HashiCorp Certified: Terraform Associate (004)

Question 1

A team wants an output that displays a custom DNS name when the variable custom_dns is set to a non-empty string, but otherwise falls back to the auto-generated endpoint from an AWS resource attribute. They want to avoid nested conditional expressions. Which built-in function best returns the first non-empty value from a list of arguments?

Accepted Answer

coalesce(var.custom_dns, aws_db_instance.main.endpoint)

Answer

concat(var.custom_dns, aws_db_instance.main.endpoint)

Answer

merge(var.custom_dns, aws_db_instance.main.endpoint)

Answer

lookup(var.custom_dns, aws_db_instance.main.endpoint)

Question 2

A team wants an aws_cloudwatch_metric_alarm to be created only when a boolean variable named enable_monitoring is set to true. When enable_monitoring is false, no alarm resource should exist. Which configuration correctly implements this toggle using the count meta-argument?

Accepted Answer

count = var.enable_monitoring ? 1 : 0

Answer

count = var.enable_monitoring

Answer

for_each = var.enable_monitoring

Answer

count = length(var.enable_monitoring)

Question 3

A developer runs 'terraform destroy' to tear down a temporary test environment. Later that day, they need the exact same environment back. The configuration files (.tf) and provider lock file are all still present in the working directory, and 'terraform init' has already been run. Which single command will recreate the entire environment as defined in the configuration?

Accepted Answer

terraform apply

Answer

terraform refresh

Answer

terraform import

Answer

terraform state push

Question 4

A developer has finished editing a Terraform configuration and wants to provision the infrastructure. They have not saved a plan file. Which single command will show the proposed changes and, after interactive approval, create the resources?

Accepted Answer

terraform apply

Answer

terraform plan

Answer

terraform refresh

Answer

terraform init

Question 5

A new engineer clones your Terraform repository containing several .tf files that reference the AWS provider. They immediately run 'terraform plan' and receive an error stating the provider is not installed and that they must run another command first. Which command must they run before 'terraform plan' will succeed, and why?

Accepted Answer

Run 'terraform init' to download the required provider plugins and prepare the working directory.

Answer

Run 'terraform apply' first, because apply installs providers automatically and plan does not.

Answer

Run 'terraform validate' to install the providers referenced in the configuration files.

Answer

Run 'terraform refresh' to sync state and pull down the provider binaries from the registry.

Question 6

A junior engineer has finished writing a new Terraform configuration that adds several resources and modifies an existing security group. Before making any changes to the live environment, they want to review exactly what Terraform intends to create, update, or delete so the team can approve the changes during a code review. Which command should they run to produce this preview without altering any real infrastructure?

Accepted Answer

terraform plan

Answer

terraform apply -auto-approve

Answer

terraform validate

Answer

terraform refresh

Question 7

A developer manages three AWS S3 buckets in a single Terraform configuration. To decommission just one bucket, they delete its resource block from the .tf file and run `terraform apply`. The other two buckets must remain untouched. What will Terraform do?

Accepted Answer

Destroy only the bucket whose resource block was removed, leaving the other two buckets unchanged

Answer

Destroy all three buckets because the configuration was modified

Answer

Ignore the removal and keep all three buckets until `terraform destroy` is run

Answer

Return an error requiring the developer to use `terraform state rm` first

Question 8

You are writing HCL to create three EC2 instances from a variable named `instance_names`, which is a list of strings. You want each instance's `Name` tag to match the corresponding string in the list. Which configuration correctly assigns the right name to each instance?

Accepted Answer

Use `count = length(var.instance_names)` on the resource and set the tag with `Name = var.instance_names[count.index]`

Answer

Use `count = length(var.instance_names)` and set the tag with `Name = var.instance_names` so Terraform maps the list automatically

Answer

Use `count = var.instance_names` and set the tag with `Name = each.value`

Answer

Use `for_each = length(var.instance_names)` and set the tag with `Name = count.value`

Question 9

Your team must always deploy EC2 instances using the most recent official Ubuntu AMI, which changes frequently. You do not manage the AMI itself with Terraform, but you need its ID available in your configuration so the aws_instance resource can reference it. Which HCL construct should you use to obtain the AMI ID?

Accepted Answer

A data source (data "aws_ami") that filters for the latest matching image, referenced by the instance's ami argument

Answer

A resource block (resource "aws_ami") to create the AMI and pass its id to the instance

Answer

An input variable with a default set to the current AMI ID, updated manually before each apply

Answer

A local value that hardcodes the AMI ID string for reuse across resources

Question 10

A DevOps engineer writes Terraform configuration to provision three EC2 instances. After running 'terraform apply' successfully, a teammate runs 'terraform apply' again without changing any code or infrastructure. What behavior should the engineer expect, and which IaC principle explains it?

Accepted Answer

Terraform will report that no changes are needed and make no modifications, demonstrating idempotency in a declarative approach.

Answer

Terraform will create three additional EC2 instances because each apply provisions new resources; this reflects the imperative model.

Answer

Terraform will destroy and recreate the three instances to guarantee a fresh state, reflecting immutable infrastructure.

Answer

Terraform will return an error because applying the same configuration twice is not permitted without '-force'.

