Terraform Associate Practice Exam.
Free practice test — 45 verified questions, instant feedback.

1. A team currently provisions cloud servers by manually clicking through a console and keeping a shared spreadsheet of what was created. Which core benefit would adopting Infrastructure as Code (IaC) most directly provide?

• A. Infrastructure changes become reproducible and reviewable because they are defined in version-controlled configuration files
• B. Cloud provider costs are automatically reduced regardless of the resources deployed
• C. The need for testing before deploying to production is eliminated
• D. Manual console access is required in addition to the code to keep infrastructure accurate

2. Which statement best describes a key advantage of a declarative IaC approach (like Terraform) compared to a purely imperative scripting approach for provisioning infrastructure?

• A. You describe the desired end state and the tool determines the steps to reach it, rather than scripting each individual action in order
• B. Declarative tools never need to communicate with a provider API
• C. Declarative configurations cannot be reused across environments
• D. Imperative scripts automatically track infrastructure drift over time

3. An organization wants infrastructure changes to go through the same pull-request review process as application code changes. Which IaC characteristic makes this workflow possible?

• A. Infrastructure configurations are stored as plain-text files that can be committed to a version control system
• B. IaC tools require a dedicated binary configuration format that cannot be diffed
• C. Cloud providers mandate that all changes be reviewed before an API accepts them
• D. IaC eliminates the need for a version control system entirely

4. A company deploys resources across AWS, Azure, and an on-premises VMware cluster and wants a single tool and workflow to manage all three. Which characteristic of Terraform makes it well suited to this multi-platform scenario compared to a single cloud vendor's native IaC tool?

• A. Terraform uses a provider plugin model that lets the same workflow target many different platforms through their respective APIs
• B. Terraform only works with a single cloud vendor at a time and requires separate state files per vendor tool
• C. Terraform automatically migrates resources between clouds without reconfiguration
• D. Terraform requires each provider to expose an identical API schema

5. Compared to a configuration management tool primarily focused on configuring software on existing servers, what is Terraform primarily designed to manage?

• A. The provisioning and lifecycle of infrastructure resources themselves, such as compute instances, networks, and managed services
• B. Installing and updating application packages on an already-running operating system
• C. Real-time application performance monitoring and alerting
• D. Source code compilation and build artifact packaging

6. A team is choosing between Terraform and a mutable, agent-based configuration tool for managing cloud VM infrastructure that is frequently torn down and recreated. Why might Terraform's immutable infrastructure model be preferable in this scenario?

• A. Replacing resources from a known configuration reduces configuration drift compared to repeatedly mutating long-lived servers in place
• B. Immutable infrastructure guarantees zero downtime during every apply
• C. Mutable tools cannot run more than once against the same server
• D. Immutable infrastructure requires no state tracking of any kind

7. Which of the following is the correct sequence of the core Terraform workflow when making a change to existing infrastructure?

• A. terraform init, then terraform plan, then terraform apply
• B. terraform apply, then terraform plan, then terraform init
• C. terraform destroy, then terraform init, then terraform plan
• D. terraform validate, then terraform destroy, then terraform apply

8. A developer runs `terraform plan` and sees that an EC2 instance will be destroyed and recreated rather than updated in place, even though only one attribute changed. What most likely explains this behavior?

• A. The changed attribute requires replacement because the provider cannot update it in place, so Terraform plans a destroy-and-recreate
• B. terraform plan always destroys and recreates every resource regardless of what changed
• C. The state file has become corrupted and must be manually deleted
• D. The developer must run terraform import before any further changes are allowed

9. During `terraform apply`, a user is prompted with a plan summary and asked to type 'yes' to proceed. What is the purpose of this interactive approval step in the core workflow?

• A. It gives the operator a final chance to review the exact set of additions, changes, and destructions before they are applied to real infrastructure
• B. It re-downloads all provider plugins before any resources can change
• C. It permanently locks the configuration files from further edits
• D. It is required only the very first time a workspace is ever applied

10. A CI pipeline runs terraform apply non-interactively for every merge to main. Which flag or approach is appropriate to skip the interactive yes/no confirmation while still applying a specific saved plan?

• A. Run terraform apply against a previously saved plan file so the exact reviewed changes are applied without re-prompting
• B. Delete the state file before every apply so no confirmation is needed
• C. Run terraform taint on every resource before applying
• D. Disable the provider's authentication so the apply always fails safely

11. A configuration file defines a resource block for an AWS S3 bucket with several arguments and a nested lifecycle block. Which statement correctly describes HCL syntax being used here?

