Question bank
HashiCorp Certified: Terraform Associate
44 HashiCorp Certified: Terraform Associate questions with the correct answer and a written explanation, organised across 9 exam domains.
- 44 questions
- 9 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
HCP Terraform Workspaces and Projects
3 questions in this domain
- Question 1Single Choice
Which statement accurately describes the relationship between HCP Terraform projects and workspaces?
- AProject groups workspaces; each has own state.Correct answer
- BWorkspace groups projects; project shares state.
- CProjects store workspace state files.
- DWorkspaces require project membership to store state.
Why this is the answer
Projects are administrative containers that group workspaces for governance. Each workspace holds its own unique state file and execution environment, while projects do not hold state.
- Question 2Multiple Select
Which two statements about HCP Terraform variable sets are correct?
- ACan be applied to multiple workspaces or projects.Correct answer
- BUpdates propagate to all associated workspaces.Correct answer
- CThey replace locally defined workspace variables.
- DThey store state files for shared workspaces.
Why this is the answer
Variable sets centralize shared configuration and can be assigned to multiple workspaces or projects. A single update propagates to all associated workspaces, reducing overhead and preventing drift.
- Question 3Interactive
Consider the HCL variable declaration shown in the code block. Which statement correctly describes its role when used with HCP Terraform?
- AIt defines the input schema.Correct answer
- BIt stores the value as a workspace variable automatically.
- CIt assigns the variable to all project workspaces.
- DIt removes the need for HCP Terraform variables.
Why this is the answer
HCL variable blocks define the schema and defaults. Actual values can be provided through HCP Terraform workspace variables or by using the declared default.
Infrastructure as Code (IaC) with Terraform
5 questions in this domain
- Question 4Single Choice
Which statement best defines Infrastructure as Code (IaC) as a practice for managing IT environments?
- AManaging infrastructure through machine-readable configuration filesCorrect answer
- BUsing manual runbooks to configure cloud resources
- CWriting shell scripts to call cloud APIs
- DDeploying application code to running servers
Why this is the answer
IaC encodes the desired infrastructure state in configuration files, enabling version control, automated review, and consistent provisioning.
- Question 5Multiple Select
Which benefits does Infrastructure as Code provide when it is used to manage cloud environments? Select all that apply.
- AVersion control integrationCorrect answer
- BIdempotent provisioningCorrect answer
- CReproducible environmentsCorrect answer
- DReal-time performance monitoring
Why this is the answer
IaC provides version control, idempotent applies, and repeatable environments. It does not replace performance monitoring or remove the need for credentials.
- Question 6Interactive
What type of infrastructure component is declared by each top-level block in the configuration? Choose the best answer.
- AResourceCorrect answer
- BProvider
- CVariable
- DOutput
Why this is the answer
Terraform configuration declares resources, such as aws_instance, that the provider creates and manages.
- Question 7Single Choice
What is the meaning of idempotency when Terraform apply is executed multiple times against an unchanged configuration?
- ANo changes after desired state is reachedCorrect answer
- BRepeated commands produce identical output
- CPerformance is monitored continuously
- DResource deletion is permanently prevented
Why this is the answer
An idempotent apply makes no changes when actual state already matches the defined desired state.
- Question 8Multiple Select
Which tasks are better suited to configuration management tools than to Terraform provisioning? Select all that apply.
- AInstalling software packages on existing hostsCorrect answer
- BManaging user accounts and OS-level filesCorrect answer
- CProvisioning cloud VPCs and subnets
- DDeploying application binaries to running VMsCorrect answer
Why this is the answer
Configuration management tools handle software, users, and files inside running hosts; Terraform provisions the underlying infrastructure.
Lifecycle and Advanced Configuration Rules
3 questions in this domain
- Question 9Single Choice
Which lifecycle meta-argument prevents Terraform from destroying a resource during a plan or apply?
