HashiCorp Certified: Terraform Associate (004)

Question 1

A team wants an output that displays a custom DNS name when the variable custom_dns is set to a non-empty string, but otherwise falls back to the auto-generated endpoint from an AWS resource attribute. They want to avoid nested conditional expressions. Which built-in function best returns the first non-empty value from a list of arguments?

Accepted Answer

coalesce(var.custom_dns, aws_db_instance.main.endpoint)

Answer

concat(var.custom_dns, aws_db_instance.main.endpoint)

Answer

merge(var.custom_dns, aws_db_instance.main.endpoint)

Answer

lookup(var.custom_dns, aws_db_instance.main.endpoint)

Question 2

A team wants an aws_cloudwatch_metric_alarm to be created only when a boolean variable named enable_monitoring is set to true. When enable_monitoring is false, no alarm resource should exist. Which configuration correctly implements this toggle using the count meta-argument?

Accepted Answer

count = var.enable_monitoring ? 1 : 0

Answer

count = var.enable_monitoring

Answer

for_each = var.enable_monitoring

Answer

count = length(var.enable_monitoring)

Question 3

A developer runs 'terraform destroy' to tear down a temporary test environment. Later that day, they need the exact same environment back. The configuration files (.tf) and provider lock file are all still present in the working directory, and 'terraform init' has already been run. Which single command will recreate the entire environment as defined in the configuration?

Accepted Answer

terraform apply

Answer

terraform refresh

Answer

terraform import

Answer

terraform state push

Question 4

A developer has finished editing a Terraform configuration and wants to provision the infrastructure. They have not saved a plan file. Which single command will show the proposed changes and, after interactive approval, create the resources?

Accepted Answer

terraform apply

Answer

terraform plan

Answer

terraform refresh

Answer

terraform init

Question 5

A new engineer clones your Terraform repository containing several .tf files that reference the AWS provider. They immediately run 'terraform plan' and receive an error stating the provider is not installed and that they must run another command first. Which command must they run before 'terraform plan' will succeed, and why?

Accepted Answer

Run 'terraform init' to download the required provider plugins and prepare the working directory.

Answer

Run 'terraform apply' first, because apply installs providers automatically and plan does not.

Answer

Run 'terraform validate' to install the providers referenced in the configuration files.

Answer

Run 'terraform refresh' to sync state and pull down the provider binaries from the registry.

Question 6

A junior engineer has finished writing a new Terraform configuration that adds several resources and modifies an existing security group. Before making any changes to the live environment, they want to review exactly what Terraform intends to create, update, or delete so the team can approve the changes during a code review. Which command should they run to produce this preview without altering any real infrastructure?

Accepted Answer

terraform plan

Answer

terraform apply -auto-approve

Answer

terraform validate

Answer

terraform refresh

Question 7

A developer manages three AWS S3 buckets in a single Terraform configuration. To decommission just one bucket, they delete its resource block from the .tf file and run `terraform apply`. The other two buckets must remain untouched. What will Terraform do?

Accepted Answer

Destroy only the bucket whose resource block was removed, leaving the other two buckets unchanged

Answer

Destroy all three buckets because the configuration was modified

Answer

Ignore the removal and keep all three buckets until `terraform destroy` is run

Answer

Return an error requiring the developer to use `terraform state rm` first

Question 8

You are writing HCL to create three EC2 instances from a variable named `instance_names`, which is a list of strings. You want each instance's `Name` tag to match the corresponding string in the list. Which configuration correctly assigns the right name to each instance?

Accepted Answer

Use `count = length(var.instance_names)` on the resource and set the tag with `Name = var.instance_names[count.index]`

Answer

Use `count = length(var.instance_names)` and set the tag with `Name = var.instance_names` so Terraform maps the list automatically

Answer

Use `count = var.instance_names` and set the tag with `Name = each.value`

Answer

Use `for_each = length(var.instance_names)` and set the tag with `Name = count.value`

Question 9

Your team must always deploy EC2 instances using the most recent official Ubuntu AMI, which changes frequently. You do not manage the AMI itself with Terraform, but you need its ID available in your configuration so the aws_instance resource can reference it. Which HCL construct should you use to obtain the AMI ID?

