Free HashiCorp Terraform Associate 004 Practice Questions

Correct answer: A. True

Infrastructure as Code is specifically designed to be stored in version control systems like Git alongside application code. This enables teams to track changes, collaborate, maintain history, and apply DevOps practices to infrastructure just as they do with application code.

Why the other options are wrong

• B. IaC is fundamentally built for version control integration and this is a core principle of infrastructure management.

Correct answer: B. False

Storing secret data such as API keys, passwords, and credentials directly in a version control repository is a critical security vulnerability. Best practice requires storing secrets in dedicated secret management systems like AWS Secrets Manager, HashiCorp Vault, or environment variables, keeping them separate from code repositories.

Why the other options are wrong

• A. Storing secrets in version control creates significant security risks as the repository history may expose sensitive data to unauthorized users.

Correct answer: A. Let’s you version, reuse, and share infrastructure configuration.

The unique advantage of IaC that GUI provisioning cannot provide is the ability to version, reuse, and share infrastructure configuration. IaC allows infrastructure definitions to be treated as code, enabling version control, code reuse across projects, and easy sharing among team members, which are not feasible with GUI-based provisioning.

Why the other options are wrong

• B. Both IaC and GUI provisioning can be insecure if credentials are mishandled; this is not an IaC-exclusive advantage.
• C. Cost is determined by resource usage, not the provisioning method; both approaches provision identical resources at the same cost.
• D. Neither IaC nor GUI provisioning inherently prevents manual modifications; both require additional controls like role-based access to prevent drift.

Correct answer: C. Quicker infrastructure upgrades

Immutable infrastructure enables quicker infrastructure upgrades because new instances are created with updated configurations and old instances are replaced rather than modified in-place. This approach reduces deployment time, complexity, and the risk of partial failures since the entire infrastructure is replaced atomically.

Why the other options are wrong

• A. Immutable infrastructure does not provide automatic upgrades; upgrades still require intentional deployment.
• B. Immutable infrastructure explicitly avoids in-place upgrades by replacing entire instances.
• D. While immutable infrastructure can reduce complexity, the primary advantage over mutable approaches is faster deployment speed.

Correct answer: C. To programmatically create and configure resources.

The primary purpose of Infrastructure as Code is to programmatically create and configure infrastructure resources. IaC enables infrastructure to be provisioned, modified, and managed through code rather than manual processes, providing repeatability, consistency, and automation.

Why the other options are wrong

• A. Defining deployment pipelines is the purpose of CI/CD tools, not the primary purpose of IaC.
• B. Cost reduction is a potential benefit but not the primary purpose of IaC.
• D. While some IaC tools may support multiple vendors, defining vendor-agnostic APIs is not the primary purpose of IaC.

Correct answer: A. Deploying new infrastructure into Microsoft Azure.

AWS CloudFormation is AWS-specific and cannot deploy resources to Microsoft Azure or other cloud providers. A team standardized on CloudFormation would face significant challenges when required to provision infrastructure outside the AWS ecosystem, as they would need to learn and adopt different tools for other cloud platforms.

Why the other options are wrong

• B. CloudFormation is excellent for automating manual web console-based provisioning; this is a primary use case.
• C. CloudFormation supports multi-region deployments within AWS through parameters and regional references.
• D. CloudFormation is designed specifically for managing AWS-native services and workloads.

Correct answer: C. A GUI (Graphical User Interface)

A GUI (Graphical User Interface) is not a benefit of adopting IaC; in fact, IaC explicitly moves away from GUI-based provisioning toward code-based management. The actual benefits of IaC include reusability of code, automation of infrastructure provisioning, and versioning of infrastructure configurations.

Why the other options are wrong

• A. Reusability of code is a direct benefit of IaC, allowing templates and modules to be reused across projects.
• B. Automation is a core benefit of IaC, eliminating manual provisioning steps.
• D. Versioning is a fundamental benefit of IaC, enabling infrastructure to be tracked and managed like application code.

Correct answer: A, C. Configuration drift is reduced with declarative definitions; Proposed changes can be reviewed before being applied.

IaC enhances reliability through configuration drift reduction and change review processes. Declarative IaC definitions prevent configuration drift by continuously enforcing desired state, ensuring infrastructure remains consistent. Additionally, proposed changes can be reviewed and validated before deployment, preventing problematic configurations from reaching production.