Question 11

A new team member argues that Terraform configurations should list the exact sequence of API calls needed to build infrastructure, similar to a shell script. A senior engineer explains that Terraform does not work this way. Which statement best describes how Terraform's approach differs from the shell-script method the new member described?

Accepted Answer

Terraform uses a declarative model where you define the desired end state, and Terraform determines the operations needed to reach it.

Answer

Terraform uses an imperative model where each resource block is executed as an ordered command exactly as written.

Answer

Terraform requires you to manually specify every create, update, and delete operation in the correct order.

Answer

Terraform executes configuration files top-to-bottom, so resource order in the file always dictates provisioning order.

Question 12

An engineer manages an AWS EC2 instance that runs a startup script needing an IAM policy to be fully attached before the instance boots. The instance configuration does not reference any attribute of the IAM policy resource, so Terraform sometimes creates them in parallel, causing the script to fail. Which change should the engineer make to guarantee correct ordering?

Accepted Answer

Add an explicit depends_on argument to the EC2 instance resource listing the IAM policy resource

Answer

Add a provisioner block to the IAM policy resource so it blocks until attachment completes

Answer

Run terraform apply twice so the IAM policy exists before the second apply creates the instance

Answer

Wrap both resources in a single module so Terraform processes them sequentially

Question 13

You are writing a security group resource that must produce a variable number of nested `ingress` blocks based on a list of port objects passed as `var.ingress_rules` (each with `port` and `cidr` attributes). You want to avoid hardcoding repeated `ingress { ... }` blocks. Which construct correctly generates the nested blocks?

Accepted Answer

A `dynamic "ingress"` block with a `for_each = var.ingress_rules` and a `content` block referencing `ingress.value.port` and `ingress.value.cidr`

Answer

A `count = length(var.ingress_rules)` meta-argument on the security group resource, indexing rules with `count.index`

Answer

A single `ingress` block using `for_each = var.ingress_rules` directly inside the block body

Answer

A `dynamic "ingress"` block with `for_each = var.ingress_rules` and a `content` block referencing `each.value.port` and `each.value.cidr`

Question 14

You are writing a module that creates 6 EC2 instances using count, and you want to distribute them across a list of 3 availability-zone subnet IDs stored in var.subnet_ids. You need each instance's subnet_id to cycle through the 3 subnets (instance 0 → subnet 0, instance 3 → subnet 0 again, etc.) without going out of bounds. Which expression should you assign to subnet_id?

Accepted Answer

subnet_id = element(var.subnet_ids, count.index)

Answer

subnet_id = var.subnet_ids[count.index]

Answer

subnet_id = lookup(var.subnet_ids, count.index)

Answer

subnet_id = slice(var.subnet_ids, count.index, 1)

Question 15

A teammate wrote the following resource block and Terraform returns an error during plan:

```hcl
variable "buckets" {
  type    = list(string)
  default = ["logs", "backups", "assets"]
}

resource "aws_s3_bucket" "this" {
  for_each = var.buckets
  bucket   = each.value
}
```

The error states the `for_each` argument must be a map or a set of strings, not a list. Which change fixes the configuration while keeping the same input variable?

Accepted Answer

Wrap the variable in the toset() function: for_each = toset(var.buckets)

Answer

Replace for_each with count = length(var.buckets) and use each.value for the bucket name

Answer

Change the reference to for_each = var.buckets[*] to expand the list

Answer

Add lifecycle { ignore_changes = [for_each] } to suppress the type error

Question 16

A platform engineer wants to guarantee that an AWS S3 bucket created by Terraform always has versioning explicitly enabled before the apply is considered valid. They want the apply to fail with a clear error if the resulting resource does not meet this requirement, evaluated against the resource's own attributes after planning. Which Terraform feature should they use?

Accepted Answer

A `lifecycle` block with a `precondition` referencing the resource's versioning attribute

Answer

A `validation` block inside the `variable` definition for the bucket name

Answer

A `lifecycle` block with `ignore_changes` set to the versioning attribute

Answer

A `depends_on` argument pointing to the versioning configuration resource

Question 17

A team manages several S3 buckets using a single resource block. They currently use `count` with a list of bucket names in a variable. When they remove a name from the middle of the list and run `terraform plan`, Terraform proposes destroying and recreating multiple buckets that were not intended to change. Which change to the configuration best prevents this behavior while still iterating over the collection?

Accepted Answer

Refactor the resource to use `for_each` over a map or set of bucket names so each instance is keyed by a stable string rather than a numeric index.

Answer

Add a `depends_on` block referencing the S3 bucket resource so Terraform preserves ordering during the apply.

Answer

Add a `lifecycle` block with `create_before_destroy = true` to avoid the recreation of the remaining buckets.

Answer

Sort the list variable alphabetically so the indexes remain consistent between plans.

Question 18

You are given a variable named subnet_names of type list(string) containing three unique subnet names. You want to create one aws_subnet resource per name using for_each so that resources are keyed by name rather than by numeric index. Which configuration correctly uses for_each with this list variable?