Accepted Answer

A data source (data "aws_ami") that filters for the latest matching image, referenced by the instance's ami argument

Answer

A resource block (resource "aws_ami") to create the AMI and pass its id to the instance

Answer

An input variable with a default set to the current AMI ID, updated manually before each apply

Answer

A local value that hardcodes the AMI ID string for reuse across resources

Question 10

A DevOps engineer writes Terraform configuration to provision three EC2 instances. After running 'terraform apply' successfully, a teammate runs 'terraform apply' again without changing any code or infrastructure. What behavior should the engineer expect, and which IaC principle explains it?

Accepted Answer

Terraform will report that no changes are needed and make no modifications, demonstrating idempotency in a declarative approach.

Answer

Terraform will create three additional EC2 instances because each apply provisions new resources; this reflects the imperative model.

Answer

Terraform will destroy and recreate the three instances to guarantee a fresh state, reflecting immutable infrastructure.

Answer

Terraform will return an error because applying the same configuration twice is not permitted without '-force'.

Question 11

A new team member argues that Terraform configurations should list the exact sequence of API calls needed to build infrastructure, similar to a shell script. A senior engineer explains that Terraform does not work this way. Which statement best describes how Terraform's approach differs from the shell-script method the new member described?

Accepted Answer

Terraform uses a declarative model where you define the desired end state, and Terraform determines the operations needed to reach it.

Answer

Terraform uses an imperative model where each resource block is executed as an ordered command exactly as written.

Answer

Terraform requires you to manually specify every create, update, and delete operation in the correct order.

Answer

Terraform executes configuration files top-to-bottom, so resource order in the file always dictates provisioning order.

Question 12

An engineer manages an AWS EC2 instance that runs a startup script needing an IAM policy to be fully attached before the instance boots. The instance configuration does not reference any attribute of the IAM policy resource, so Terraform sometimes creates them in parallel, causing the script to fail. Which change should the engineer make to guarantee correct ordering?

Accepted Answer

Add an explicit depends_on argument to the EC2 instance resource listing the IAM policy resource

Answer

Add a provisioner block to the IAM policy resource so it blocks until attachment completes

Answer

Run terraform apply twice so the IAM policy exists before the second apply creates the instance

Answer

Wrap both resources in a single module so Terraform processes them sequentially

Question 13

You are writing a security group resource that must produce a variable number of nested `ingress` blocks based on a list of port objects passed as `var.ingress_rules` (each with `port` and `cidr` attributes). You want to avoid hardcoding repeated `ingress { ... }` blocks. Which construct correctly generates the nested blocks?

Accepted Answer

A `dynamic "ingress"` block with a `for_each = var.ingress_rules` and a `content` block referencing `ingress.value.port` and `ingress.value.cidr`

Answer

A `count = length(var.ingress_rules)` meta-argument on the security group resource, indexing rules with `count.index`

Answer

A single `ingress` block using `for_each = var.ingress_rules` directly inside the block body

Answer

A `dynamic "ingress"` block with `for_each = var.ingress_rules` and a `content` block referencing `each.value.port` and `each.value.cidr`

Question 14

You are writing a module that creates 6 EC2 instances using count, and you want to distribute them across a list of 3 availability-zone subnet IDs stored in var.subnet_ids. You need each instance's subnet_id to cycle through the 3 subnets (instance 0 → subnet 0, instance 3 → subnet 0 again, etc.) without going out of bounds. Which expression should you assign to subnet_id?

Accepted Answer

subnet_id = element(var.subnet_ids, count.index)

Answer

subnet_id = var.subnet_ids[count.index]

Answer

subnet_id = lookup(var.subnet_ids, count.index)

Answer

subnet_id = slice(var.subnet_ids, count.index, 1)

Question 15

A teammate wrote the following resource block and Terraform returns an error during plan:

```hcl
variable "buckets" {
  type    = list(string)
  default = ["logs", "backups", "assets"]
}

resource "aws_s3_bucket" "this" {
  for_each = var.buckets
  bucket   = each.value
}
```

The error states the `for_each` argument must be a map or a set of strings, not a list. Which change fixes the configuration while keeping the same input variable?

Accepted Answer

Wrap the variable in the toset() function: for_each = toset(var.buckets)

Answer

Replace for_each with count = length(var.buckets) and use each.value for the bucket name

Answer

Change the reference to for_each = var.buckets[*] to expand the list

Answer

Add lifecycle { ignore_changes = [for_each] } to suppress the type error

Question 16

A platform engineer wants to guarantee that an AWS S3 bucket created by Terraform always has versioning explicitly enabled before the apply is considered valid. They want the apply to fail with a clear error if the resulting resource does not meet this requirement, evaluated against the resource's own attributes after planning. Which Terraform feature should they use?

