Terraform Associate 004 #10 Practice Exam: 50 Questions Across the Full Scope with Explanations

Infrastructure Terraform IaC Certification

Friday, October 9, 2026

20 min read

This is the final part of the series: a practice exam covering the full scope. The approach is the same as in the GitHub Foundations practice exam.

Aim to finish within 60 minutes (the same time as the real exam, with a similar question density)
Resist checking the explanation after each question — grade yourself after finishing all of them
35 or more questions (70%) count as ready to book (the actual passing line is not published; this is a conservative bar)
If a weak domain shows up, go back to the matching part (#2–#9) and review

Domain distribution #

Domain	Questions	Range
IaC concepts and Terraform’s purpose (#2)	6	Q1–Q6
Fundamentals: versions and providers (#3)	6	Q7–Q12
Core workflow (#4)	8	Q13–Q20
State management (#5)	8	Q21–Q28
Modules (#6)	6	Q29–Q34
Writing configuration and custom conditions (#7)	7	Q35–Q41
New scope: ephemeral and meta-arguments (#8)	5	Q42–Q46
HCP Terraform (#9)	4	Q47–Q50

IaC Concepts and Terraform’s Purpose (Q1–Q6) #

Q1. Which of the following is not a benefit of IaC (Infrastructure as Code)?

A The same code can create identical environments repeatedly B Infrastructure changes become subject to version control and code review C Cloud pricing rates automatically go down D Configuration drift between environments decreases

Q2. Which statement most accurately describes Terraform’s configuration model?

A Imperative — you describe the ordered steps to reach the desired state B Declarative — you describe the desired end state and the tool computes how to get there C Purely functional with no state at all D It records console operations on each cloud and replays them

Q3. What do you call the property that running Terraform apply multiple times with the same configuration produces the same result?

A Atomicity B Idempotency C Commutativity D Immutability

Q4. What is the structural reason Terraform can support so many clouds and SaaS products?

A Every cloud API is built into the core binary B A separate Terraform distribution exists for each cloud C Provider plugins, separate from the core, handle each service’s API calls D Each cloud implements Terraform syntax on its own

Q5. Which best describes the fundamental purpose of Terraform state?

A It records syntax errors in configuration files B It aggregates cloud billing C It permanently archives execution logs D It maintains the mapping between resources in the configuration and real infrastructure objects, making change calculation possible

Q6. What is HashiCorp’s official position on provisioners?

A They are the recommended standard method for configuration management B They are a last resort when no other option exists C They were removed in 004 and can no longer be used D They are another name for providers

Fundamentals: Versions and Providers (Q7–Q12) #

Q7. What range does the version constraint ~> 6.2 allow?

A Only 6.2.0 B Everything 6.2 and above, including 7.x C 6.2 or higher and below 7.0 D Everything 6.2 and below

Q8. Which statement about the .terraform.lock.hcl file is correct?

A It contains sensitive information and must not be committed to version control B It records the provider versions and checksums that init actually selected, and it should be committed C It records the lock status of the state D It is a version policy file that people write by hand

Q9. Which command upgrades the provider versions recorded in the lock file to the latest within the allowed range?

A terraform init -upgrade B terraform apply -refresh-only C terraform providers update D terraform version -latest

Q10. How do you use the same AWS provider twice with different region settings?

A It is impossible; you have to split directories B Declare it twice in required_providers C Add an alias to the second provider block and select it with the provider argument on the resource D Set it per resource with a region argument

Q11. Which is the recommended way to manage provider credentials?

A Write access keys directly in the provider block B Put them in a tfvars file in plaintext and commit it C Store them in the state file in advance D Use external injection such as environment variables or IAM roles

Q12. Which statement about the .terraform directory is correct?

A The state file is stored there, so it should be backed up B It holds provider plugins and the module cache, can be regenerated with init, and is not committed C Deleting it deletes the infrastructure too D It contains the lock file, so it must be committed

Core Workflow (Q13–Q20) #

Q13. What are the three stages of the Terraform core workflow as HashiCorp defines it?