Accepted Answer

for_each = toset(var.subnet_names), then reference each.value for the name

Answer

for_each = var.subnet_names, then reference each.value for the name

Answer

count = length(var.subnet_names), then reference var.subnet_names[count.index]

Answer

for_each = tolist(var.subnet_names), then reference each.key for the name

Question 19

You are creating multiple S3 buckets from a map variable that pairs a logical name with an environment tag. Inside a resource block using for_each over this map, you need to set the bucket name from the map key and apply the environment as a tag from the map value. Which pair of references correctly retrieves the key and value for each iteration?

Accepted Answer

each.key for the map key and each.value for the map value

Answer

count.index for the map key and each.value for the map value

Answer

each.name for the map key and each.tag for the map value

Answer

self.key for the map key and self.value for the map value

Question 20

You maintain a list of instance objects and need an output that contains only the private IP addresses of instances whose 'role' attribute equals "web". The variable is defined as a list of objects, each with 'role' and 'private_ip' attributes. Which expression produces the desired filtered list?

Accepted Answer

[for i in var.instances : i.private_ip if i.role == "web"]

Answer

[for i in var.instances : i.private_ip == "web"]

Answer

{for i in var.instances : i.role => i.private_ip if i.role == "web"}

Answer

[for i in var.instances if i.role == "web"]

Question 21

You have a variable `environments = ["dev", "staging", "prod"]` and need to produce a local value that is a map where each key is the environment name and each value is the environment name converted to uppercase (e.g., {"dev" = "DEV"}). Which local expression produces this result?

Accepted Answer

locals { env_map = { for e in var.environments : e => upper(e) } }

Answer

locals { env_map = [ for e in var.environments : e => upper(e) ] }

Answer

locals { env_map = { for e in var.environments : upper(e) } }

Answer

locals { env_map = { for e in var.environments : e = upper(e) } }

Question 22

Your team currently stores Terraform state in a file on a shared network drive that everyone edits from their laptops. You have experienced overwritten state files, lost updates, and exposed credentials stored in plaintext state. Leadership asks you to migrate to HCP Terraform as the remote backend. Which combination of benefits BEST justifies this migration compared to the current setup?

Accepted Answer

Automatic state locking during operations plus encryption of state at rest and in transit

Answer

Elimination of the need for a state file entirely, since HCP Terraform queries live infrastructure directly

Answer

Removal of all sensitive values from state so credentials are never written anywhere

Answer

Faster local plans because state is cached on each engineer's laptop after the first run

Question 23

A development team currently spins up identical staging environments by hand each time a new feature branch needs testing. This process takes several hours, and engineers often forget individual configuration steps, leading to environments that behave differently from one another. The team lead wants to adopt Infrastructure as Code specifically to solve the problem of recreating the same environment quickly and reliably on demand. Which IaC advantage most directly addresses this goal?

Accepted Answer

Repeatability and automation, allowing the same configuration to provision identical environments on demand

Answer

The ability to write configuration in an imperative language that specifies each provisioning step

Answer

Provider-agnostic syntax that lets the team target multiple cloud vendors

Answer

Automatic cost optimization that selects the cheapest resources during provisioning

Question 24

A platform engineering team currently provisions infrastructure by having individual engineers run shell scripts from their laptops. Changes are frequently applied without any peer review, and the team struggles to understand who changed what and why. Leadership wants to adopt Infrastructure as Code specifically to improve how proposed infrastructure changes are reviewed and discussed before they take effect. Which advantage of IaC most directly addresses this goal?

Accepted Answer

Because infrastructure is defined in text files, proposed changes can go through a pull request workflow where teammates review and approve them before they are applied.

Answer

IaC guarantees that no two engineers can ever run terraform apply against the same environment at the same time.

Answer

IaC automatically provisions resources faster than manual scripts, eliminating the need for any review.

Answer

IaC removes the need for cloud provider credentials, so security reviews are no longer required.

Question 25

A platform team manually patches a production web server's firewall rules during an incident, bypassing the Terraform configuration that originally provisioned it. Weeks later, a developer runs `terraform plan` against that infrastructure. Which advantage of Infrastructure as Code most directly helps the team identify this out-of-band change?

Accepted Answer

IaC exposes configuration drift by comparing the real infrastructure state against the declared desired state

Answer

IaC automatically prevents any manual changes from being made to managed resources

Answer

IaC increases provisioning speed so servers can be rebuilt faster than they are patched

Answer

IaC allows the same configuration to be deployed across multiple cloud providers

Question 26

A development team repeatedly encounters bugs that appear only in production but cannot be reproduced in their staging environment. Investigation reveals that staging was built by one engineer clicking through the cloud console, while production was set up months earlier by a different engineer using slightly different settings. Which core advantage of Infrastructure as Code most directly addresses this problem?

Accepted Answer

IaC lets the same configuration files provision staging and production identically, ensuring environment consistency across deployments

Answer

IaC automatically detects and corrects security vulnerabilities in cloud resources

Answer

IaC eliminates the need for a staging environment by testing directly in production

Answer

IaC reduces cloud spending by automatically selecting the cheapest available resources

Question 27

A finance team complains that cloud spending is unpredictable because operations engineers provision resources ad hoc through cloud consoles, and no one can forecast costs before changes are applied. The engineering lead wants to adopt Infrastructure as Code specifically to help address this concern. Beyond the raw cost tooling, which inherent characteristic of a declarative IaC workflow BEST helps the team review the exact set of resource changes before they are provisioned?