Accepted Answer

A `lifecycle` block with a `precondition` referencing the resource's versioning attribute

Answer

A `validation` block inside the `variable` definition for the bucket name

Answer

A `lifecycle` block with `ignore_changes` set to the versioning attribute

Answer

A `depends_on` argument pointing to the versioning configuration resource

Question 17

A team manages several S3 buckets using a single resource block. They currently use `count` with a list of bucket names in a variable. When they remove a name from the middle of the list and run `terraform plan`, Terraform proposes destroying and recreating multiple buckets that were not intended to change. Which change to the configuration best prevents this behavior while still iterating over the collection?

Accepted Answer

Refactor the resource to use `for_each` over a map or set of bucket names so each instance is keyed by a stable string rather than a numeric index.

Answer

Add a `depends_on` block referencing the S3 bucket resource so Terraform preserves ordering during the apply.

Answer

Add a `lifecycle` block with `create_before_destroy = true` to avoid the recreation of the remaining buckets.

Answer

Sort the list variable alphabetically so the indexes remain consistent between plans.

Question 18

You are given a variable named subnet_names of type list(string) containing three unique subnet names. You want to create one aws_subnet resource per name using for_each so that resources are keyed by name rather than by numeric index. Which configuration correctly uses for_each with this list variable?

Accepted Answer

for_each = toset(var.subnet_names), then reference each.value for the name

Answer

for_each = var.subnet_names, then reference each.value for the name

Answer

count = length(var.subnet_names), then reference var.subnet_names[count.index]

Answer

for_each = tolist(var.subnet_names), then reference each.key for the name

Question 19

Your team currently stores Terraform state in a file on a shared network drive that everyone edits from their laptops. You have experienced overwritten state files, lost updates, and exposed credentials stored in plaintext state. Leadership asks you to migrate to HCP Terraform as the remote backend. Which combination of benefits BEST justifies this migration compared to the current setup?

Accepted Answer

Automatic state locking during operations plus encryption of state at rest and in transit

Answer

Elimination of the need for a state file entirely, since HCP Terraform queries live infrastructure directly

Answer

Removal of all sensitive values from state so credentials are never written anywhere

Answer

Faster local plans because state is cached on each engineer's laptop after the first run

Question 20

A development team currently spins up identical staging environments by hand each time a new feature branch needs testing. This process takes several hours, and engineers often forget individual configuration steps, leading to environments that behave differently from one another. The team lead wants to adopt Infrastructure as Code specifically to solve the problem of recreating the same environment quickly and reliably on demand. Which IaC advantage most directly addresses this goal?

Accepted Answer

Repeatability and automation, allowing the same configuration to provision identical environments on demand

Answer

The ability to write configuration in an imperative language that specifies each provisioning step

Answer

Provider-agnostic syntax that lets the team target multiple cloud vendors

Answer

Automatic cost optimization that selects the cheapest resources during provisioning

Question 21

A platform engineering team currently provisions infrastructure by having individual engineers run shell scripts from their laptops. Changes are frequently applied without any peer review, and the team struggles to understand who changed what and why. Leadership wants to adopt Infrastructure as Code specifically to improve how proposed infrastructure changes are reviewed and discussed before they take effect. Which advantage of IaC most directly addresses this goal?

Accepted Answer

Because infrastructure is defined in text files, proposed changes can go through a pull request workflow where teammates review and approve them before they are applied.

Answer

IaC guarantees that no two engineers can ever run terraform apply against the same environment at the same time.

Answer

IaC automatically provisions resources faster than manual scripts, eliminating the need for any review.

Answer

IaC removes the need for cloud provider credentials, so security reviews are no longer required.

Question 22

A platform team manually patches a production web server's firewall rules during an incident, bypassing the Terraform configuration that originally provisioned it. Weeks later, a developer runs `terraform plan` against that infrastructure. Which advantage of Infrastructure as Code most directly helps the team identify this out-of-band change?

Accepted Answer

IaC exposes configuration drift by comparing the real infrastructure state against the declared desired state

Answer

IaC automatically prevents any manual changes from being made to managed resources

Answer

IaC increases provisioning speed so servers can be rebuilt faster than they are patched

Answer

IaC allows the same configuration to be deployed across multiple cloud providers

Question 23

A development team repeatedly encounters bugs that appear only in production but cannot be reproduced in their staging environment. Investigation reveals that staging was built by one engineer clicking through the cloud console, while production was set up months earlier by a different engineer using slightly different settings. Which core advantage of Infrastructure as Code most directly addresses this problem?