Why the other options are wrong

• B. Zero-downtime updates are an advanced deployment strategy (blue-green, canary) and not inherent to IaC itself.
• D. IaC does not prevent incorrect configurations from being deployed; it requires additional validation and testing mechanisms.
• E. Automatic scaling to meet demand is an infrastructure capability independent of IaC; scaling policies must be explicitly configured.

Correct answer: B. Terraform describes infrastructure with version-controlled, repeatable configurations that specify the desired state.

Terraform differs fundamentally from conventional infrastructure management by using declarative configuration files that describe the desired state of infrastructure. These configurations are version-controlled, repeatable, and enable teams to manage infrastructure through code rather than manual API calls or imperative scripts. Terraform abstracts away the complexity of directly calling cloud provider APIs while maintaining compatibility with them.

Why the other options are wrong

• A. Terraform does not replace cloud provider APIs; it abstracts and simplifies interaction with them.
• C. While Terraform uses cloud provider APIs under the hood, it provides significant abstraction and differs substantially from calling APIs directly.
• D. Terraform uses declarative configuration, not imperative scripts, to define the desired state rather than procedural steps.

Correct answer: D. Reviewing the proposed changes for potential security issues.

Reviewing proposed changes for potential security issues is uniquely enabled by Infrastructure as Code. When infrastructure is defined as code, changes can be submitted as code reviews (pull requests) before deployment, allowing security teams and peers to inspect the changes for vulnerabilities and policy violations. Options A, B, and C can all be accomplished through various means independent of IaC.

Why the other options are wrong

• A. Automatic scaling is enabled by cloud provider features and can be configured manually or through IaC.
• B. Cost optimization can be achieved through manual resource selection and cloud provider cost analysis tools.
• C. Role-based access control is a cloud provider feature independent of whether infrastructure is managed through code.

Correct answer: A, B. Generate a new execution plan file with terraform plan, and apply the new plan; Run terraform apply without the saved execution plan.

When a saved plan becomes stale because the state changed after the plan was created, you must regenerate the plan. Option A solves this by creating a fresh execution plan with terraform plan, then applying it. Option B allows you to regenerate the plan interactively without saving to a file. Option C with -refresh-only updates state but does not create a new plan for the stale changes. Option D bypasses locking but does not resolve the stale plan issue. Option E cannot update a plan file; terraform state push manages state, not plans.

Why the other options are wrong

• C. Refreshing state does not generate a new execution plan needed to resolve staleness.
• D. Disabling locks does not address the core issue that the plan no longer reflects current state.
• E. The terraform state push command manipulates state files, not plan files.

Correct answer: B. Add a validation block to the variable block.

In Terraform, variable validation is enforced using a validation block nested within the variable block definition. This validation block contains a condition and error_message to enforce specific requirements and block operations if they are not met.

Why the other options are wrong

• A. Top-level check blocks exist in Terraform but are used for test assertions, not for enforcing variable value requirements.
• C. Top-level validation blocks do not exist as a Terraform configuration construct.
• D. Check blocks cannot be added to variable blocks; they are separate top-level constructs used for testing.

Correct answer: B. 1. Write Terraform configuration. 2. Run terraform init to initialize the working directory or workspace. 3. Run terraform apply.

The correct workflow requires initializing the working directory first with terraform init, which downloads provider plugins and sets up the backend. After initialization, terraform plan reviews changes and terraform apply executes them. Option A skips initialization and validation order is wrong. Option C incorrectly states terraform plan initializes the directory. Option D uses terraform show instead of plan.

Why the other options are wrong

• A. This skips the critical terraform init step and runs validate after apply, which is backwards.
• C. terraform plan does not initialize the working directory; terraform init is required for that purpose.
• D. terraform show displays existing state, not proposed changes; terraform plan is needed for that.

Correct answer: B. False

Terraform automatically infers resource dependencies based on resource references and attributes without requiring explicit depends_on arguments. When one resource references another resource's output or attribute, Terraform builds a dependency graph and deploys resources in the correct order automatically. The depends_on argument is only necessary for implicit dependencies that Terraform cannot detect from configuration references.

Why the other options are wrong

• A. Terraform infers most dependencies automatically from resource references; explicit depends_on is only needed for implicit dependencies.

Correct answer: A. The directory contains plugins and modules that Terraform downloads during initialization, along with other important information.

The .terraform directory is created during terraform init and stores downloaded provider plugins, modules, and backend configuration data. It is essential for Terraform's operation and should not be committed to version control. Option C incorrectly describes where the state file is stored (typically as terraform.tfstate in the working directory, not within .terraform). Option B describes files that should be gitignored but not stored in .terraform. Option D describes the function of providers themselves, not the directory.

