Terraform Associate Practice Test.

1. A team currently provisions cloud servers by manually clicking through a console and keeping a shared spreadsheet of what was created. Which core benefit would adopting Infrastructure as Code (IaC) most directly provide?

• A. Infrastructure changes become reproducible and reviewable because they are defined in version-controlled configuration files
• B. Cloud provider costs are automatically reduced regardless of the resources deployed
• C. The need for testing before deploying to production is eliminated
• D. Manual console access is required in addition to the code to keep infrastructure accurate

2. Which statement best describes a key advantage of a declarative IaC approach (like Terraform) compared to a purely imperative scripting approach for provisioning infrastructure?

• A. You describe the desired end state and the tool determines the steps to reach it, rather than scripting each individual action in order
• B. Declarative tools never need to communicate with a provider API
• C. Declarative configurations cannot be reused across environments
• D. Imperative scripts automatically track infrastructure drift over time

3. An organization wants infrastructure changes to go through the same pull-request review process as application code changes. Which IaC characteristic makes this workflow possible?

• A. IaC eliminates the need for a version control system entirely
• B. IaC tools require a dedicated binary configuration format that cannot be diffed
• C. Cloud providers mandate that all changes be reviewed before an API accepts them
• D. Infrastructure configurations are stored as plain-text files that can be committed to a version control system

4. A company deploys resources across AWS, Azure, and an on-premises VMware cluster and wants a single tool and workflow to manage all three. Which characteristic of Terraform makes it well suited to this multi-platform scenario compared to a single cloud vendor's native IaC tool?

• A. Terraform uses a provider plugin model that lets the same workflow target many different platforms through their respective APIs
• B. Terraform only works with a single cloud vendor at a time and requires separate state files per vendor tool
• C. Terraform automatically migrates resources between clouds without reconfiguration
• D. Terraform requires each provider to expose an identical API schema

5. A module is sourced from a registry without a version constraint. What risk does this create?

• A. A later run can pick up a new module version whose behaviour differs, changing infrastructure without any change to the configuration
• B. The module will fail to download
• C. The module's outputs become unavailable
• D. State locking is disabled

6. A provider version constraint is written as pessimistic to the patch level. What does this permit?

• A. Patch updates within the specified minor version but not a minor or major version change
• B. Any version newer than the one specified
• C. Only the exact version specified
• D. Any version including older ones

7. Compared to a configuration management tool primarily focused on configuring software on existing servers, what is Terraform primarily designed to manage?

• A. Real-time application performance monitoring and alerting
• B. Source code compilation and build artifact packaging
• C. Installing and updating application packages on an already-running operating system
• D. The provisioning and lifecycle of infrastructure resources themselves, such as compute instances, networks, and managed services

8. A team is choosing between Terraform and a mutable, agent-based configuration tool for managing cloud VM infrastructure that is frequently torn down and recreated. Why might Terraform's immutable infrastructure model be preferable in this scenario?

• A. Replacing resources from a known configuration reduces configuration drift compared to repeatedly mutating long-lived servers in place
• B. Immutable infrastructure guarantees zero downtime during every apply
• C. Mutable tools cannot run more than once against the same server
• D. Immutable infrastructure requires no state tracking of any kind

9. Which of the following is the correct sequence of the core Terraform workflow when making a change to existing infrastructure?

• A. terraform init, then terraform plan, then terraform apply
• B. terraform validate, then terraform destroy, then terraform apply
• C. terraform destroy, then terraform init, then terraform plan
• D. terraform apply, then terraform plan, then terraform init

10. A developer runs `terraform plan` and sees that an EC2 instance will be destroyed and recreated rather than updated in place, even though only one attribute changed. What most likely explains this behavior?

• A. The changed attribute requires replacement because the provider cannot update it in place, so Terraform plans a destroy-and-recreate
• B. terraform plan always destroys and recreates every resource regardless of what changed
• C. The state file has become corrupted and must be manually deleted
• D. The developer must run terraform import before any further changes are allowed

11. During `terraform apply`, a user is prompted with a plan summary and asked to type 'yes' to proceed. What is the purpose of this interactive approval step in the core workflow?