A Init, Validate, Deploy B Write, Plan, Apply C Code, Build, Release D Plan, Approve, Destroy

Q14. Which situation does not require re-running terraform init?

A You changed the backend settings B You added a provider to required_providers C You changed the source of a module block D You edited a tag value on a resource

Q15. How do you apply exactly what you reviewed in plan, with no changes slipping in between?

A Save the plan with plan -out and pass that file to apply B Run apply quickly right after plan C Use apply -auto-approve D Copy the plan output and paste it into apply

Q16. What is the current way to force a single resource you suspect is damaged to be recreated on the next apply?

A Use the terraform taint command B Remove it from state with rm, then apply C Use the -replace=ADDRESS flag with plan and apply D Delete the resource block and add it back

Q17. Which statement about the -target flag is most accurate?

A It is the recommended way to narrow the scope of applies in the daily workflow B It applies only part of the dependency graph, so it is used only as a temporary measure in exceptional situations C It is a flag that deletes the specified resource D It can only be used with plan

Q18. Which statement about terraform validate is correct?

A It connects to the cloud and validates real values B It reformats code into the standard style C It checks syntax and internal consistency without credentials, and it works after init D It finds drift between state and real infrastructure

Q19. Which setting writes the most detailed Terraform debug logs to a file?

A Set the TF_LOG=TRACE and TF_LOG_PATH environment variables B Use the terraform apply –debug flag C Run the terraform log enable command D Add a logging block to the configuration

Q20. Which command does the same thing as terraform destroy?

A terraform rm -all B terraform state rm C terraform plan -destroy D terraform apply -destroy

State Management (Q21–Q28) #

Q21. With the default (local backend) behavior, where is state stored?

A Inside the .terraform directory B In the terraform.tfstate file in the working directory C In .terraformrc in the home directory D In a cloud bucket designated by the provider

Q22. Which is not an advantage that a remote backend provides over local state?

A Every team member shares the same state B It can support locking that prevents concurrent runs C plan calculations become more accurate D It removes the risk of loss, such as a lost laptop

Q23. You run apply and get “Error acquiring the state lock”. What should you do first?

A Check who holds it in Lock Info, and if a run is in progress, wait for it to finish B Immediately release the lock with force-unlock C Delete the state file and try again D Switch the backend settings back to local

Q24. Which statement about terraform force-unlock is correct?

A It rolls the state contents back to the last good version B It only releases the lock and does not change the state contents C It safely stops an apply that is in progress D It permanently disables the backend’s locking feature

Q25. What happens when you run terraform state rm?

A The real resource is deleted B The resource is replaced on the next apply C The resource remains and is only removed from Terraform’s management D The entire state file is deleted

Q26. What is the declarative way to rename a resource block while avoiding recreation?

A Declare the old and new addresses with a moved block B Use a removed block C Use the -replace flag D Do nothing; Terraform recognizes renames automatically

Q27. What is the current standard for bringing an existing resource that was first created in the console under Terraform management?

A Write only the resource block and apply B Add JSON to the state file by hand C Run refresh D Declare an import block, review with plan, then apply

Q28. Which statement about the value of a variable marked sensitive = true is correct?

A It is stored encrypted in state as well B It is only masked in plan output and remains in plaintext in state C It is completely removed from both logs and state D The variable can no longer be used in the workflow

Modules (Q29–Q34) #

Q29. What is the root module in Terraform?

A A module that carries the verified badge on the registry B A module that calls no other modules C The configuration in the working directory where you run Terraform D A standard module distributed by HashiCorp

Q30. For which source is the version argument of a module block valid?

A A local path such as ../modules/network B A registry address such as terraform-aws-modules/vpc/aws C A Git address with the git:: prefix D It is valid for every source

Q31. How does the calling side read a value that a child module created?

A Reference the values the module exports as outputs via module.NAME.OUTPUT B Access the resources inside directly via module.NAME.RESOURCE_ADDRESS C Read the child module’s state file directly D They are automatically exposed as global variables

Q32. After adding a new module block, plan fails with a “Module not installed” error. What is the fix?

A terraform apply -auto-approve B terraform refresh C Manually copy the module directory into .terraform D terraform init

Q33. Which statement about the verified badge on the public registry is correct?