- Aprevent_destroyCorrect answer
- Bcreate_before_destroy
- Cignore_changes
- Densure_destroy
Why this is the answer
prevent_destroy is a lifecycle meta-argument that protects a resource from being destroyed by Terraform. If a plan would destroy the resource, Terraform halts with an error, which is useful for high-value assets such as production databases.
- Question 10Multiple Select
Which statements accurately describe dynamic blocks in Terraform? Select two.
- AThey use for_each to iterate over a collection and produce repeated nested blocks.Correct answer
- BThey create multiple copies of the resource in which they are defined.
- CA content block is required to assign values from the current iteration to the nested block attributes.Correct answer
- DThey can only be used with tuple and object variable types.
Why this is the answer
Dynamic blocks generate repeated nested blocks within a single resource by iterating over a collection with for_each. The content block is mandatory because it defines the structure of each generated nested block. Dynamic blocks do not create multiple resources, and they are not limited to tuple or object types.
- Question 11Interactive
Review the dynamic block in the code block. The collection and iterator are defined, but a required inner block is missing. What is the missing block?
- AcontentCorrect answer
- Bbody
- Cloop
- Dvalues
Why this is the answer
Every dynamic block must contain a content block. The content block defines the actual nested block structure and is the place where the iterator variable is used to assign dynamic values.
Terraform CLI and Providers
5 questions in this domain
- Question 12Single Choice
What is the primary distinction between Terraform CLI installation and Terraform initialization?
- AInstalling the CLI places the binary on the system, while initialization prepares the working directory by downloading providers and setting up the backend.Correct answer
- BInstalling the CLI downloads provider plugins, while initialization simply verifies the HCL syntax.
- CInstalling the CLI creates the .terraform.lock.hcl file, while initialization makes the terraform command available globally.
- DThere is no difference; both terms describe the same action.
Why this is the answer
CLI installation makes the terraform binary executable from the system PATH. Initialization is project-specific and prepares the working directory by downloading providers and configuring the backend.
- Question 13Multiple Select
Which two artifacts are generated or managed when you run terraform init?
- AThe local .terraform directory containing provider pluginsCorrect answer
- BThe .terraform.lock.hcl dependency lock fileCorrect answer
- CThe main.tf configuration file
- DThe state file in the remote backend
Why this is the answer
During initialization, Terraform downloads provider plugins into the .terraform directory and creates or updates .terraform.lock.hcl. It does not create configuration files or the state file.
- Question 14Interactive
After cloning a repository that contains the configuration shown, what command must be run before terraform plan can succeed?
- Aterraform initCorrect answer
- Bterraform install
- Cterraform download
- Dterraform validate
Why this is the answer
terraform init is required to download provider plugins, initialize the backend, and create the dependency lock file before planning or applying.
- Question 15Single Choice
What does the version constraint ~> 1.2 indicate in a provider block?
- AAny version from 1.2 up to, but not including, 2.0Correct answer
- BExactly version 1.2
- CAny version from 1.2 up to, but not including, 1.3
- DAny version greater than or equal to 2.0
Why this is the answer
The pessimistic constraint ~> 1.2 allows versions greater than or equal to 1.2 and less than 2.0, preventing major breaking upgrades.
- Question 16Multiple Select
Which two statements about the .terraform.lock.hcl file are true?
- AIt records the exact versions and cryptographic hashes of the providers used during initialization.Correct answer
- BIt should be committed to version control to ensure consistent provider versions across environments.Correct answer
- CIt contains the actual provider binary plugins.
- DIt is a temporary file that can be safely ignored after every terraform init.
Why this is the answer
The lock file stores provider versions and checksums, and it must be committed to version control to prevent dependency drift across teams and CI/CD runners.
Terraform Cloud and Enterprise Capabilities
5 questions in this domain
- Question 17Single Choice
Which Terraform Cloud feature automatically prevents non-compliant infrastructure from being deployed in a managed organization?
- APolicy as Code with Sentinel or OPACorrect answer
- BLocal state files
- CPublic Terraform Registry
- DManual code reviews
Why this is the answer
Policy as Code uses Sentinel or OPA to evaluate plans and block non-compliant infrastructure before deployment, providing automated governance.