• A. It gives the operator a final chance to review the exact set of additions, changes, and destructions before they are applied to real infrastructure
• B. It permanently locks the configuration files from further edits
• C. It re-downloads all provider plugins before any resources can change
• D. It is required only the very first time a workspace is ever applied

12. A CI pipeline runs terraform apply non-interactively for every merge to main. Which flag or approach is appropriate to skip the interactive yes/no confirmation while still applying a specific saved plan?

• A. Run terraform apply against a previously saved plan file so the exact reviewed changes are applied without re-prompting
• B. Delete the state file before every apply so no confirmation is needed
• C. Run terraform taint on every resource before applying
• D. Disable the provider's authentication so the apply always fails safely

13. A configuration file defines a resource block for an AWS S3 bucket with several arguments and a nested lifecycle block. Which statement correctly describes HCL syntax being used here?

• A. Resource blocks use a resource type and a local name, and arguments inside are key-value pairs, with nested blocks representing structured sub-configuration
• B. HCL requires all resource arguments to be defined as separate top-level resource blocks
• C. Nested blocks like lifecycle can only be used inside variable declarations
• D. HCL syntax mandates that every block be wrapped in double quotes

14. A configuration needs to reference the ID of an aws_vpc resource named "main" from within an aws_subnet resource's vpc_id argument. Which expression correctly does this?

• A. aws_vpc.main.id
• B. vpc.main.id
• C. aws_subnet.main.vpc_id
• D. var.aws_vpc.main.id

15. A variable block declares `variable "instance_count" { type = number, default = 2 }`. If a caller does not supply a value for instance_count, what value will Terraform use?

• A. The default value of 2, since no override was supplied
• B. Terraform will always fail immediately at plan time due to a missing required value
• C. Terraform will silently substitute the value 0 for any numeric variable without a default
• D. Terraform will prompt for the value only during terraform destroy

16. A configuration must create three nearly identical S3 buckets, differing only by name, based on a list variable containing three strings. Which HCL construct is most appropriate?

• A. A count or for_each meta-argument on the resource block, iterating over the list to create one instance per element
• B. Writing three separate, hand-duplicated resource blocks with unique local names
• C. A provisioner block that loops internally to create each bucket
• D. A nested module with no input variables at all

17. An engineer wants to select an appropriate meta-argument for creating multiple resource instances from a map where each resource needs a stable identity even if items are added or removed from the middle of the collection. Why is for_each generally preferred over count in this case?

• A. count automatically re-keys instances by name whenever the list changes
• B. count and for_each are functionally identical and interchangeable in every scenario
• C. for_each cannot be used with modules, only with resources
• D. for_each keys each instance by a map key or set value, so removing or adding an unrelated element does not shift the index-based identity of other instances

18. A configuration includes `locals { name_prefix = "${var.environment}-app" }` and later references `local.name_prefix` in multiple resources. What is the primary benefit of using a local value here?

• A. It computes a derived expression once and gives it a reusable name, avoiding repeating the same interpolation logic across multiple resources
• B. Local values can be overridden at apply time using a -var flag just like input variables
• C. Local values automatically become outputs of the root module
• D. Local values are required before any variable can be declared

19. A root configuration calls a module for provisioning a VPC, passing in a cidr_block variable and expecting a vpc_id back for use elsewhere in the root. Which two module features make this data flow possible?

• A. Input variables defined in the module accept values from the caller, and output values defined in the module expose data back to the caller
• B. Modules automatically share their entire state with the root module without any explicit inputs or outputs
• C. Only the root module can define variables; child modules can only define outputs
• D. Modules communicate exclusively through provider configuration blocks

20. A team wants to reuse a well-tested networking module published by a third party, pinning it to a specific version to avoid unexpected breaking changes. Which source configuration best supports this in a module block?

• A. Referencing the module from a registry source with an explicit version constraint, e.g. version = "~> 2.0"
• B. Copying the module's source files directly into every consuming configuration's directory
• C. Referencing the module source with no version argument so it always tracks the newest release
• D. Declaring the module as a provider block instead of a module block

21. Within a root module, a child module block is written as `module "network" { source = "./modules/network" }` and the module internally creates an aws_vpc resource named "this". How would the root module reference an output value named vpc_id exposed by that module?