Accepted Answer

IaC lets the same configuration files provision staging and production identically, ensuring environment consistency across deployments

Answer

IaC automatically detects and corrects security vulnerabilities in cloud resources

Answer

IaC eliminates the need for a staging environment by testing directly in production

Answer

IaC reduces cloud spending by automatically selecting the cheapest available resources

Question 24

A finance team complains that cloud spending is unpredictable because operations engineers provision resources ad hoc through cloud consoles, and no one can forecast costs before changes are applied. The engineering lead wants to adopt Infrastructure as Code specifically to help address this concern. Beyond the raw cost tooling, which inherent characteristic of a declarative IaC workflow BEST helps the team review the exact set of resource changes before they are provisioned?

Accepted Answer

IaC produces a reviewable plan of the desired end state and the precise resource changes required to reach it before anything is applied

Answer

IaC automatically negotiates lower pricing with cloud providers when resources are declared in configuration files

Answer

IaC eliminates the need for any human approval because changes are applied continuously and instantly

Answer

IaC forces all resources to be deployed in a single region to minimize data transfer charges

Question 25

You are writing Terraform configuration that provisions an AWS EC2 instance which must be attached to a specific subnet. The subnet is created in the same configuration as an aws_subnet resource. You want Terraform to always create the subnet before the instance without adding any extra meta-arguments. What is the recommended way to achieve this ordering?

Accepted Answer

Reference the subnet resource's id attribute (e.g., aws_subnet.main.id) in the instance's subnet_id argument so Terraform infers an implicit dependency.

Answer

Add depends_on = [aws_subnet.main] to the aws_instance resource block to force the ordering.

Answer

Place the aws_subnet block physically above the aws_instance block in the .tf file so it is created first.

Answer

Use a local-exec provisioner on the instance to wait until the subnet exists before continuing.

Question 26

Your team manages an existing AWS S3 bucket named 'legacy-data-archive' that was created manually in the console. You have written a resource block 'aws_s3_bucket.archive' in your configuration but have not yet brought the bucket under Terraform management. Using the CLI import workflow, which command correctly associates the existing bucket with your resource address?

Accepted Answer

terraform import aws_s3_bucket.archive legacy-data-archive

Answer

terraform import legacy-data-archive aws_s3_bucket.archive

Answer

terraform state import aws_s3_bucket.archive legacy-data-archive

Answer

terraform apply -import=aws_s3_bucket.archive legacy-data-archive

Question 27

You need to bring an existing AWS EC2 instance (instance ID i-0abc123def456) under Terraform management using the CLI-based `terraform import` command. You have already written a matching resource block named `aws_instance.web` in your configuration. Which command correctly imports the instance into your current state?

Accepted Answer

terraform import aws_instance.web i-0abc123def456

Answer

terraform import i-0abc123def456 aws_instance.web

Answer

terraform import aws_instance.web --id=i-0abc123def456

Answer

terraform state import aws_instance.web i-0abc123def456

Question 28

A DevOps engineer must bring a manually-created AWS S3 bucket under Terraform management using the legacy `terraform import` command (not import blocks). The engineer runs `terraform import aws_s3_bucket.logs my-existing-bucket` in a directory that currently has no resource block for that bucket. What happens, and what must be done first?

Accepted Answer

The import fails or leaves an orphaned state entry because no matching resource block exists; the engineer must first write an `aws_s3_bucket.logs` resource block in configuration, then run import.

Answer

The import succeeds and Terraform automatically generates the full resource configuration in the .tf files, so no manual work is needed.

Answer

The import fails and Terraform prompts interactively to create the resource block for you before continuing.

Answer

The import succeeds and Terraform manages the bucket entirely from state, so a resource block is never required.

Question 29

A colleague manually created an AWS security group in the console named 'legacy-web-sg' with ID 'sg-0a1b2c3d4e5f'. You have written a matching `aws_security_group` resource block labeled 'web' in your configuration. You want Terraform to begin managing this existing security group without destroying and recreating it. Which command accomplishes this?