Accepted Answer

IaC produces a reviewable plan of the desired end state and the precise resource changes required to reach it before anything is applied

Answer

IaC automatically negotiates lower pricing with cloud providers when resources are declared in configuration files

Answer

IaC eliminates the need for any human approval because changes are applied continuously and instantly

Answer

IaC forces all resources to be deployed in a single region to minimize data transfer charges

Question 28

A new engineer on your platform team asks how Terraform decides what actions to take during an apply. Your team writes configuration files that describe the final set of resources they want (three servers, one load balancer, one database) without listing the individual API calls or ordering steps needed to build them. Which characteristic of Terraform's declarative model best explains how this works?

Accepted Answer

You define the desired end state of the infrastructure, and Terraform determines the operations and order required to reach it.

Answer

You write a sequential script of provisioning commands that Terraform executes line by line in the order given.

Answer

Terraform randomly retries creation commands until the infrastructure eventually converges to a working configuration.

Answer

You must manually specify each resource's dependencies and creation order because Terraform cannot infer them.

Question 29

A company's primary data center suffers a catastrophic failure, destroying all running infrastructure. The operations team needs to rebuild the entire environment in a secondary region as quickly as possible. Their infrastructure is fully defined in Terraform configuration files stored in a Git repository. Which advantage of Infrastructure as Code most directly enables the team to recreate this environment reliably?

Accepted Answer

Repeatability, because the same configuration can be applied to provision an identical environment on demand

Answer

Cost optimization, because Terraform automatically selects the cheapest available resources during a rebuild

Answer

Manual documentation, because engineers can read the configuration files as a runbook and click through the console

Answer

State locking, because it prevents two engineers from editing the same physical server at once

Question 30

A new engineer joins your team and inherits an environment provisioned by a 600-line Bash script that runs a sequence of cloud CLI commands to create servers, networks, and load balancers. The engineer struggles to understand the current state of the infrastructure because the script only describes the steps to build it, not the end result. Which characteristic of the imperative approach used in this script is the primary source of the engineer's difficulty?

Accepted Answer

The imperative script specifies the step-by-step commands to reach a result but does not explicitly define the intended final state of the infrastructure.

Answer

The imperative script guarantees idempotency, so re-running it always produces different results that are hard to predict.

Answer

The imperative script is provider-agnostic, making it impossible to tell which cloud the resources belong to.

Answer

The imperative script stores a declarative desired-state file that the engineer cannot access.

Question 31

A small operations team currently provisions cloud environments by hand, following a lengthy wiki runbook. Each new environment (dev, staging, prod) is supposed to be identical, but the team repeatedly finds subtle differences—an unopened firewall port here, a mismatched instance size there—that cause bugs to appear in production but not in staging. Management asks how adopting Infrastructure as Code would most directly address this specific problem. What is the best answer?

Accepted Answer

IaC defines environments in code that can be applied identically each time, eliminating the manual variation between environments.

Answer

IaC automatically detects security vulnerabilities in the operating system and patches them before provisioning.

Answer

IaC removes the need for staging and production environments by testing everything in a single shared environment.

Answer

IaC reduces cloud costs by automatically selecting the cheapest available instance types for each environment.

Question 32

Your organization runs production workloads on AWS but is acquiring a company whose systems all run on Microsoft Azure. Leadership wants the combined infrastructure teams to use one tool and one workflow to provision resources across both clouds, rather than maintaining separate cloud-native scripting for each. Which characteristic of Terraform most directly addresses this requirement?

Accepted Answer

Terraform uses a provider-agnostic configuration language and a plugin-based provider model, letting a single workflow manage resources across multiple cloud platforms

Answer

Terraform automatically converts AWS CloudFormation templates into Azure Resource Manager templates during apply

Answer

Terraform requires a separate binary for each cloud, but they share the same state file format

Answer

Terraform migrates existing running resources from one cloud provider to another when the provider block is changed

Question 33

A platform team currently manages AWS infrastructure with a mix of shell scripts and AWS CLI commands. Leadership announces the company will adopt Azure for a new product line and may later use Google Cloud. The team wants to avoid learning and maintaining a completely separate scripting toolchain for each cloud. Which characteristic of Terraform as an IaC tool most directly addresses this concern?

Accepted Answer

Terraform uses a single, consistent configuration language and workflow (write, plan, apply) across many providers, so the team applies the same skills and process to AWS, Azure, and GCP.

Answer

Terraform automatically translates existing AWS CLI shell scripts into equivalent Azure and GCP commands.

Answer

Terraform guarantees that any configuration written for AWS will deploy identical resources on Azure without modification.

Answer

Terraform removes the need for cloud-specific accounts and credentials by proxying all API calls through HashiCorp's own cloud service.

Question 34

A startup's operations team currently provisions each new customer environment by clicking through the cloud console, a process that takes an engineer roughly two days per environment. Onboarding demand has spiked, and leadership wants to provision dozens of identical environments per week without proportionally growing the team. Which advantage of adopting Infrastructure as Code most directly addresses this business need?