• A. network.module.vpc_id
• B. var.network.vpc_id
• C. module.network.vpc_id
• D. aws_vpc.this.vpc_id

22. A large configuration repeats near-identical blocks for provisioning a web tier across three environments (dev, staging, prod), varying only instance sizes and counts. What is the primary architectural benefit of extracting this into a reusable module with input variables for size and count?

• A. It centralizes the shared logic in one place so fixes and improvements propagate to every environment that calls the module
• B. It removes the need to ever run terraform plan in any environment that uses the module
• C. It guarantees that all three environments will always have identical instance counts
• D. It automatically merges the three environments' state files into one

23. A nested child module internally calls another module two levels deep, and that innermost module declares a resource. From the root module's perspective, why can't the root directly reference that innermost resource by its resource address without going through outputs?

• A. Each module has its own local resource namespace, and data only crosses a module boundary through explicitly declared outputs and inputs
• B. Terraform limits module nesting to a single level, so this configuration would fail to load
• C. Resources declared in nested modules are automatically renamed to include the root module's name
• D. Only provider configurations, never resources, can exist inside nested modules

24. Two engineers run terraform apply against the same remote backend workspace at nearly the same time. What mechanism is designed to prevent both applies from corrupting the state file simultaneously?

• A. State locking, which many remote backends support to serialize concurrent write operations
• B. Terraform automatically merges concurrent state changes like a version control system merges text files
• C. Local state files always prevent concurrent access even without a remote backend
• D. The second terraform apply silently overwrites the first apply's state changes without warning

25. An engineer manually deletes a cloud resource from the provider console that Terraform is still tracking in its state file. The next time terraform plan runs, what will Terraform most likely report?

• A. Terraform will automatically update its state to remove the resource with no plan output at all
• B. terraform plan will fail with an unrecoverable error and require deleting the entire state file
• C. Terraform will ignore the discrepancy until the next terraform destroy is run
• D. Terraform will detect drift and plan to recreate the resource, since state says it should exist but the real infrastructure does not

26. A team stores terraform.tfstate as a local file inside their project's git repository. What is the most significant risk of this practice compared to using a remote backend?

• A. State can easily fall out of sync between collaborators, and sensitive values in state may be exposed in version control history
• B. Local state files cannot store resource attributes at all
• C. Git repositories reject any file over 1 KB, so state files will not commit successfully
• D. Local state automatically encrypts itself when committed to any git provider

27. A resource was created outside of Terraform (via the console) and now needs to be brought under Terraform management without destroying and recreating it. Which command is designed for this purpose?

• A. terraform import
• B. terraform taint
• C. terraform refresh only, with no configuration written
• D. terraform apply -destroy

28. A team splits a large monolithic configuration's state into multiple smaller state files organized by service boundary (networking, database, application). What is a key trade-off introduced by this split?

• A. Cross-service references now require explicit data sharing (such as remote state data sources or outputs), since each state file only knows about its own resources
• B. All state files must now be applied in a single terraform apply command simultaneously
• C. Splitting state eliminates the possibility of ever needing state locking
• D. Terraform automatically keeps all split state files in sync with no additional configuration

29. A provider's resource attribute value stored in state does not match the real infrastructure's current value because someone modified the resource out-of-band. Which core Terraform operation, run as part of plan, is responsible for detecting this kind of discrepancy before proposing changes?

• A. The refresh step, which queries the current state of real infrastructure and reconciles it against the recorded state
• B. terraform fmt, which reformats configuration files
• C. terraform validate, which only checks configuration syntax
• D. terraform init, which downloads provider plugins

30. An operator wants to permanently remove a resource from Terraform's management without destroying the underlying real-world infrastructure. Which action accomplishes this?

• A. Removing the resource from state (e.g., via terraform state rm) while leaving the configuration or real resource alone as needed
• B. Deleting the resource block from configuration is always sufficient with no other steps and never triggers a destroy
• C. Renaming the resource's local name in configuration accomplishes the same outcome automatically
• D. Running terraform destroy, which only removes the state entry and never touches real infrastructure

31. A team wants to run custom validation scripts, generate documentation, or trigger notifications as part of their infrastructure lifecycle, but outside the scope of what terraform plan/apply directly does. Which category of usage does this best describe?