Accepted Answer

terraform import aws_security_group.web sg-0a1b2c3d4e5f

Answer

terraform apply -replace=aws_security_group.web

Answer

terraform state push aws_security_group.web sg-0a1b2c3d4e5f

Answer

terraform refresh aws_security_group.web sg-0a1b2c3d4e5f

Question 30

A developer adds a `local-exec` provisioner to an `aws_instance` resource to write the instance's public IP into a local inventory file after creation. During which point of the core Terraform workflow does this provisioner command execute by default?

Accepted Answer

During `terraform apply`, after the instance resource is successfully created

Answer

During `terraform plan`, so the resulting file appears in the plan output before any apply

Answer

During `terraform init`, when the local provider is being configured

Answer

During `terraform validate`, as part of the configuration syntax check

Question 31

Your team's Terraform configuration references the same complex expression — a combined name prefix built from the project name, environment, and region — in more than a dozen resource blocks. You want to define this value once so it can be reused throughout the configuration and updated in a single place, but it should NOT be settable from outside the module. Which construct should you use?

Accepted Answer

A locals block that assigns the expression to a named local value, referenced as local.name_prefix

Answer

An input variable with a default set to the expression, referenced as var.name_prefix

Answer

An output block that exposes the expression to callers

Answer

A data source that recomputes the expression on each plan

Question 32

A team is collaborating on a Terraform project stored in Git. After one developer runs 'terraform init' locally, a '.terraform.lock.hcl' file is generated. The team lead wants to ensure every team member and the CI pipeline install exactly the same provider versions and verified checksums. What is the recommended practice regarding this file?

Accepted Answer

Commit the '.terraform.lock.hcl' file to version control so all collaborators and CI use the same recorded provider versions and hashes

Answer

Add '.terraform.lock.hcl' to '.gitignore' because it is regenerated on every 'terraform init' and should never be shared

Answer

Commit the entire '.terraform' directory to version control so the downloaded provider binaries are shared across the team

Answer

Manually copy the lock file into the 'terraform' block of each configuration so versions are enforced in code

Question 33

A developer is refactoring a Terraform configuration into a reusable child module for provisioning S3 buckets. Inside the root module, a variable named 'environment' is defined and used. When the developer references var.environment inside the child module's main.tf, Terraform reports an error that the variable is not declared. What is the correct way to make the parent's 'environment' value available to the child module?

Accepted Answer

Declare an input variable inside the child module and pass the value from the parent by setting that argument in the module block.

Answer

Terraform automatically inherits all variables from the root module, so the error indicates a syntax typo that must be fixed.

Answer

Add an output block for 'environment' in the root module so the child can read it during initialization.

Answer

Define a provider alias in the child module that references the parent's variable scope.

Question 34

Your team has a reusable local module at ./modules/app-server that provisions a single application server. A colleague needs to deploy three identical instances of this server from the root configuration without copying the module block three times. Which approach correctly creates three instances of the module?

Accepted Answer

Add a single module block with the count = 3 meta-argument, then reference instances as module.app_server[0], module.app_server[1], etc.

Answer

Set a replicas = 3 argument inside the module's variables.tf so Terraform loops internally.

Answer

Declare the module three times with identical source values but different names in a single file.

Answer

Use the terraform apply -parallelism=3 flag to instruct Terraform to create three copies of the module.

Question 35

You are authoring a reusable module named 'web-server' that provisions EC2 instances. The module needs the calling configuration to supply an instance size, but you do not want to hard-code any default so that consumers are forced to make an explicit choice. Inside the module, how should you declare this input so that Terraform requires the caller to pass a value?

Accepted Answer

Define a `variable "instance_size" {}` block in the module with no `default` argument, then reference it as `var.instance_size`.

Answer

Define an `output "instance_size" {}` block in the module and reference it as `var.instance_size`.

Answer

Define a `variable "instance_size" { default = "" }` block so callers can override the empty default.

Answer

Add `instance_size` to the `required_providers` block so Terraform prompts the caller during init.

Question 36

You are refactoring a large Terraform configuration and have extracted reusable networking logic into a subdirectory named 'modules/network' within your project repository. From the root configuration, you want to call this module without publishing it to any registry or Git host. Which source value should the module block use?

Accepted Answer

source = "./modules/network"

Answer

source = "registry.terraform.io/modules/network"

Answer

source = "git::https://github.com/modules/network.git"

Answer

source = "modules/network"

Question 37

A developer is calling a reusable VPC module and wants to create three copies of it. They add `count = 3` to the module block, but they also expect the child module to automatically receive a variable named `count` that it can reference internally. When they run `terraform plan`, the child module cannot find any variable called `count`. What is the correct explanation of this behavior?

