or fmt do not compare state against real-world infrastructure.

Correct answer: A. configure the Vault provider with credentials and use Vault data sources to retrieve secrets

Configuring the Vault provider with credentials and using its data sources lets Terraform securely retrieve dynamic secrets. Hardcoding tokens in variables or tfvars files violates security best practices and is not the intended provider integration.

Correct answer: B. Create a single import block with for_each = toset(["dev", "staging", "prod"]), to = aws_s3_bucket.app_data[each.key], and id = "app-data-${each.key}

A single import block can use for_each to import multiple resources into a for_each resource block. The target must reference the specific instance using the each key, and the id must uniquely identify the real-world object.

Correct answer: C. type = object()

Using an object type variable allows you to define a structured input containing multiple attributes of different types. Simple types like string or bool cannot group related fields together.

Correct answer: C. terraform apply -replace=kubernetes_deployment.api

The terraform apply command with the replace flag forces Terraform to taint and recreate a specific resource. Using the target flag would only limit the scope of the operation, whereas replace explicitly destroys and recreates the chosen deployment without affecting others.

Correct answer: D. version = "~> 5.1.2"

The pessimistic constraint operator allows the rightmost specified version segment to increment. Specifying the version as five dot one dot two permits patch updates like five dot one dot three, but prevents minor updates to five dot two dot zero.

Correct answer: A. unset the TF_LOG environment variable

Unsetting the TF_LOG environment variable is the correct way to disable Terraform logging for subsequent operations. Removing the environment variable causes Terraform to revert to its default behavior, whereas setting it to OFF or NONE are invalid values.

Correct answer: D. only the resources that failed to create or were not yet attempted will show as needing to be created

Terraform updates the state file incrementally as resources are successfully provisioned during an apply operation. A dropped connection triggers a partial failure, so the subsequent plan only shows the incomplete or unattempted resources instead of recreating the successfully deployed ones.

Correct answer: C. explicit dependency

The depends_on argument creates an explicit dependency between resources. Terraform builds implicit dependencies automatically from expressions, but depends_on manually forces the order of operations.

Correct answer: C. Terraform stores state in a file named terraform.tfstate in the current working directory and uses system APIs for state locking

The default local backend stores state in a local file named terraform dot tfstate within the current working directory. It uses system APIs for state locking to prevent concurrent operations from corrupting the state.

Correct answer: B. Set the environment variable TF_LOG=TRACE in your shell environment.

Setting the TF_LOG environment variable to TRACE provides highly detailed output for troubleshooting. The log path variable only dictates where logs are written, so setting TRACE is required to actually increase verbosity.

Correct answer: A. Terraform selects the provider configuration with a matching type in the same module.

Terraform automatically infers the correct provider configuration by matching the resource type prefix in the same module. Explicit provider arguments are only required when using multiple configurations of the same provider, such as targeting different regions.

Correct answer: A. image = var.vm_ids[1]

Terraform list indices are zero-based, so index one accesses the second element in a list. Option D uses index two, which would incorrectly retrieve the third item in your list of virtual machine identifiers.