Accepted Answer

IaC lets the team codify an environment once and rapidly reproduce it many times, dramatically reducing the manual effort and time per environment.

Answer

IaC guarantees that cloud provider costs will decrease because resources are defined in text files.

Answer

IaC eliminates the need for any cloud provider account or credentials when creating resources.

Answer

IaC removes the requirement to test infrastructure because code is inherently correct.

Question 35

A new engineer joins a team that manages its entire cloud footprint with Terraform. On their first day, they need to understand exactly what resources exist, how they are configured, and how components relate to each other. There is no separate architecture wiki. Which advantage of Infrastructure as Code best helps the new engineer answer these questions?

Accepted Answer

The Terraform configuration files serve as self-documenting source of truth describing the intended infrastructure and its relationships

Answer

IaC guarantees that the cloud provider automatically generates an up-to-date architecture diagram on every deployment

Answer

Terraform continuously emails the team a written summary of all running resources each morning

Answer

IaC removes the need to understand the infrastructure because everything is fully abstracted away from engineers

Question 36

Your operations team currently provisions servers by having engineers manually click through a cloud provider's web console. Each engineer configures resources slightly differently, and when an outage occurs, no one can determine what changed or who changed it. Leadership asks you to adopt Infrastructure as Code to solve these problems. Which combination of IaC advantages MOST directly addresses these specific pain points?

Accepted Answer

Version control and consistency, because configurations are stored as code that can be reviewed, tracked in a change history, and applied identically every time

Answer

Faster network throughput and reduced latency, because code deploys resources closer to end users automatically

Answer

Lower cloud spend, because IaC negotiates better pricing tiers with the cloud provider on your behalf

Answer

Elimination of the need for any cloud provider credentials, because code executes without authenticating to the provider

Question 37

A platform team manages all their cloud infrastructure using Terraform configuration files stored in a Git repository. A recent change to a network security group configuration caused an unexpected outage in production. The team needs to quickly return the infrastructure to its previous working configuration and understand exactly what changed. Which advantage of Infrastructure as Code most directly enables them to do this?

Accepted Answer

Because the configuration is stored in version control, the team can review the commit history to identify the exact change and revert to the previous known-good configuration.

Answer

Because Terraform uses a declarative language, it will automatically detect the outage and roll back the change without any manual intervention.

Answer

Because Terraform is provider-agnostic, the team can migrate the workload to a different cloud provider to avoid the faulty configuration.

Answer

Because IaC is idempotent, re-running the same apply command will restore the infrastructure to its original healthy state automatically.

Question 38

You are writing Terraform configuration that provisions an AWS EC2 instance which must be attached to a specific subnet. The subnet is created in the same configuration as an aws_subnet resource. You want Terraform to always create the subnet before the instance without adding any extra meta-arguments. What is the recommended way to achieve this ordering?

Accepted Answer

Reference the subnet resource's id attribute (e.g., aws_subnet.main.id) in the instance's subnet_id argument so Terraform infers an implicit dependency.

Answer

Add depends_on = [aws_subnet.main] to the aws_instance resource block to force the ordering.

Answer

Place the aws_subnet block physically above the aws_instance block in the .tf file so it is created first.

Answer

Use a local-exec provisioner on the instance to wait until the subnet exists before continuing.

Question 39

Your team manages an existing AWS S3 bucket named 'legacy-data-archive' that was created manually in the console. You have written a resource block 'aws_s3_bucket.archive' in your configuration but have not yet brought the bucket under Terraform management. Using the CLI import workflow, which command correctly associates the existing bucket with your resource address?

Accepted Answer

terraform import aws_s3_bucket.archive legacy-data-archive

Answer

terraform import legacy-data-archive aws_s3_bucket.archive

Answer

terraform state import aws_s3_bucket.archive legacy-data-archive

Answer

terraform apply -import=aws_s3_bucket.archive legacy-data-archive

Question 40

You need to bring an existing AWS EC2 instance (instance ID i-0abc123def456) under Terraform management using the CLI-based `terraform import` command. You have already written a matching resource block named `aws_instance.web` in your configuration. Which command correctly imports the instance into your current state?

Accepted Answer

terraform import aws_instance.web i-0abc123def456

Answer

terraform import i-0abc123def456 aws_instance.web

Answer

terraform import aws_instance.web --id=i-0abc123def456

Answer

terraform state import aws_instance.web i-0abc123def456

Question 41

A DevOps engineer must bring a manually-created AWS S3 bucket under Terraform management using the legacy `terraform import` command (not import blocks). The engineer runs `terraform import aws_s3_bucket.logs my-existing-bucket` in a directory that currently has no resource block for that bucket. What happens, and what must be done first?

Accepted Answer

The import fails or leaves an orphaned state entry because no matching resource block exists; the engineer must first write an `aws_s3_bucket.logs` resource block in configuration, then run import.

Answer

The import succeeds and Terraform automatically generates the full resource configuration in the .tf files, so no manual work is needed.

Answer

The import fails and Terraform prompts interactively to create the resource block for you before continuing.