Accepted Answer

`count` is a meta-argument handled by Terraform itself and is not passed into the child module as an input variable; the module can use `count.index` only in its own resources if it declares its own count logic.

Answer

Meta-arguments like `count` are automatically exposed to child modules as input variables of the same name, so the child module must simply declare a matching variable block.

Answer

The child module must add `count` to its `outputs.tf` file to make the value visible during planning.

Answer

Terraform only supports `for_each` on module blocks, so the `count` meta-argument is silently ignored and never affects the child module.

Question 38

You maintain a reusable module named 'network' that provisions a VPC and subnets. In your root configuration, you write `subnet_id = module.network.private_subnet_id`, but `terraform plan` fails with an error saying the module has no output named 'private_subnet_id'. The subnet resource clearly exists inside the module's files. What is the correct fix?

Accepted Answer

Add an `output "private_subnet_id"` block inside the network module that references the subnet resource's attribute

Answer

Add a `variable "private_subnet_id"` block to the root module so the value can be passed in

Answer

Reference the resource directly with `module.network.aws_subnet.private.id` instead of using an output

Answer

Run `terraform init` again so the module's internal resource attributes become accessible to the root module

Question 39

A platform team maintains two modules: a 'network' module that provisions a VPC and subnets, and an 'app' module that deploys instances into an existing subnet. In the root configuration, both modules are called. The 'app' module has an input variable named 'subnet_id'. The 'network' module already declares an output named 'private_subnet_id'. How should the root module wire the network's subnet into the app module?

Accepted Answer

Set subnet_id = module.network.private_subnet_id in the app module block

Answer

Set subnet_id = network.private_subnet_id in the app module block

Answer

Reference var.private_subnet_id inside the app module's resource directly

Answer

Add an output 'subnet_id' to the app module so it can read the network output

Question 40

Your team needs to deploy resources into two different AWS regions (us-east-1 and eu-west-1) from within the same Terraform configuration. You have declared the default AWS provider for us-east-1 and a second provider block with 'alias = "europe"' set to eu-west-1. How do you instruct a specific resource to be created in the eu-west-1 region?

Accepted Answer

Add a 'provider = aws.europe' argument inside that resource block

Answer

Set 'region = "eu-west-1"' directly as an argument in the resource block

Answer

Add an 'alias = "europe"' argument inside the resource block

Answer

Run 'terraform apply -provider=aws.europe' to target the aliased provider

Question 41

A platform team already uses Terraform to provision AWS infrastructure. They now want to manage GitHub repository settings, Datadog monitors, and Cloudflare DNS records using the same tool and workflow, without writing custom API scripts. Which characteristic of Terraform's provider ecosystem makes this possible?

Accepted Answer

Providers exist not only for cloud IaaS platforms but also for SaaS and API-driven services, so Terraform can manage any system that exposes a supported provider

Answer

Terraform can only manage resources belonging to the three major cloud providers (AWS, Azure, GCP) natively

Answer

Terraform automatically generates a provider at runtime for any REST API it detects in the configuration

Answer

Non-cloud services must be managed with provisioners because Terraform providers are limited to compute infrastructure

Question 42

Your team writes Terraform configuration that provisions resources in a SaaS monitoring platform. The platform exposes a REST API, but your engineers only write HCL resource blocks and never call the API directly. Which component is responsible for translating your declarative resource definitions into the specific API calls that create and manage those resources?

Accepted Answer

The Terraform provider for that platform

Answer

The Terraform state file

Answer

The Terraform CLI core binary alone

Answer

The Terraform module registry

Question 43

Your team wants to allow automatic upgrades to new patch releases of the AWS provider (for bug fixes) but must prevent any minor or major version changes that could introduce breaking behavior. The current version in use is 5.31.0. Which version constraint in the required_providers block satisfies this requirement?

Accepted Answer

version = "~> 5.31.0"

Answer

version = "~> 5.31"

Answer

version = ">= 5.31.0"

Answer

version = "= 5.31.0"

Question 44

Your team maintains Terraform configurations that provision resources across AWS. During a recent CI run, a teammate's apply produced a slightly different plan than yours, even though the configuration and state were identical. You discover that each machine downloaded a different version of the AWS provider from the Terraform Registry. Which practice would most directly prevent this inconsistency?