A Modules without the verified badge cannot be downloaded B It is trust reference information indicating a module from a partner that HashiCorp has verified C It guarantees the absence of security vulnerabilities D It indicates that automatic updates are applied

Q34. What happens if you do not specify version for a registry module?

A init rejects it with an error B It is pinned to 1.0.0 C It fetches the latest version, which can differ from run to run D The lock file pins the version instead

Writing Configuration and Custom Conditions (Q35–Q41) #

Q35. When values arrive for the same variable through multiple channels, which one is applied in the end?

A The TF_VAR_ environment variable B terraform.tfvars C *.auto.tfvars D -var on the command line

Q36. Which statement about locals is correct?

A Both declaration and reference use the locals keyword B You declare them in a locals block and reference them as local.NAME C They are the entry point for injecting values from outside D They are another name for outputs

Q37. You want to read a user-data script file while substituting variables into it. Which function fits?

A templatefile B file C jsonencode D format

Q38. Which command lets you experiment with expression results interactively without an apply?

A terraform test B terraform eval C terraform console D terraform expression

Q39. Inside a resource’s lifecycle block, what validates “assumptions that must hold before this resource is evaluated”?

A postcondition B precondition C validation D check

Q40. Which keyword references the resource’s own attributes inside a postcondition?

A this B each C resource D self

Q41. Which custom condition leaves only a warning on failure instead of blocking apply?

A A check block B precondition C postcondition D Variable validation

New Scope: ephemeral and Meta-Arguments (Q42–Q46) #

Q42. Which statement about ephemeral values is correct?

A They are stored encrypted in state B They are generated once on the first apply and reused C They are not stored in plan or state and exist only during execution D Only the string type is allowed

Q43. How do you later rotate the value of a write-only argument such as password_wo on aws_db_instance?

A Put in a new value and Terraform detects the difference and applies it B Bump the paired _wo_version value to signal the change C Delete the state and apply again D write-only values cannot be rotated

Q44. When is using depends_on justified?

A When there is no reference between the resources but a real ordering dependency exists B When you want to specify the creation order of every resource C When you want to speed up apply D When you want to guarantee the order once more for resources that already reference each other

Q45. With resources created from a list-based count, what happens when you remove an element from the middle of the list?

A Exactly that element is deleted B Nothing changes C Everything is recreated D The indexes of the later elements shift, and unintended replacements and deletions get planned

Q46. Which setting blocks, at the Terraform level, a production database from accidentally being included in a deletion plan?

A ignore_changes = all B prevent_destroy = true in lifecycle C create_before_destroy = true D Adding depends_on

HCP Terraform (Q47–Q50) #

Q47. Which statement about HCP Terraform workspaces is correct?

A They are the same feature as the CLI’s terraform workspace command B An organization can have only one workspace C They are the management unit holding the state, variables, and run history for one configuration D They do not store state

Q48. What is the standard way to supply common cloud credentials to multiple workspaces?

A Create a variable set and apply it to the target workspaces B Copy and register them manually in each workspace C Hardcode them in the configuration files D Put them in the state file and share it

Q49. Which Sentinel policy level blocks on violation but allows an authorized person to override and proceed?

A hard-mandatory B soft-mandatory C advisory D optional

Q50. What is Terraform Enterprise?

A The name of HCP Terraform’s free tier B A paid version of the Terraform CLI C A self-hosted edition that installs HCP Terraform capabilities directly on an organization’s own infrastructure D An AWS-only Terraform distribution

Scoring and Next Steps #

35 or more questions (70%) counts as ready to book. For the questions you missed, find the matching part in the domain distribution table and go back — in particular, the custom conditions in #7 and the new scope in #8 are new in 004, so if your wrong answers cluster there, reinforce those first. Before booking, I recommend going through the official study guide and the sample questions once to get familiar with how the exam phrases things.

The series-guided study ends here. The 26-part Terraform basics, practice, and operations track that this certification line is built on carries the practical depth, so whenever exam prep surfaces a concept your hands do not remember, drop down to the track anytime and pair it with hands-on work. Good luck on the exam.