Answer

The import succeeds and Terraform manages the bucket entirely from state, so a resource block is never required.

Question 42

A colleague manually created an AWS security group in the console named 'legacy-web-sg' with ID 'sg-0a1b2c3d4e5f'. You have written a matching `aws_security_group` resource block labeled 'web' in your configuration. You want Terraform to begin managing this existing security group without destroying and recreating it. Which command accomplishes this?

Accepted Answer

terraform import aws_security_group.web sg-0a1b2c3d4e5f

Answer

terraform apply -replace=aws_security_group.web

Answer

terraform state push aws_security_group.web sg-0a1b2c3d4e5f

Answer

terraform refresh aws_security_group.web sg-0a1b2c3d4e5f

Question 43

You are defining an AWS IAM policy inline in Terraform. Rather than hardcode a JSON string, you want to build the policy from HCL data structures so it stays readable and can reference other resource attributes. Which built-in function should you use to convert an HCL object into the JSON string the policy argument expects?

Accepted Answer

jsonencode() to serialize the HCL object into a JSON-formatted string

Answer

jsondecode() to parse the HCL object into a JSON string

Answer

templatefile() to render the object through an external template

Answer

yamlencode() to serialize the object, since IAM accepts YAML policies

Question 44

Your team manages a production launch configuration whose attribute changes force Terraform to replace the resource. During recent applies, Terraform destroyed the old resource before creating the replacement, causing a brief service outage because a dependent autoscaling group had no valid launch configuration during the gap. Which lifecycle setting should you add to the resource block to eliminate this downtime?

Accepted Answer

lifecycle { create_before_destroy = true }

Answer

lifecycle { prevent_destroy = true }

Answer

lifecycle { ignore_changes = all }

Answer

lifecycle { replace_triggered_by = [aws_autoscaling_group.web] }

Question 45

An operations team manages an AWS instance with Terraform. A separate cost-tracking automation tool continuously adds and updates a 'CostCenter' tag on the instance out-of-band. Every time the team runs 'terraform apply', Terraform tries to remove that tag to match the configuration. The team wants Terraform to stop reverting the externally-managed tag while still managing all other attributes of the instance. Which configuration change accomplishes this?

Accepted Answer

Add a lifecycle block with 'ignore_changes = [tags["CostCenter"]]' to the aws_instance resource.

Answer

Add a lifecycle block with 'prevent_destroy = true' to the aws_instance resource.

Answer

Add 'depends_on = [aws_instance.this]' referencing the cost-tracking tool.

Answer

Run 'terraform apply -refresh=false' each time to skip reading the external tag.

Question 46

Your team manages a production RDS database with Terraform. During a routine refactor, a colleague accidentally removed the database's configuration, and a subsequent 'terraform apply' nearly destroyed the instance. You want Terraform to hard-fail any plan that would delete this specific database, forcing engineers to consciously edit the configuration before removal. Which lifecycle setting achieves this?

Accepted Answer

Add a lifecycle block with prevent_destroy = true to the RDS resource

Answer

Add a lifecycle block with ignore_changes = all to the RDS resource

Answer

Add a lifecycle block with create_before_destroy = true to the RDS resource

Answer

Add depends_on referencing the RDS resource so it cannot be removed

Question 47

A developer adds a `local-exec` provisioner to an `aws_instance` resource to write the instance's public IP into a local inventory file after creation. During which point of the core Terraform workflow does this provisioner command execute by default?

Accepted Answer

During `terraform apply`, after the instance resource is successfully created

Answer

During `terraform plan`, so the resulting file appears in the plan output before any apply

Answer

During `terraform init`, when the local provider is being configured

Answer

During `terraform validate`, as part of the configuration syntax check

Question 48

Your team's Terraform configuration references the same complex expression — a combined name prefix built from the project name, environment, and region — in more than a dozen resource blocks. You want to define this value once so it can be reused throughout the configuration and updated in a single place, but it should NOT be settable from outside the module. Which construct should you use?

Accepted Answer

A locals block that assigns the expression to a named local value, referenced as local.name_prefix

Answer

An input variable with a default set to the expression, referenced as var.name_prefix

Answer

An output block that exposes the expression to callers

Answer

A data source that recomputes the expression on each plan

Question 49

A team is collaborating on a Terraform project stored in Git. After one developer runs 'terraform init' locally, a '.terraform.lock.hcl' file is generated. The team lead wants to ensure every team member and the CI pipeline install exactly the same provider versions and verified checksums. What is the recommended practice regarding this file?

Accepted Answer

Commit the '.terraform.lock.hcl' file to version control so all collaborators and CI use the same recorded provider versions and hashes

Answer

Add '.terraform.lock.hcl' to '.gitignore' because it is regenerated on every 'terraform init' and should never be shared

Answer

Commit the entire '.terraform' directory to version control so the downloaded provider binaries are shared across the team

Answer

Manually copy the lock file into the 'terraform' block of each configuration so versions are enforced in code

Question 50

A developer is refactoring a Terraform configuration into a reusable child module for provisioning S3 buckets. Inside the root module, a variable named 'environment' is defined and used. When the developer references var.environment inside the child module's main.tf, Terraform reports an error that the variable is not declared. What is the correct way to make the parent's 'environment' value available to the child module?