- Question 18Multiple Select
Which of the following are benefits of Terraform Cloud or HCP Terraform compared to local CLI workflows? Select all that apply.
- ACentralized remote state managementCorrect answer
- BAutomated policy enforcementCorrect answer
- CVCS-driven workflow automationCorrect answer
- DLocal execution on developer machines
Why this is the answer
Terraform Cloud provides centralized state, automated governance, and VCS-driven workflows. Local execution on developer machines is opposite to its remote execution model.
- Question 19Interactive
Refer to the configuration code block below. Which Terraform Cloud capability is being demonstrated by this resource?
- ARemote state sharing between workspacesCorrect answer
- BPrivate module registry
- CSentinel policy enforcement
- DLocal CLI execution
Why this is the answer
The terraform_remote_state data source reads output values from another workspace's remote state, demonstrating centralized remote state sharing in Terraform Cloud.
- Question 20Single Choice
At which stage does Terraform Cloud evaluate Sentinel or Open Policy Agent policies during a run?
- ADuring the plan phaseCorrect answer
- BDuring the apply phase
- CAfter state lock release
- DDuring manual code review
Why this is the answer
Policy controls are evaluated during the plan phase, preventing non-compliant infrastructure from ever reaching the apply stage.
- Question 21Multiple Select
Which statements accurately describe team-based access and governance in Terraform Cloud? Select all that apply.
- ATeams group users with shared responsibilities and are mapped to workspacesCorrect answer
- BPermissions are assigned at the individual resource level
- CAudit logs provide a record of actions for complianceCorrect answer
- DRBAC supports least privilege by limiting workspace accessCorrect answer
Why this is the answer
Team-based access groups users, grants granular RBAC at the workspace level, and keeps audit logs for governance. Permissions are not assigned to individual resources.
Terraform Configuration Language
8 questions in this domain
- Question 22Single Choice
Which HCL element is the primary structural unit that acts as a container for arguments and nested blocks?
- ABlockCorrect answer
- BArgument
- CExpression
- DAttribute
Why this is the answer
A block is the primary structural unit in HCL, acting as a container for arguments and nested blocks.
- Question 23Multiple Select
Which statements about Terraform parameterization mechanisms are correct? (Select all that apply.)
- AInput variables are the primary interface for external customization.Correct answer
- BLocal values can be set by users through .tfvars files.
- COutput values are consumer-facing return values from a module.Correct answer
- DOutput values are commonly used to set resource arguments inside the same module.
Why this is the answer
Input variables allow external customization, and output values expose module data. Local values are internal, and outputs do not flow back into resource arguments.
- Question 24Interactive
In the displayed HCL code, how should the value assigned to the 'Name' tag be classified?
- AA literal string
- BAn interpolation expressionCorrect answer
- CAn argument name
- DA block label
Why this is the answer
The Name tag value contains ${...}, so it is an interpolation expression that embeds a dynamic value inside a string.
- Question 25Single Choice
What is the main purpose of input variables in Terraform?
- ATo enable customization of deployments from outside the configurationCorrect answer
- BTo store internal calculated values used in multiple locations
- CTo expose resource attributes to module consumers
- DTo replace the remote state backend
Why this is the answer
Input variables are the primary interface for external configuration, allowing users to customize parameters without modifying the core logic.
- Question 26Multiple Select
Which statements about resource dependencies are correct? (Select all that apply.)
- AAn implicit dependency is created when one resource references another resource's attribute.Correct answer
- Bdepends_on should be used for every resource relationship.
- Cdepends_on is appropriate when no attribute reference exists between resources.Correct answer
- DThe DAG permits circular dependencies so resources can wait on each other.
Why this is the answer
Implicit dependencies come from attribute references, while depends_on should be used only when no attribute link exists. Circular dependencies are not allowed in a DAG.
- Question 27Interactive
In the resource configuration shown, what type of dependency exists between the instance and the subnet?