• A. Using Terraform outside of its core workflow, such as via external tooling, wrapper scripts, or provisioners integrated around the standard commands
• B. This is only possible by modifying the Terraform binary's source code directly
• C. This requires abandoning Terraform entirely in favor of a different tool
• D. terraform plan natively performs documentation generation and notification sending with no extra tooling

32. A provisioner block is added to a resource to run a remote-exec script that installs an application after the instance is created. What is a commonly cited caveat about relying heavily on provisioners for this purpose?

• A. Provisioners are considered a last resort because they can introduce non-idempotent, harder-to-track behavior compared to native provider features or dedicated configuration management tools
• B. Provisioners can only be attached to data sources, never to resources
• C. Provisioners always run before terraform plan and never during apply
• D. Using any provisioner permanently disables state locking for that resource

33. A pipeline wants to check that all committed .tf files are syntactically valid and consistently formatted before merging, without actually connecting to any cloud provider. Which combination of commands best supports this outside the normal plan/apply flow?

• A. terraform fmt -check and terraform validate
• B. terraform apply -auto-approve and terraform destroy
• C. terraform import and terraform state rm
• D. terraform workspace new and terraform workspace select

34. A team wants a shared, remote location to run terraform plan and apply, with built-in state storage, access controls, and a history of runs visible to the whole team, rather than everyone running Terraform CLI locally against a self-managed backend. Which product area does this describe?

• A. HCP Terraform (Terraform Cloud), which provides remote runs, state management, and collaboration features as a managed service
• B. terraform console, a local-only command for evaluating expressions interactively
• C. The terraform fmt command, which only reformats configuration files
• D. A provider plugin, which only implements resource and data source logic for a specific platform

35. An organization uses HCP Terraform workspaces to separate configuration and state for dev, staging, and prod environments, each with its own variable sets and run history. What is the primary organizational benefit of using separate workspaces here rather than one shared workspace for all three environments?

• A. Workspaces remove the need to ever define environment-specific variables
• B. Each environment's state, variables, and run history stay isolated, reducing the risk that a change intended for one environment accidentally affects another
• C. Separate workspaces automatically synchronize variable values across all environments
• D. Only one workspace total is allowed per HCP Terraform organization

36. A company wants multiple engineers to collaborate on the same set of Terraform configurations, with runs automatically triggered on VCS commits and clear visibility into who approved which apply. Which HCP Terraform capability area most directly supports this requirement?

• A. VCS-driven workflows combined with team-based access controls and run approval history
• B. Only running terraform apply -auto-approve locally on each engineer's laptop
• C. Manually emailing plan output to teammates for review before every apply
• D. Disabling state locking so multiple people can apply concurrently without waiting

37. A workspace in HCP Terraform is configured with remote execution mode, meaning plan and apply operations run on HCP Terraform's infrastructure rather than a user's local machine. What is one advantage of this remote execution model for a team?

• A. Runs execute in a consistent, centrally managed environment with consistent provider/plugin versions and don't depend on any individual engineer's local machine setup
• B. Remote execution mode removes the need for any provider credentials to be configured anywhere
• C. Remote execution guarantees that plans never show any changes
• D. Remote execution mode is only available for the terraform destroy command

38. Which of the following best describes what HCP Terraform's Sentinel or OPA-based policy checks are typically used for in a workspace's run pipeline?

• A. Replacing the need for a provider block in the configuration
• B. Automatically writing the Terraform configuration files for the user
• C. Formatting HCL code according to canonical style
• D. Enforcing organizational rules (such as required tags, allowed instance types, or cost limits) against a plan before it can be applied

39. A newcomer to Terraform asks why 'basic terminal skills and an understanding of on-premises and cloud architecture' are recommended before attempting to learn Terraform in a production context. Which best explains this recommendation?