Why the other options are wrong

• B. Credential files and .tfvars are kept outside .terraform and managed separately through .gitignore.
• C. The state file is stored in the working directory as terraform.tfstate, not inside the .terraform directory.
• D. Conversion to API calls is the function of providers, not the purpose of the .terraform directory.

Correct answer: B. False

terraform apply can be executed independently without a preceding terraform plan command. When apply runs without a saved plan file, it automatically generates its own plan internally and then executes it after confirmation. The terraform plan command is optional and useful for review purposes, but not a prerequisite for apply.

Why the other options are wrong

• A. terraform apply is designed to work standalone and will generate its own plan if one is not provided.

Correct answer: B. data.vsphere_datacenter.dc.id

To reference an attribute from a data source in Terraform, you use the syntax data.<type>.<name>.<attribute>. Since you need the id attribute of the vsphere_datacenter data source named dc, the correct reference is data.vsphere_datacenter.dc.id.

Why the other options are wrong

• A. This references the data source itself but omits the .id attribute needed to access the actual ID value.
• C. This uses the resource syntax instead of data source syntax; resources use resource.<type>.<name>, not data.
• D. This is an invalid syntax that doesn't follow Terraform's naming conventions for data source references.

Correct answer: B. Set the TF_LOG environment variable.

The TF_LOG environment variable enables verbose logging in Terraform for troubleshooting purposes. Setting this variable to DEBUG, TRACE, or other log levels outputs detailed diagnostic information about Terraform's execution, API calls, and internal operations. This is the standard and documented method for enabling verbose logging in Terraform.

Why the other options are wrong

• A. Terraform does not use a log level command line flag for verbose logging.
• C. While the terraform block configures provider behavior and backend settings, it is not used to set logging verbosity.

Correct answer: A. True

Terraform requires the terraform init command to initialize a backend configuration before it can be used. This command sets up the backend infrastructure, validates the configuration, and prepares Terraform to manage state using that backend. Without running terraform init, Terraform cannot interact with a newly-defined backend.

Why the other options are wrong

• B. This is false; terraform init is mandatory for initializing a new backend.

Correct answer: B. Source code

Terraform cannot load a provider from source code directly. Providers must be compiled binaries. Terraform can load providers from the provider plugin cache (local directory), the official HashiCorp distribution on releases.hashicorp.com, and the plugins directory. Source code would need to be compiled first before it could be used as a provider plugin.

Why the other options are wrong

• A. Terraform can load providers from the local provider plugin cache.
• C. Terraform can load providers from the official HashiCorp releases.hashicorp.com distribution.
• D. Terraform can load providers from the plugins directory in .terraform.

Correct answer: A. True

Terraform requires a different provider for each cloud platform. Each provider (aws, azurerm, google, etc.) has its own configuration and manages resources specific to that cloud platform. To deploy to multiple clouds, you must explicitly configure and use multiple providers.

Why the other options are wrong

• B. This is false; Terraform requires different providers for different cloud platforms.

Correct answer: D. Dynamic blocks

Dynamic blocks allow you to construct nested blocks (like multiple data disks) using values from a variable or list. The dynamic block iterates over a collection and generates the nested block structure for each item, making it ideal for defining a variable number of similar configuration blocks.

Why the other options are wrong

• A. Count arguments replicate entire resources, not nested blocks within a resource.
• B. Collection functions manipulate data but do not generate nested block structures.
• C. Local values store computed values but do not generate dynamic nested blocks.

Correct answer: B. Add a local value.

A local value is the simplest and most appropriate way to store a computed value that will be reused multiple times within a configuration. Locals are defined using the locals block and can reference other values like random_id and variables, then be referenced anywhere in the configuration without repetition.

Why the other options are wrong

• A. Output values are intended for sharing values outside the configuration module, not for internal reuse within a configuration.
• C. Data sources retrieve information from external systems; this use case requires storing a computed value locally.
• D. Modules add unnecessary complexity for a simple value computation and reuse pattern.

Correct answer: A. True

terraform validate checks the syntax and structure of Terraform configuration files, ensuring they are well-formed and valid. It validates that arguments and blocks are correctly structured without requiring variable values to be set. This statement is true.

Correct answer: B. var.sizes[1]

In Terraform, list indices are zero-based. The list contains ["small", "medium", "large"] where "small" is at index 0, "medium" is at index 1, and "large" is at index 2. Therefore, var.sizes[1] returns "medium".