Accepted Answer

Declare an input variable inside the child module and pass the value from the parent by setting that argument in the module block.

Answer

Terraform automatically inherits all variables from the root module, so the error indicates a syntax typo that must be fixed.

Answer

Add an output block for 'environment' in the root module so the child can read it during initialization.

Answer

Define a provider alias in the child module that references the parent's variable scope.

Question 51

Your team has a reusable local module at ./modules/app-server that provisions a single application server. A colleague needs to deploy three identical instances of this server from the root configuration without copying the module block three times. Which approach correctly creates three instances of the module?

Accepted Answer

Add a single module block with the count = 3 meta-argument, then reference instances as module.app_server[0], module.app_server[1], etc.

Answer

Set a replicas = 3 argument inside the module's variables.tf so Terraform loops internally.

Answer

Declare the module three times with identical source values but different names in a single file.

Answer

Use the terraform apply -parallelism=3 flag to instruct Terraform to create three copies of the module.

Question 52

You are authoring a reusable module named 'web-server' that provisions EC2 instances. The module needs the calling configuration to supply an instance size, but you do not want to hard-code any default so that consumers are forced to make an explicit choice. Inside the module, how should you declare this input so that Terraform requires the caller to pass a value?

Accepted Answer

Define a `variable "instance_size" {}` block in the module with no `default` argument, then reference it as `var.instance_size`.

Answer

Define an `output "instance_size" {}` block in the module and reference it as `var.instance_size`.

Answer

Define a `variable "instance_size" { default = "" }` block so callers can override the empty default.

Answer

Add `instance_size` to the `required_providers` block so Terraform prompts the caller during init.

Question 53

You are refactoring a large Terraform configuration and have extracted reusable networking logic into a subdirectory named 'modules/network' within your project repository. From the root configuration, you want to call this module without publishing it to any registry or Git host. Which source value should the module block use?

Accepted Answer

source = "./modules/network"

Answer

source = "registry.terraform.io/modules/network"

Answer

source = "git::https://github.com/modules/network.git"

Answer

source = "modules/network"

Question 54

A developer is calling a reusable VPC module and wants to create three copies of it. They add `count = 3` to the module block, but they also expect the child module to automatically receive a variable named `count` that it can reference internally. When they run `terraform plan`, the child module cannot find any variable called `count`. What is the correct explanation of this behavior?

Accepted Answer

`count` is a meta-argument handled by Terraform itself and is not passed into the child module as an input variable; the module can use `count.index` only in its own resources if it declares its own count logic.

Answer

Meta-arguments like `count` are automatically exposed to child modules as input variables of the same name, so the child module must simply declare a matching variable block.

Answer

The child module must add `count` to its `outputs.tf` file to make the value visible during planning.

Answer

Terraform only supports `for_each` on module blocks, so the `count` meta-argument is silently ignored and never affects the child module.

Question 55

You maintain a reusable module named 'network' that provisions a VPC and subnets. In your root configuration, you write `subnet_id = module.network.private_subnet_id`, but `terraform plan` fails with an error saying the module has no output named 'private_subnet_id'. The subnet resource clearly exists inside the module's files. What is the correct fix?

Accepted Answer

Add an `output "private_subnet_id"` block inside the network module that references the subnet resource's attribute

Answer

Add a `variable "private_subnet_id"` block to the root module so the value can be passed in

Answer

Reference the resource directly with `module.network.aws_subnet.private.id` instead of using an output

Answer

Run `terraform init` again so the module's internal resource attributes become accessible to the root module

Question 56

A platform team maintains two modules: a 'network' module that provisions a VPC and subnets, and an 'app' module that deploys instances into an existing subnet. In the root configuration, both modules are called. The 'app' module has an input variable named 'subnet_id'. The 'network' module already declares an output named 'private_subnet_id'. How should the root module wire the network's subnet into the app module?

Accepted Answer

Set subnet_id = module.network.private_subnet_id in the app module block

Answer

Set subnet_id = network.private_subnet_id in the app module block

Answer

Reference var.private_subnet_id inside the app module's resource directly

Answer

Add an output 'subnet_id' to the app module so it can read the network output

Question 57

You have written a reusable module named "network" that creates a VPC. The module defines an output named "vpc_id". In the root configuration, you want to pass this VPC ID into a resource that creates a security group. Which expression correctly references the module's output?

Accepted Answer

module.network.vpc_id

Answer

module.network.output.vpc_id

Answer

output.network.vpc_id

Answer

var.network.vpc_id

Question 58

You are authoring a reusable module named 'network' that provisions a VPC and subnets. The parent (root) configuration needs to reference the VPC ID created inside the module so it can pass that value to a separate 'compute' module. Inside the 'network' module, the VPC is defined as 'resource "aws_vpc" "main"'. What must you do so the root configuration can access the VPC ID?

Accepted Answer

Declare an output block in the 'network' module (e.g., output "vpc_id" { value = aws_vpc.main.id }), then reference it as module.network.vpc_id in the root configuration.