• A. Terraform is operated primarily via CLI commands and manages real infrastructure resources, so comfort with a terminal and infrastructure concepts helps in understanding what configurations actually provision
• B. Terraform cannot be installed on any operating system that includes a graphical user interface
• C. HashiCorp requires a separate terminal-usage certification before anyone may install Terraform
• D. Infrastructure architecture knowledge is only relevant to Terraform's HCP Terraform product, not the open-source CLI

40. A candidate is scheduling their Terraform Associate exam and wants to know roughly how long they should budget for the actual online proctored session. Which duration should they plan for?

• A. About 1 hour (60 minutes)
• B. About 4 hours
• C. About 15 minutes
• D. About 8 hours across two sessions

41. A candidate wants to know how many separate objective domains the Terraform Associate (004) exam measures knowledge across, so they can plan their study checklist. What is the correct count?

• A. Eight objective domains
• B. Three objective domains
• C. Twelve objective domains
• D. Five objective domains

42. A candidate is reviewing the format of the Terraform Associate exam and wants to know what kinds of questions to expect on exam day. Which set of question types matches the official format?

• A. True or false, multiple choice, and multiple answer questions
• B. Only essay-style, free-response questions
• C. Only fill-in-the-blank coding exercises with no answer choices
• D. Only matching-pairs style questions

43. A candidate passes the Terraform Associate exam today and wants to know how long the resulting certification credential remains valid before recertification is required.

• A. 2 years
• B. 1 year
• C. 5 years
• D. The credential never expires

44. A candidate fails the Terraform Associate exam on their first attempt and asks whether a free retake is included in the price they already paid. Based on the official policy, what should they be told?

• A. No, a free retake is not included in the exam price, so a retake would require paying again
• B. Yes, every candidate automatically receives one free retake within 24 hours
• C. Yes, but only if they fail by fewer than five percentage points
• D. Retakes are entirely prohibited and the credential can never be attempted again

45. A study guide for this exam version notes that scenario questions may assume behavior consistent with a specific Terraform release line. Which version does this exam version test on?

• A. Terraform 1.12
• B. Terraform 0.11
• C. Terraform 2.0
• D. Terraform 1.0 exactly, with no later point releases

46. A candidate asks whether the Terraform Associate exam publishes an official percentage weighting for each of its eight objective domains, similar to how some other certification exams list exact percentages per domain. Based on the official exam guidance, what is accurate?

• A. The exam does not publish per-objective percentage weightings, so candidates should prepare across all eight domains rather than optimizing study time by a published percentage split
• B. Each of the eight domains is weighted at exactly 12.5 percent, published officially by HashiCorp
• C. The state management domain alone makes up 50 percent of the exam by official published weighting
• D. Only two of the eight domains are actually tested, despite all eight being listed

47. A configuration is applied and later a resource is changed manually outside the tool. What does the next plan show?

• A. A difference between the recorded state and reality, proposing changes to bring the resource back to the configured state
• B. No changes, since state is the authoritative record
• C. An error preventing any further operations permanently
• D. Automatic adoption of the manual change into the configuration

48. A team stores state in a remote backend rather than locally. What two problems does this address?

• A. Sharing state across the team and preventing concurrent operations through locking, alongside keeping sensitive state values off individual machines
• B. Reducing the time each apply takes to complete
• C. Removing the need to write a configuration
• D. Eliminating provider authentication requirements

49. An existing resource created outside the tool must be brought under management. What is required?

• A. Deleting and recreating it through the tool
• B. Renaming the resource to match a naming convention
• C. Nothing, since resources are adopted automatically on the next apply
• D. Importing it so state records the existing object, along with a configuration block matching its actual settings

50. A plan proposes to destroy and recreate a resource rather than update it in place. What determines this?

• A. Whether the changed attribute can be modified on the live resource, since attributes that cannot be updated force replacement
• B. The alphabetical position of the resource in the configuration
• C. The size of the state file
• D. Whether the backend is local or remote

51. A configuration must create a variable number of near-identical resources from a list of names. Which construct is generally preferred and why?