Why the other options are wrong

• A. var.sizes[0] returns "small", not "medium".
• C. var.sizes[2] returns "large", not "medium".
• D. var.sizes[3] is out of bounds and would cause an error since the list only has three elements.

Correct answer: A. Validates your expectations against the execution plan without permanently modifying state.

terraform plan generates an execution plan showing what changes will be made to infrastructure without actually applying them. This allows you to review and validate that the planned changes match your expectations before committing them. Option B describes terraform apply, not plan. Option C describes terraform init. Option D describes terraform fmt.

Why the other options are wrong

• B. This describes terraform apply behavior, which actually modifies state and resources.
• C. This describes the terraform init command, not plan.
• D. This describes the terraform fmt command for code formatting.

Correct answer: A, B. The state file; The cloud infrastructure

When you approve and run terraform apply, it makes two primary changes: the state file is updated to reflect the current infrastructure, and the cloud infrastructure itself is provisioned or modified according to the execution plan. The execution plan itself is not modified by apply; it is merely followed. The Terraform code remains unchanged unless you edit it separately. The .terraform directory contains cached plugins and does not change as a result of apply.

Why the other options are wrong

• C. The execution plan is used by apply but is not changed by it.
• D. Your Terraform configuration code is not modified by apply unless you manually edit it.
• E. The .terraform directory contains provider plugins and is not modified during apply execution.

Correct answer: C. terraform plan -out=tfplan

The correct syntax for saving a terraform plan to a file is terraform plan -out=tfplan. This flag specifies the output location for the plan file, which can then be passed to terraform apply for deterministic execution. The -out flag is the standard Terraform option for this purpose.

Why the other options are wrong

• A. -generate-config-out is not a valid terraform plan flag.
• B. -target is used to select specific resources, not to save plan output.
• D. -var-file is used to pass variable values from a file, not to output plans.

Correct answer: D. Set the correct environment variable.

Terraform debug logging is enabled by setting the TF_LOG environment variable (e.g., TF_LOG=DEBUG) before running terraform commands. This environment variable controls the log level for Terraform operations and is the standard method for enabling detailed debugging output to investigate errors during terraform plan or apply.

Why the other options are wrong

• A. There is no specific flag to terraform plan that enables debug logging; the solution requires an environment variable.
• B. Editing a client configuration file does not enable debug logging in Terraform.
• C. Updating the backend configuration does not enable debug logging for terraform plan operations.

Correct answer: D. aws_instance.web[1].name

When using count on a resource, instances are indexed starting from 0. The second instance (the second of two with count = 2) is therefore at index 1, referenced as aws_instance.web[1].name. Array indexing in Terraform uses zero-based numbering.

Why the other options are wrong

• A. The splat syntax aws_instance.web.*.name returns all names as a list, not a single instance's name.
• B. Index 2 would reference a third instance, which does not exist when count = 2 (only indices 0 and 1 exist).
• C. The element function is not the correct syntax for accessing counted resources in Terraform.
• E. This references the entire second instance object, not specifically the name attribute as required.

Correct answer: A. Declaring a resource identifier more than once.

terraform validate checks the syntax and structural consistency of Terraform configuration files, including verifying that resource identifiers are not declared more than once. It validates configuration logic before any infrastructure operations occur, catching duplicate resource declarations and other configuration errors.

Why the other options are wrong

• B. Differences between local and remote state are identified through terraform plan or state comparison, not terraform validate.
• C. Out-of-date modules are detected during terraform init or plan operations, not by terraform validate.
• D. Whitespace consistency (spaces vs tabs) is not validated by terraform validate; Terraform's HCL parser is flexible about formatting.

Correct answer: D. provider “aws” { region = “us-east-1” } provider “aws” { alias = “west” region = “us-west-2” }

To use multiple provider configurations of the same type, an alias must be assigned to distinguish them. The correct syntax is provider "aws" { alias = "west" region = "us-west-2" }, which creates a named provider variant that can be referenced in resources using the provider argument.

Why the other options are wrong

• A. Does not address the provider configuration issue and only shows a resource block.
• B. Uses incorrect syntax for provider aliasing.
• C. Attempts to create a new provider type instead of using an alias for the existing aws provider.

Correct answer: C. Run terraform init -upgrade.

terraform init -upgrade reinstalls provider plugins and checks for newer versions, downloading them as needed. The -upgrade flag forces Terraform to fetch the latest compatible provider versions. Option A (plan) and option B (apply) do not download providers. Option D (refresh) only updates state to match real resources and does not upgrade providers.