• A. Resource blocks use a resource type and a local name, and arguments inside are key-value pairs, with nested blocks representing structured sub-configuration
• B. HCL requires all resource arguments to be defined as separate top-level resource blocks
• C. Nested blocks like lifecycle can only be used inside variable declarations
• D. HCL syntax mandates that every block be wrapped in double quotes

12. A configuration needs to reference the ID of an aws_vpc resource named "main" from within an aws_subnet resource's vpc_id argument. Which expression correctly does this?

• A. aws_vpc.main.id
• B. vpc.main.id
• C. aws_subnet.main.vpc_id
• D. var.aws_vpc.main.id

13. A variable block declares `variable "instance_count" { type = number, default = 2 }`. If a caller does not supply a value for instance_count, what value will Terraform use?

• A. The default value of 2, since no override was supplied
• B. Terraform will always fail immediately at plan time due to a missing required value
• C. Terraform will silently substitute the value 0 for any numeric variable without a default
• D. Terraform will prompt for the value only during terraform destroy

14. A configuration must create three nearly identical S3 buckets, differing only by name, based on a list variable containing three strings. Which HCL construct is most appropriate?

• A. A count or for_each meta-argument on the resource block, iterating over the list to create one instance per element
• B. Writing three separate, hand-duplicated resource blocks with unique local names
• C. A provisioner block that loops internally to create each bucket
• D. A nested module with no input variables at all

15. An engineer wants to select an appropriate meta-argument for creating multiple resource instances from a map where each resource needs a stable identity even if items are added or removed from the middle of the collection. Why is for_each generally preferred over count in this case?

• A. for_each keys each instance by a map key or set value, so removing or adding an unrelated element does not shift the index-based identity of other instances
• B. count automatically re-keys instances by name whenever the list changes
• C. for_each cannot be used with modules, only with resources
• D. count and for_each are functionally identical and interchangeable in every scenario

16. A configuration includes `locals { name_prefix = "${var.environment}-app" }` and later references `local.name_prefix` in multiple resources. What is the primary benefit of using a local value here?

• A. It computes a derived expression once and gives it a reusable name, avoiding repeating the same interpolation logic across multiple resources
• B. Local values can be overridden at apply time using a -var flag just like input variables
• C. Local values automatically become outputs of the root module
• D. Local values are required before any variable can be declared

17. A root configuration calls a module for provisioning a VPC, passing in a cidr_block variable and expecting a vpc_id back for use elsewhere in the root. Which two module features make this data flow possible?

• A. Input variables defined in the module accept values from the caller, and output values defined in the module expose data back to the caller
• B. Modules automatically share their entire state with the root module without any explicit inputs or outputs
• C. Only the root module can define variables; child modules can only define outputs
• D. Modules communicate exclusively through provider configuration blocks

18. A team wants to reuse a well-tested networking module published by a third party, pinning it to a specific version to avoid unexpected breaking changes. Which source configuration best supports this in a module block?

• A. Referencing the module from a registry source with an explicit version constraint, e.g. version = "~> 2.0"
• B. Copying the module's source files directly into every consuming configuration's directory
• C. Referencing the module source with no version argument so it always tracks the newest release
• D. Declaring the module as a provider block instead of a module block

19. Within a root module, a child module block is written as `module "network" { source = "./modules/network" }` and the module internally creates an aws_vpc resource named "this". How would the root module reference an output value named vpc_id exposed by that module?

• A. module.network.vpc_id
• B. aws_vpc.this.vpc_id
• C. network.module.vpc_id
• D. var.network.vpc_id

20. A large configuration repeats near-identical blocks for provisioning a web tier across three environments (dev, staging, prod), varying only instance sizes and counts. What is the primary architectural benefit of extracting this into a reusable module with input variables for size and count?

• A. It centralizes the shared logic in one place so fixes and improvements propagate to every environment that calls the module
• B. It removes the need to ever run terraform plan in any environment that uses the module
• C. It guarantees that all three environments will always have identical instance counts
• D. It automatically merges the three environments' state files into one

21. A nested child module internally calls another module two levels deep, and that innermost module declares a resource. From the root module's perspective, why can't the root directly reference that innermost resource by its resource address without going through outputs?

• A. Each module has its own local resource namespace, and data only crosses a module boundary through explicitly declared outputs and inputs
• B. Terraform limits module nesting to a single level, so this configuration would fail to load
• C. Resources declared in nested modules are automatically renamed to include the root module's name
• D. Only provider configurations, never resources, can exist inside nested modules

22. Two engineers run terraform apply against the same remote backend workspace at nearly the same time. What mechanism is designed to prevent both applies from corrupting the state file simultaneously?

• A. State locking, which many remote backends support to serialize concurrent write operations
• B. Terraform automatically merges concurrent state changes like a version control system merges text files
• C. The second terraform apply silently overwrites the first apply's state changes without warning
• D. Local state files always prevent concurrent access even without a remote backend

23. An engineer manually deletes a cloud resource from the provider console that Terraform is still tracking in its state file. The next time terraform plan runs, what will Terraform most likely report?