Accepted Answer

Pin the provider to a specific version using a version constraint in the required_providers block, and commit the resulting lock file to version control.

Answer

Store the Terraform state in a remote backend so both machines share the same state file.

Answer

Add explicit depends_on arguments to each resource so the providers evaluate resources in the same order.

Answer

Run terraform refresh before each apply so every machine synchronizes the latest attributes from AWS.

Question 45

Your networking team manages VPC infrastructure in a separate Terraform configuration with its own state file stored in an S3 backend. The application team needs to reference the VPC ID and subnet IDs (exposed as outputs in the networking configuration) from their own separate configuration, without duplicating or hardcoding those values. What is the recommended approach?

Accepted Answer

Use a terraform_remote_state data source pointing at the networking team's S3 backend to read its exposed output values

Answer

Run 'terraform state pull' on the networking configuration and manually copy the values into the application configuration's variables

Answer

Merge both configurations into a single state file so all outputs are directly accessible

Answer

Use 'terraform state mv' to move the VPC resources into the application team's state file

Question 46

Your team stores Terraform state in an S3 bucket configured as a remote backend. Two engineers run 'terraform apply' against the same configuration at nearly the same time. You want to guarantee that only one apply can modify the state at a time to prevent state corruption. Which addition to the S3 backend configuration accomplishes this?

Accepted Answer

Add a DynamoDB table reference via the dynamodb_table argument to enable state locking

Answer

Enable S3 bucket versioning so each write creates a new object version

Answer

Enable server-side encryption on the bucket with a KMS key

Answer

Set the 'workspace_key_prefix' argument to isolate each engineer's state

Question 47

Your team stores Terraform state in an S3 backend. A security review flags that the state file contains database passwords and TLS private keys in plaintext. Aside from restricting IAM access, which additional measure best protects this sensitive data at rest in the S3 backend?

Accepted Answer

Enable server-side encryption on the S3 bucket (and set encrypt = true in the backend configuration)

Answer

Add the sensitive = true argument to the affected resource blocks so the values are removed from state

Answer

Run terraform state rm on the sensitive resources so their attributes are no longer persisted

Answer

Store the state file in a private Git repository instead of S3

Question 48

Your team has been running Terraform with local state on a single engineer's laptop. To enable collaboration, you add an S3 backend configuration block to your Terraform files pointing to a new empty bucket. What is the correct next step to move the existing local state into the S3 backend?

Accepted Answer

Run 'terraform init', and when prompted, confirm that Terraform should copy the existing local state to the new S3 backend

Answer

Manually upload the terraform.tfstate file to the S3 bucket using the AWS CLI, then run 'terraform plan'

Answer

Run 'terraform apply' so the backend block is provisioned and the state is uploaded automatically

Answer

Run 'terraform state push terraform.tfstate' before any other command to seed the backend

Question 49

Your team manages an RDS database with Terraform. A security audit flags that the database master password, passed via a variable marked `sensitive = true`, could still be exposed. Where is this password stored in plaintext, and what is the recommended mitigation?

Accepted Answer

It is stored in plaintext in the state file; encrypt state at rest and restrict backend access using a remote backend that supports encryption and access controls.

Answer

It is never written anywhere because the variable is marked sensitive; no further action is needed.

Answer

It is stored only in the CLI output; redirecting output to /dev/null fully protects the value.

Answer

It is stored in the lock file (.terraform.lock.hcl); adding it to .gitignore resolves the exposure.

Question 50

A teammate uses your cloud provider's web console to manually resize a virtual machine that was originally created by Terraform. No one updated the Terraform configuration. During the next 'terraform plan', what allows Terraform to detect that the live infrastructure no longer matches its records?

Accepted Answer

Terraform compares the state file (refreshed against the real resource) to the desired configuration and reports the difference.

Answer

Terraform reads change history from the cloud provider's audit log to identify who modified the VM.

Answer

Terraform re-runs the entire configuration from scratch and destroys any resource it did not create in this run.

Answer

Terraform relies solely on the local configuration files, since state is only used during 'terraform apply'.

Question 51

A platform team manages a large Terraform configuration with hundreds of resources spanning several cloud services. During each `terraform plan`, engineers notice that Terraform does not query every provider API from scratch to rebuild the full picture of what exists; instead it uses recorded resource metadata and can process independent resources concurrently. Which benefit of Terraform state is primarily responsible for this behavior?