- AImplicit dependencyCorrect answer
- BExplicit dependency
- CCircular dependency
- DNo dependency
Why this is the answer
The instance references aws_subnet.main.id, so Terraform automatically detects an implicit dependency.
- Question 28Single Choice
Which built-in function is used to retrieve a value from a map by key?
- Alookup()Correct answer
- Bjoin()
- Celement()
- Dmerge()
Why this is the answer
lookup() retrieves a value from a map by key. join() concatenates strings, element() gets list items, and merge() combines maps.
- Question 29Multiple Select
Which statements about count and for_each are correct? (Select all that apply.)
- Acount uses an integer to create a specified number of resource instances.Correct answer
- Bfor_each can iterate over maps and sets of strings.Correct answer
- Ccount is more stable than for_each when items are removed from the middle of a list.
- Dfor_each uses map keys as unique identifiers in Terraform state.Correct answer
Why this is the answer
count is integer-based, while for_each works with maps/sets and uses keys as state identifiers, giving it greater stability when collections change.
Terraform Lifecycle and Workflows
5 questions in this domain
- Question 30Single Choice
Which Terraform command previews the changes that will be made to infrastructure without modifying real-world resources?
- Aterraform planCorrect answer
- Bterraform apply
- Cterraform validate
- Dterraform init
Why this is the answer
terraform plan is the speculative phase of the workflow. It reads the current state and provider information to produce an execution plan, but it does not change infrastructure or persist updates to the state file.
- Question 31Multiple Select
Which statements correctly describe the core Terraform workflow phases? Select all that apply.
- AThe write phase uses HCL to define the desired state of infrastructure.Correct answer
- BThe plan phase is a dry-run that does not alter real infrastructure.Correct answer
- CThe apply phase updates the state file to match the real-world resources.Correct answer
- DThe plan phase writes changes to the state file on disk.
Why this is the answer
The write phase codifies the desired state in HCL. The plan phase is speculative and only reads state and provider data, so it has no side effects. The apply phase executes API calls and updates the state file. Terraform plan never persists changes to the state file.
- Question 32Interactive
Review the command output in the code block. Which Terraform command produces this execution summary before changing infrastructure?
- Aterraform planCorrect answer
- Bterraform apply
- Cterraform init
- Dterraform validate
Why this is the answer
The output \"Plan: 1 to add, 0 to change, 0 to destroy\" is an execution plan summary produced by terraform plan. It describes proposed actions without applying them to real infrastructure.
- Question 33Single Choice
Which Terraform command performs a lightweight, local check of configuration syntax and internal consistency without needing provider credentials or state access?
- Aterraform validateCorrect answer
- Bterraform plan
- Cterraform apply
- Dterraform init
Why this is the answer
terraform validate performs static analysis on the configuration to check syntax and internal consistency. It does not interact with the state file or cloud provider APIs, making it a fast and local safety check.
- Question 34Multiple Select
Which statements about Terraform outputs and lifecycle behavior are true? Select all that apply.
- ASetting sensitive = true prevents an output value from being shown in CLI output, though it remains in the state file.Correct answer
- Bcreate_before_destroy is a lifecycle meta-argument that creates a replacement resource before destroying the original.Correct answer
- Cprevent_destroy causes Terraform to error if a configuration change would destroy the protected resource.Correct answer
- DChanging an immutable attribute results in an in-place update rather than resource replacement.
Why this is the answer
sensitive outputs hide values from CLI display but the state file still stores them. create_before_destroy reduces downtime by creating the replacement first. prevent_destroy blocks destructive changes. Changing an immutable attribute requires replacement, not an in-place update.
Terraform Modules
5 questions in this domain
- Question 35Single Choice
Which type of path is required to call a local Terraform module?
- ARelative or absolute filesystem path (e.g., './modules/vpc')Correct answer
- BRegistry namespace/name/provider (e.g., 'hashicorp/vpc/aws')
- CGit URL with a version tag
- DRemote S3 object URL
Why this is the answer
A local module is called by setting source to a filesystem path such as './modules/vpc'. Registry modules use the namespace/name/provider format, not file paths.