• A. Terraform will detect drift and plan to recreate the resource, since state says it should exist but the real infrastructure does not
• B. Terraform will automatically update its state to remove the resource with no plan output at all
• C. terraform plan will fail with an unrecoverable error and require deleting the entire state file
• D. Terraform will ignore the discrepancy until the next terraform destroy is run

24. A team stores terraform.tfstate as a local file inside their project's git repository. What is the most significant risk of this practice compared to using a remote backend?

• A. State can easily fall out of sync between collaborators, and sensitive values in state may be exposed in version control history
• B. Local state files cannot store resource attributes at all
• C. Git repositories reject any file over 1 KB, so state files will not commit successfully
• D. Local state automatically encrypts itself when committed to any git provider

25. A resource was created outside of Terraform (via the console) and now needs to be brought under Terraform management without destroying and recreating it. Which command is designed for this purpose?

• A. terraform import
• B. terraform taint
• C. terraform refresh only, with no configuration written
• D. terraform apply -destroy

26. A team splits a large monolithic configuration's state into multiple smaller state files organized by service boundary (networking, database, application). What is a key trade-off introduced by this split?

• A. Cross-service references now require explicit data sharing (such as remote state data sources or outputs), since each state file only knows about its own resources
• B. All state files must now be applied in a single terraform apply command simultaneously
• C. Splitting state eliminates the possibility of ever needing state locking
• D. Terraform automatically keeps all split state files in sync with no additional configuration

27. A provider's resource attribute value stored in state does not match the real infrastructure's current value because someone modified the resource out-of-band. Which core Terraform operation, run as part of plan, is responsible for detecting this kind of discrepancy before proposing changes?

• A. The refresh step, which queries the current state of real infrastructure and reconciles it against the recorded state
• B. terraform fmt, which reformats configuration files
• C. terraform validate, which only checks configuration syntax
• D. terraform init, which downloads provider plugins

28. An operator wants to permanently remove a resource from Terraform's management without destroying the underlying real-world infrastructure. Which action accomplishes this?

• A. Removing the resource from state (e.g., via terraform state rm) while leaving the configuration or real resource alone as needed
• B. Running terraform destroy, which only removes the state entry and never touches real infrastructure
• C. Deleting the resource block from configuration is always sufficient with no other steps and never triggers a destroy
• D. Renaming the resource's local name in configuration accomplishes the same outcome automatically

29. A team wants to run custom validation scripts, generate documentation, or trigger notifications as part of their infrastructure lifecycle, but outside the scope of what terraform plan/apply directly does. Which category of usage does this best describe?

• A. Using Terraform outside of its core workflow, such as via external tooling, wrapper scripts, or provisioners integrated around the standard commands
• B. This is only possible by modifying the Terraform binary's source code directly
• C. This requires abandoning Terraform entirely in favor of a different tool
• D. terraform plan natively performs documentation generation and notification sending with no extra tooling

30. A provisioner block is added to a resource to run a remote-exec script that installs an application after the instance is created. What is a commonly cited caveat about relying heavily on provisioners for this purpose?

• A. Provisioners are considered a last resort because they can introduce non-idempotent, harder-to-track behavior compared to native provider features or dedicated configuration management tools
• B. Provisioners can only be attached to data sources, never to resources
• C. Provisioners always run before terraform plan and never during apply
• D. Using any provisioner permanently disables state locking for that resource

31. A pipeline wants to check that all committed .tf files are syntactically valid and consistently formatted before merging, without actually connecting to any cloud provider. Which combination of commands best supports this outside the normal plan/apply flow?

• A. terraform fmt -check and terraform validate
• B. terraform apply -auto-approve and terraform destroy
• C. terraform import and terraform state rm
• D. terraform workspace new and terraform workspace select

32. A team wants a shared, remote location to run terraform plan and apply, with built-in state storage, access controls, and a history of runs visible to the whole team, rather than everyone running Terraform CLI locally against a self-managed backend. Which product area does this describe?

• A. HCP Terraform (Terraform Cloud), which provides remote runs, state management, and collaboration features as a managed service
• B. terraform console, a local-only command for evaluating expressions interactively
• C. The terraform fmt command, which only reformats configuration files
• D. A provider plugin, which only implements resource and data source logic for a specific platform

33. An organization uses HCP Terraform workspaces to separate configuration and state for dev, staging, and prod environments, each with its own variable sets and run history. What is the primary organizational benefit of using separate workspaces here rather than one shared workspace for all three environments?