Accepted Answer

State stores resource metadata and dependency information, letting Terraform improve performance and determine what can be operated on in parallel without re-reading every attribute from the provider.

Answer

State encrypts all provider credentials so that API calls are authenticated faster on subsequent runs.

Answer

State converts the declarative configuration into an imperative execution script that runs faster each time.

Answer

State disables provider API calls entirely, so Terraform never contacts the cloud during a plan.

Question 52

A DevOps engineer notices that when they run 'terraform plan' after provisioning infrastructure, Terraform correctly reports 'No changes' even though the configuration files contain resources that already exist in AWS. A new team member asks how Terraform knows which real-world AWS resources correspond to the resources declared in the configuration without re-querying and re-creating everything. What is the correct explanation?

Accepted Answer

Terraform maintains a state file that stores the mapping between configuration resources and the real infrastructure objects, along with their attributes.

Answer

Terraform tags every real resource with a hidden metadata label and scans all cloud accounts on each plan to rebuild the mapping.

Answer

Terraform relies entirely on the AWS provider's live API to infer which resources belong to the configuration during each run.

Answer

Terraform embeds resource identifiers directly inside the .tf configuration files so no separate tracking mechanism is needed.

Question 53

A new engineer joins your team and argues that Terraform doesn't really need a state file because it could just query each cloud provider's API directly to determine what infrastructure exists before every plan. Which statement best explains why Terraform relies on a state file rather than treating the live cloud API as its sole source of truth?

Accepted Answer

State records the mapping between resources in your configuration and real-world objects, including metadata Terraform cannot always reconstruct from provider APIs alone.

Answer

Cloud provider APIs are read-only, so Terraform must store all resource data locally in state to be able to make changes.

Answer

State exists only to encrypt credentials, and without it Terraform would expose provider secrets on every API call.

Answer

Terraform cannot authenticate to provider APIs during a plan, so state acts as a cached login token for each provider.

Question 54

You inherited a Terraform configuration with a large state file and need to locate the exact resource address of a specific EC2 instance before running a targeted operation. You want to see all resource addresses currently tracked in state without querying the cloud provider or modifying anything. Which command should you run?

Accepted Answer

terraform state list

Answer

terraform refresh

Answer

terraform plan -target

Answer

terraform state show aws_instance.web

Question 55

A teammate's CI pipeline running 'terraform apply' against an S3 backend with DynamoDB locking crashed midway due to a network failure. Now every subsequent 'terraform plan' fails with an error indicating the state is locked, even though no operation is actually running. After confirming with the team that no apply is in progress, what is the recommended way to resolve this?

Accepted Answer

Run 'terraform force-unlock <LOCK_ID>' using the lock ID reported in the error message to release the stale lock

Answer

Manually delete the state file from the S3 bucket and re-run 'terraform init' to regenerate it

Answer

Add '-lock=false' permanently to all Terraform commands to avoid the locking mechanism entirely

Answer

Delete the DynamoDB table so Terraform stops tracking locks and recreates it on the next apply

Question 56

Your team refactored the Terraform configuration by moving an existing `aws_instance.web` resource into a new module named `frontend`. After running `terraform plan`, Terraform proposes to destroy the original instance and create a new one inside the module. You want to preserve the running EC2 instance and simply update the state to reflect the new address. Which command should you run?

Accepted Answer

terraform state mv aws_instance.web module.frontend.aws_instance.web

Answer

terraform import module.frontend.aws_instance.web aws_instance.web

Answer

terraform apply -replace=aws_instance.web

Answer

terraform refresh -target=module.frontend.aws_instance.web

Question 57

You renamed an AWS instance resource in your configuration from `aws_instance.web` to `aws_instance.frontend` without changing any of its arguments. When you run `terraform plan`, Terraform proposes to destroy `aws_instance.web` and create `aws_instance.frontend`. You want Terraform to keep the existing instance and simply track it under the new resource address. Which command accomplishes this?

Accepted Answer

terraform state mv aws_instance.web aws_instance.frontend

Answer

terraform import aws_instance.frontend aws_instance.web

Answer

terraform state rm aws_instance.web

Answer

terraform apply -replace=aws_instance.web

HashiCorp Certified: Terraform Associate (004) (Terraform Associate) full-length practice exam

How this timed Terraform Associate mock exam works

What your Terraform Associate results show

How to get the most out of it

Ready for the full Terraform Associate mock exam?