Why the other options are wrong

• A. terraform plan does not download or upgrade providers.
• B. terraform apply does not upgrade providers; it uses already-downloaded versions.
• D. terraform refresh updates state but does not install new provider versions.

Correct answer: A. Terraform builds a resource graph based on your configuration and your state file (if present).

Terraform automatically determines dependencies by analyzing the resource graph built from the configuration and state file. It identifies implicit dependencies through resource references (e.g., aws_instance.app.id used in another resource) and explicit dependencies defined with depends_on. This automatic analysis does not require manual ordering or module-based dependency specification.

Why the other options are wrong

• B. Terraform does not require resources to be listed in creation order; it uses graph analysis to determine the correct sequence automatically.
• C. While depends_on can be used for explicit dependencies, Terraform automatically infers most dependencies from resource references without requiring this parameter.
• D. Dependencies do not need to be defined through modules; Terraform resolves dependencies within the same configuration through its graph-based analysis.

Correct answer: B. Set the environment variable TF_LOG=TRACE.

The TF_LOG environment variable controls Terraform logging verbosity, with TRACE being the most detailed level that shows provider loading paths and other low-level operations. Setting TF_LOG=TRACE enables the diagnostic output needed to see from which paths providers are being loaded.

Why the other options are wrong

• A. TF_VAR_log is not a valid environment variable; TF_VAR prefix is for input variables.
• C. PATH is not a valid TF_LOG value; the correct value is TRACE.
• D. Verbose logging is not configured per-provider in the Terraform configuration file; it uses the TF_LOG environment variable.

Correct answer: B. False

By default, terraform fmt rewrites Terraform configuration files to a canonical format and saves the changes. Without the -check flag, it modifies the files in place rather than only checking them.

Correct answer: A. True

The terraform init command can install Community and Partner providers and plugins from the Terraform Registry. When you reference a provider in your configuration, terraform init automatically downloads and installs the required provider, enabling use of community-developed and vendor-partner plugins alongside official providers.

Correct answer: B. value

The value argument is the only required argument when declaring a Terraform output. It specifies what value should be exported from the module or configuration. The description, default, and sensitive arguments are all optional and provide additional metadata or behavior for the output.

Why the other options are wrong

• A. The default argument is optional for outputs and is not required.
• C. The description argument is optional and provides documentation but is not required.
• D. The sensitive argument is optional and controls whether the output value is masked in logs but is not required.

Correct answer: C. No impact since Terraform reads all .tf files as a single configuration when executing a terraform plan.

Terraform treats all .tf files in a working directory as a single configuration unit. When you run terraform plan, it reads and parses all .tf files together regardless of how they are split, so reorganizing code across multiple files has no impact on the plan output.

Why the other options are wrong

• A. Terraform does not require a specific file order; it processes all .tf files as a single configuration regardless of block placement across files.
• B. Moving resources between files does not trigger destroy/replacement; the state file maintains resource identity independently of file location.
• D. Terraform does not parse main.tf first or use file order to determine resource creation; all files are read as a unified configuration.

Correct answer: C. Validates that values are set for all required input variables.

terraform init downloads providers and modules, connects to configured backends, and performs backend initialization. It does not validate that all required input variables have values; that validation occurs during terraform plan or apply. Variable validation is a separate process triggered when configuration is evaluated against actual values, not during initialization.

Why the other options are wrong

• A. terraform init explicitly sources and downloads remote modules.
• B. terraform init connects to and initializes the configured backend.
• D. terraform init downloads all providers specified in the configuration.

Correct answer: C. terraform validate only checks if a configuration is syntactically correct and internally consistent, and does not communicate with providers.

terraform validate performs only syntactic and internal consistency checking of the configuration code itself. It does not interact with cloud providers, authenticate credentials, or contact remote systems. Authentication errors only surface when terraform plan attempts to communicate with the actual provider, requiring valid credentials and permissions.

Why the other options are wrong

• A. The working directory does not need to be initialized for validate to work, and validate does not use provider plugins.
• B. The remote backend configuration is not required for validate to function; validate works locally on syntax alone.
• D. Variables are validated during terraform plan and apply, but this is unrelated to why provider authentication errors are not caught by validate.

Correct answer: A. True

The terraform fmt command automatically formats all Terraform configuration files in the current working directory and subdirectories to Terraform's canonical format and style. This includes proper indentation, spacing, and syntax standardization.