- Question 36Multiple Select
Which two statements about module inputs and outputs are correct? (Select two.)
- AInput variables define the module's inbound interfaceCorrect answer
- BOutput values expose resource attributes to the calling moduleCorrect answer
- CVariables inside a module are automatically assigned from root variables
- DResource attributes in a module are directly accessible to the root
Why this is the answer
Variables are the module's inbound API, and outputs expose results to the caller. Terraform requires explicit passing and does not allow direct access to encapsulated resources.
- Question 37Interactive
After the module block in this configuration is added, which command must be run before terraform plan?
- Aterraform initCorrect answer
- Bterraform plan
- Cterraform apply
- Dterraform validate
Why this is the answer
After adding a new module, terraform init must be run because it indexes the path and populates .terraform/modules. The other commands do not perform this step.
- Question 38Single Choice
Why is specifying a version constraint recommended when calling a registry module?
- ATo ensure stable and reproducible deploymentsCorrect answer
- BTo download modules more quickly
- CTo generate configuration documentation
- DTo enable caching of provider binaries
Why this is the answer
Version constraints protect production deployments from breaking changes because the module source is not updated silently to a new major version.
- Question 39Multiple Select
Which two practices support module composition and reuse? (Select two.)
- ADefine variables to make modules reusable across environmentsCorrect answer
- BPin remote module versions to prevent breaking changesCorrect answer
- CHardcode environment-specific values inside the module
- DCall every resource as a separate module
Why this is the answer
Modules are reusable when inputs are parameterized, and remote modules should be version-pinned. Hardcoding values and over-fragmenting infrastructure are both anti-patterns.
Terraform State Management
5 questions in this domain
- Question 40Single Choice
What is the primary role of the Terraform state file?
- AIt maps logical resource names to real-world resource IDs.Correct answer
- BIt stores the HCL configuration source code.
- CIt records all user commands and API calls.
- DIt caches provider plugins for faster execution.
Why this is the answer
The state file is Terraform's source of truth for mapping configured resource names to provider-generated IDs. This mapping enables updates, dependency tracking, and drift detection.
- Question 41Multiple Select
Which two statements about Terraform state are correct? Select all that apply.
- AState stores sensitive values such as passwords in plain text.Correct answer
- BState records the relationship between configuration and live resources.Correct answer
- CState files are written in HCL format like configuration files.
- DState files should be committed to Git for version control.
Why this is the answer
State contains sensitive values in plain text and links configuration to real infrastructure. It is JSON, not HCL, and should never be committed to version control.
- Question 42Interactive
A resource block was renamed as shown in the code. Which command updates the state so Terraform does not plan to replace the resource?
- Aterraform state mv aws_instance.web_server aws_instance.application_serverCorrect answer
- Bterraform state rm aws_instance.web_server
- Cterraform state list
- Dterraform destroy
Why this is the answer
terraform state mv updates the state address without touching the cloud resource. Without it, Terraform would plan to destroy the old instance and create a new one.
- Question 43Single Choice
Which Terraform command shows detailed attribute values for a single resource in the state file?
- Aterraform state show <address>Correct answer
- Bterraform state list
- Cterraform plan
- Dterraform refresh
Why this is the answer
terraform state show reveals the stored attributes of one resource. list only shows addresses; plan shows proposed changes; refresh syncs state with cloud data.
- Question 44Multiple Select
Which statements about remote backends and state locking are correct? Select all that apply.
- AAn S3 backend requires a separate DynamoDB table for locking.Correct answer
- BRemote backends provide a shared source of truth for teams.Correct answer
- CState locking prevents concurrent writes that can corrupt state.Correct answer
- DLocal backend storage supports automatic state locking.
Why this is the answer
Remote backends support team workflows, S3 locking uses DynamoDB, and locking prevents concurrent writes. Local backends do not provide automatic locking.
Frequently asked questions
Everything about the HashiCorp Certified: Terraform Associate question bank and how to use it.