Answer

Reference aws_vpc.main.id directly from the root configuration, since all resource attributes are globally accessible once created.

Answer

Add a variable block for vpc_id in the 'network' module so the value is exported to the parent configuration.

Answer

Use a data source in the root configuration to read the VPC, because module resource attributes cannot be passed between modules.

Question 59

A team maintains a reusable VPC module in ./modules/network. The module declares a variable named subnet_cidrs of type list(string) with no default. In the root module, an engineer writes a module block referencing this module but the plan fails with an error stating the required variable was not provided. Which change to the root module block correctly supplies the value?

Accepted Answer

Add an argument inside the module block: subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24"]

Answer

Add a variable "subnet_cidrs" {} block inside the module block to declare the input

Answer

Reference the value using module.network.subnet_cidrs in the module block

Answer

Add an output "subnet_cidrs" block to the child module so the value propagates automatically

Question 60

You maintain a reusable networking module that must deploy resources into a secondary AWS region. In the root module you have configured a default AWS provider and an aliased provider named `aws.secondary`. You want the child module to use the aliased provider for all of its resources. What is the correct way to pass this provider configuration to the module?

Accepted Answer

Add a `providers` argument to the module block mapping the child's `aws` to `aws.secondary`, and declare the requirement with a `configuration_aliases` entry in the child module's `required_providers`.

Answer

Define the aliased provider block a second time inside the child module so it inherits automatically at apply time.

Answer

Set an input variable in the child module equal to `aws.secondary` and reference that variable in each resource's `provider` argument.

Answer

Do nothing; a child module always inherits all aliased provider configurations from the root module automatically.

Question 61

Your team wants to consume the AWS VPC module published on the public Terraform Registry (terraform-aws-modules/vpc/aws) and pin it to version 5.1.2. Which module block correctly references the Registry module and constrains its version?

Accepted Answer

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.1.2"
}

Answer

module "vpc" {
  source  = "registry.terraform.io/terraform-aws-modules/vpc"
  version = ">= 5.1.2"
  ref     = "5.1.2"
}

Answer

module "vpc" {
  source = "terraform-aws-modules/vpc/aws?version=5.1.2"
}

Answer

module "vpc" {
  source  = "git::https://github.com/terraform-aws-modules/vpc/aws"
  version = "5.1.2"
}

Question 62

Your team stores a reusable networking module in a self-hosted GitLab instance that is not published to any Terraform Registry. You want a root configuration to consume this module directly over HTTPS from the Git repository. Which source value correctly references a generic Git repository over HTTPS?

Accepted Answer

source = "git::https://gitlab.example.com/infra/network.git"

Answer

source = "gitlab.example.com/infra/network/aws"

Answer

source = "registry::https://gitlab.example.com/infra/network"

Answer

source = "https://gitlab.example.com/infra/network.git"

Question 63

Your team stores a reusable networking module in a private Git repository at github.com/acme/tf-modules in the subdirectory 'vpc'. You need to reference version tag 'v1.4.0' of that module from a root configuration. Which module block source value correctly pins to that tagged version and subdirectory?

Accepted Answer

source = "git::https://github.com/acme/tf-modules.git//vpc?ref=v1.4.0"

Answer

source = "github.com/acme/tf-modules/vpc"
  version = "v1.4.0"

Answer

source = "https://github.com/acme/tf-modules/vpc@v1.4.0"

Answer

source = "git::github.com/acme/tf-modules/vpc:v1.4.0"

Question 64

A platform team publishes reusable Terraform modules as versioned .zip archives on an internal artifact server reachable at https://artifacts.example.com. A downstream team wants to consume a specific packaged version of the networking module without using Git or the public/private registry. Which module source configuration correctly references the archive?

Accepted Answer

source = "https://artifacts.example.com/modules/networking-1.4.0.zip"

Answer

source = "artifacts.example.com/networking/aws"
  version = "1.4.0"

Answer

source = "git::https://artifacts.example.com/modules/networking-1.4.0.zip"

Answer

source = "https://artifacts.example.com/modules/networking-1.4.0.zip"
  version = "1.4.0"

Exam domain	Exam weight	Practice
Infrastructure as Code (IaC) with Terraform	12%	Practice this topic
Terraform Fundamentals	12%	Practice this topic
Core Terraform Workflow	13%	Practice this topic
Terraform Configuration	13%	Practice this topic
Terraform Modules	13%	Practice this topic
Terraform State Management	13%	Practice this topic
Maintain Infrastructure with Terraform	12%	Practice this topic
HCP Terraform	12%	Practice this topic

HashiCorp Certified: Terraform Associate (004) (Terraform Associate) practice exam & study guide

Start studying Terraform Associate

All Terraform Associate study resources

Terraform Associate exam domains

Sample Terraform Associate questions

Key Terraform Associate terms

Terraform Associate frequently asked questions

Infrastructure as Code (IaC) with Terraform (12%)

Terraform Fundamentals (12%)

Core Terraform Workflow (13%)

Terraform Configuration (13%)

Terraform Modules (13%)

Terraform State Management (13%)

Maintain Infrastructure with Terraform (12%)

HCP Terraform (12%)