10 free HashiCorp Terraform Associate 004 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 147 questions. Work through them, then open each answer to check your reasoning.
Get all 147 questions (US$39) · Download these 10 as a PDF
Question 1
IaC (Infrastructure as Code) can be stored in a version control system along with application code.
Show answer and explanation
Correct answer: A. True
Infrastructure as Code is specifically designed to be stored in version control systems like Git alongside application code. This enables teams to track changes, collaborate, maintain history, and apply DevOps practices to infrastructure just as they do with application code.
Why the other options are wrong
- B. IaC is fundamentally built for version control integration and this is a core principle of infrastructure management.
Question 2
It is best practice to store secret data in the same version control repository as your Terraform configuration.
Show answer and explanation
Correct answer: B. False
Storing secret data such as API keys, passwords, and credentials directly in a version control repository is a critical security vulnerability. Best practice requires storing secrets in dedicated secret management systems like AWS Secrets Manager, HashiCorp Vault, or environment variables, keeping them separate from code repositories.
Why the other options are wrong
- A. Storing secrets in version control creates significant security risks as the repository history may expose sensitive data to unauthorized users.
Question 3
Which is an advantage of using IaC (Infrastructure as Code) that is not possible when provisioning with a GUI (Graphical User Interface)?
Show answer and explanation
Correct answer: A. Let’s you version, reuse, and share infrastructure configuration.
The unique advantage of IaC that GUI provisioning cannot provide is the ability to version, reuse, and share infrastructure configuration. IaC allows infrastructure definitions to be treated as code, enabling version control, code reuse across projects, and easy sharing among team members, which are not feasible with GUI-based provisioning.
Why the other options are wrong
- B. Both IaC and GUI provisioning can be insecure if credentials are mishandled; this is not an IaC-exclusive advantage.
- C. Cost is determined by resource usage, not the provisioning method; both approaches provision identical resources at the same cost.
- D. Neither IaC nor GUI provisioning inherently prevents manual modifications; both require additional controls like role-based access to prevent drift.
Question 4
What is an advantage of immutable infrastructure?
Show answer and explanation

Question 5
What is the primary purpose of IaC (Infrastructure as Code)?
Show answer and explanation
Correct answer: C. To programmatically create and configure resources.
The primary purpose of Infrastructure as Code is to programmatically create and configure infrastructure resources. IaC enables infrastructure to be provisioned, modified, and managed through code rather than manual processes, providing repeatability, consistency, and automation.
Why the other options are wrong
- A. Defining deployment pipelines is the purpose of CI/CD tools, not the primary purpose of IaC.
- B. Cost reduction is a potential benefit but not the primary purpose of IaC.
- D. While some IaC tools may support multiple vendors, defining vendor-agnostic APIs is not the primary purpose of IaC.
Question 6
Your team adopts an AWS CloudFormation as the standardized method for provisioning public cloud resources.
Which scenario presents a challenge for your team?
Show answer and explanation
Correct answer: A. Deploying new infrastructure into Microsoft Azure.
AWS CloudFormation is AWS-specific and cannot deploy resources to Microsoft Azure or other cloud providers. A team standardized on CloudFormation would face significant challenges when required to provision infrastructure outside the AWS ecosystem, as they would need to learn and adopt different tools for other cloud platforms.
Why the other options are wrong
- B. CloudFormation is excellent for automating manual web console-based provisioning; this is a primary use case.
- C. CloudFormation supports multi-region deployments within AWS through parameters and regional references.
- D. CloudFormation is designed specifically for managing AWS-native services and workloads.
Question 7
Which is not a benefit of adopting IaC (Infrastructure as Code)?
Show answer and explanation
Correct answer: C. A GUI (Graphical User Interface)
A GUI (Graphical User Interface) is not a benefit of adopting IaC; in fact, IaC explicitly moves away from GUI-based provisioning toward code-based management. The actual benefits of IaC include reusability of code, automation of infrastructure provisioning, and versioning of infrastructure configurations.
Why the other options are wrong
- A. Reusability of code is a direct benefit of IaC, allowing templates and modules to be reused across projects.
- B. Automation is a core benefit of IaC, eliminating manual provisioning steps.
- D. Versioning is a fundamental benefit of IaC, enabling infrastructure to be tracked and managed like application code.
Question 8
How does the use of Infrastructure as Code (IaC) enhance the reliability of your infrastructure? (Choose two.)
Show answer and explanation

Question 9
Your team often uses API calls to create and manage cloud infrastructure.
In what ways does Terraform differ from conventional infrastructure management approaches?
Show answer and explanation
Correct answer: B. Terraform describes infrastructure with version-controlled, repeatable configurations that specify the desired state.
Terraform differs fundamentally from conventional infrastructure management by using declarative configuration files that describe the desired state of infrastructure. These configurations are version-controlled, repeatable, and enable teams to manage infrastructure through code rather than manual API calls or imperative scripts. Terraform abstracts away the complexity of directly calling cloud provider APIs while maintaining compatibility with them.
Why the other options are wrong
- A. Terraform does not replace cloud provider APIs; it abstracts and simplifies interaction with them.
- C. While Terraform uses cloud provider APIs under the hood, it provides significant abstraction and differs substantially from calling APIs directly.
- D. Terraform uses declarative configuration, not imperative scripts, to define the desired state rather than procedural steps.
Question 10
Which of these workflows is only enabled by the use of Infrastructure as Code?
Show answer and explanation
Correct answer: D. Reviewing the proposed changes for potential security issues.
Reviewing proposed changes for potential security issues is uniquely enabled by Infrastructure as Code. When infrastructure is defined as code, changes can be submitted as code reviews (pull requests) before deployment, allowing security teams and peers to inspect the changes for vulnerabilities and policy violations. Options A, B, and C can all be accomplished through various means independent of IaC.
Why the other options are wrong
- A. Automatic scaling is enabled by cloud provider features and can be configured manually or through IaC.
- B. Cost optimization can be achieved through manual resource selection and cloud provider cost analysis tools.
- C. Role-based access control is a cloud provider feature independent of whether infrastructure is managed through code.
That was 10 of 147.
The full HashiCorp Terraform Associate 004 pack has all 147 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