• A. for_each keyed by a set or map, because resources are addressed by key rather than by index so removing one element does not shift the others
• B. count with the list's length, because index-based addressing is more stable
• C. Copying the resource block once per name
• D. A provisioner running a loop inside the resource

52. A module is reused across environments. How are environment-specific values supplied?

• A. Through input variables passed by the calling configuration, with outputs exposing values other configurations need
• B. By editing the module's source each time it is used
• C. By hardcoding values and maintaining a copy per environment
• D. By setting operating system environment variables inside the module

53. The initialization step is run in a new working directory. What does it do?

• A. Downloads required providers and modules, configures the backend and prepares the working directory for planning and applying
• B. Validates only the configuration syntax with no other effect
• C. Creates the infrastructure described in the configuration
• D. Destroys any existing infrastructure

54. A plan is saved to a file and later applied. What guarantee does this provide?

• A. The apply executes exactly the actions the saved plan described, rather than recomputing them against possibly changed conditions
• B. The apply cannot fail under any circumstances
• C. The plan file can be applied to a different state
• D. No provider credentials are needed at apply time

55. A resource must be created only after another resource exists, but no attribute reference links them. How is the ordering expressed?

• A. An explicit dependency declaration, since the dependency graph is otherwise built from attribute references between resources
• B. Placing the resource blocks in the desired order within the file
• C. Naming the resources alphabetically in sequence
• D. Splitting the resources into separate files

56. A value must be looked up from an existing resource that the configuration does not manage. What construct provides this?

• A. A data source, which reads information without creating or managing the underlying object
• B. A resource block, which would create a duplicate object
• C. An output block, which exposes values to callers
• D. A variable block, which accepts input

57. A variable is marked as sensitive. What does this affect?

• A. Display of the value in plan and apply output, while the value is still recorded in state and must be protected there
• B. Encryption of the value within the state file automatically
• C. Whether the value can be passed to a module
• D. Whether the value is stored in the configuration file

58. Workspaces are used within a single configuration. What do they provide?

• A. Separate state instances for the same configuration, suitable for lightweight variation but not for strongly isolated environments
• B. Complete isolation including separate credentials and backends
• C. A separate configuration per environment
• D. Automatic promotion of changes between environments

59. A team must review infrastructure changes before they are applied. What makes the plan output suitable for that review?

• A. It enumerates each resource to be created, updated, replaced or destroyed with the specific attribute changes, so destructive actions are visible before execution
• B. It guarantees the changes will succeed
• C. It applies non-destructive changes automatically during review
• D. It hides replacements to keep output concise

60. A resource must be replaced deliberately without changing its configuration. What is the appropriate approach?

• A. Requesting replacement of that specific resource address in the plan, so only it is recreated
• B. Deleting the entire state file and reapplying
• C. Manually deleting the resource in the platform console
• D. Renaming the resource block

61. A resource must be removed from management without being destroyed. What accomplishes this?

• A. Removing it from state so the tool forgets it, leaving the real object in place unmanaged
• B. Deleting the resource block and applying, which destroys it
• C. Setting the resource's count to zero, which destroys it
• D. Renaming the resource block

62. Infrastructure as code is adopted in place of console-driven changes. What benefit is most fundamental?

• A. The configuration becomes a reviewable, versioned record so environments can be reproduced and changes carry history and approval
• B. Infrastructure becomes free to operate
• C. Changes can no longer fail
• D. Credentials are no longer required

63. A tool is described as declarative rather than imperative for infrastructure management. What follows from this?

• A. The configuration describes the desired end state and the tool determines the actions, so applying the same configuration repeatedly converges rather than duplicating work
• B. Each action must be scripted in the order it should execute
• C. The configuration cannot express dependencies between resources
• D. The tool cannot detect existing infrastructure

64. A managed service offers remote execution of runs with policy enforcement before apply. What capability does the policy layer add?

• A. Automated evaluation of a proposed plan against organizational rules, blocking or requiring override for changes that violate them
• B. Faster provider downloads during initialization
• C. Automatic generation of the configuration from existing infrastructure
• D. Elimination of the need for state storage

65. Remote runs are used so applies do not execute from individual workstations. What advantage does this provide beyond convenience?

• A. Provider versions become irrelevant
• B. State is no longer required
• C. Credentials are held centrally rather than on developer machines, and every run produces a consistent audited record
• D. Configuration no longer needs to be written