• A. Each environment's state, variables, and run history stay isolated, reducing the risk that a change intended for one environment accidentally affects another
• B. Separate workspaces automatically synchronize variable values across all environments
• C. Only one workspace total is allowed per HCP Terraform organization
• D. Workspaces remove the need to ever define environment-specific variables

34. A company wants multiple engineers to collaborate on the same set of Terraform configurations, with runs automatically triggered on VCS commits and clear visibility into who approved which apply. Which HCP Terraform capability area most directly supports this requirement?

• A. VCS-driven workflows combined with team-based access controls and run approval history
• B. Only running terraform apply -auto-approve locally on each engineer's laptop
• C. Manually emailing plan output to teammates for review before every apply
• D. Disabling state locking so multiple people can apply concurrently without waiting

35. A workspace in HCP Terraform is configured with remote execution mode, meaning plan and apply operations run on HCP Terraform's infrastructure rather than a user's local machine. What is one advantage of this remote execution model for a team?

• A. Runs execute in a consistent, centrally managed environment with consistent provider/plugin versions and don't depend on any individual engineer's local machine setup
• B. Remote execution mode removes the need for any provider credentials to be configured anywhere
• C. Remote execution guarantees that plans never show any changes
• D. Remote execution mode is only available for the terraform destroy command

36. Which of the following best describes what HCP Terraform's Sentinel or OPA-based policy checks are typically used for in a workspace's run pipeline?

• A. Enforcing organizational rules (such as required tags, allowed instance types, or cost limits) against a plan before it can be applied
• B. Automatically writing the Terraform configuration files for the user
• C. Replacing the need for a provider block in the configuration
• D. Formatting HCL code according to canonical style

37. A newcomer to Terraform asks why 'basic terminal skills and an understanding of on-premises and cloud architecture' are recommended before attempting to learn Terraform in a production context. Which best explains this recommendation?

• A. Terraform is operated primarily via CLI commands and manages real infrastructure resources, so comfort with a terminal and infrastructure concepts helps in understanding what configurations actually provision
• B. Terraform cannot be installed on any operating system that includes a graphical user interface
• C. HashiCorp requires a separate terminal-usage certification before anyone may install Terraform
• D. Infrastructure architecture knowledge is only relevant to Terraform's HCP Terraform product, not the open-source CLI

38. A candidate is scheduling their Terraform Associate exam and wants to know roughly how long they should budget for the actual online proctored session. Which duration should they plan for?

• A. About 1 hour (60 minutes)
• B. About 4 hours
• C. About 15 minutes
• D. About 8 hours across two sessions

39. A candidate wants to know how many separate objective domains the Terraform Associate (004) exam measures knowledge across, so they can plan their study checklist. What is the correct count?

• A. Eight objective domains
• B. Three objective domains
• C. Twelve objective domains
• D. Five objective domains

40. A candidate is reviewing the format of the Terraform Associate exam and wants to know what kinds of questions to expect on exam day. Which set of question types matches the official format?

• A. True or false, multiple choice, and multiple answer questions
• B. Only essay-style, free-response questions
• C. Only fill-in-the-blank coding exercises with no answer choices
• D. Only matching-pairs style questions

41. A candidate passes the Terraform Associate exam today and wants to know how long the resulting certification credential remains valid before recertification is required.

• A. 2 years
• B. 1 year
• C. 5 years
• D. The credential never expires

42. A candidate is budgeting for the Terraform Associate exam registration and wants to know the base exam fee before any locally applicable taxes or fees are added.

• A. $70.50 USD
• B. $150.00 USD
• C. $35.00 USD
• D. $225.00 USD

43. A candidate fails the Terraform Associate exam on their first attempt and asks whether a free retake is included in the price they already paid. Based on the official policy, what should they be told?

• A. No, a free retake is not included in the exam price, so a retake would require paying again
• B. Yes, every candidate automatically receives one free retake within 24 hours
• C. Yes, but only if they fail by fewer than five percentage points
• D. Retakes are entirely prohibited and the credential can never be attempted again

44. A study guide for this exam version notes that scenario questions may assume behavior consistent with a specific Terraform release line. Which version does this exam version test on?

• A. Terraform 1.12
• B. Terraform 0.11
• C. Terraform 2.0
• D. Terraform 1.0 exactly, with no later point releases

45. A candidate asks whether the Terraform Associate exam publishes an official percentage weighting for each of its eight objective domains, similar to how some other certification exams list exact percentages per domain. Based on the official exam guidance, what is accurate?

• A. The exam does not publish per-objective percentage weightings, so candidates should prepare across all eight domains rather than optimizing study time by a published percentage split
• B. Each of the eight domains is weighted at exactly 12.5 percent, published officially by HashiCorp
• C. The state management domain alone makes up 50 percent of the exam by official published weighting
• D. Only two of the eight domains are actually tested, despite all eight being listed