HashiCorp Terraform Associate 004 Practice Questions with Explanations

Correct answer: A

Infrastructure as Code is specifically designed to be stored in version control systems like Git alongside application code. This enables teams to track changes, collaborate, maintain history, and apply DevOps practices to infrastructure just as they do with application code.

Why the other options are wrong:

• B. IaC is fundamentally built for version control integration and this is a core principle of infrastructure management.

Correct answer: B

Storing secret data such as API keys, passwords, and credentials directly in a version control repository is a critical security vulnerability. Best practice requires storing secrets in dedicated secret management systems like AWS Secrets Manager, HashiCorp Vault, or environment variables, keeping them separate from code repositories.

Why the other options are wrong:

• A. Storing secrets in version control creates significant security risks as the repository history may expose sensitive data to unauthorized users.

Correct answer: A

The unique advantage of IaC that GUI provisioning cannot provide is the ability to version, reuse, and share infrastructure configuration. IaC allows infrastructure definitions to be treated as code, enabling version control, code reuse across projects, and easy sharing among team members, which are not feasible with GUI-based provisioning.

Why the other options are wrong:

• B. Both IaC and GUI provisioning can be insecure if credentials are mishandled; this is not an IaC-exclusive advantage.
• C. Cost is determined by resource usage, not the provisioning method; both approaches provision identical resources at the same cost.
• D. Neither IaC nor GUI provisioning inherently prevents manual modifications; both require additional controls like role-based access to prevent drift.

Correct answer: C

Immutable infrastructure enables quicker infrastructure upgrades because new instances are created with updated configurations and old instances are replaced rather than modified in-place. This approach reduces deployment time, complexity, and the risk of partial failures since the entire infrastructure is replaced atomically.

Why the other options are wrong:

• A. Immutable infrastructure does not provide automatic upgrades; upgrades still require intentional deployment.
• B. Immutable infrastructure explicitly avoids in-place upgrades by replacing entire instances.
• D. While immutable infrastructure can reduce complexity, the primary advantage over mutable approaches is faster deployment speed.

Correct answer: C

The primary purpose of Infrastructure as Code is to programmatically create and configure infrastructure resources. IaC enables infrastructure to be provisioned, modified, and managed through code rather than manual processes, providing repeatability, consistency, and automation.

Why the other options are wrong:

• A. Defining deployment pipelines is the purpose of CI/CD tools, not the primary purpose of IaC.
• B. Cost reduction is a potential benefit but not the primary purpose of IaC.
• D. While some IaC tools may support multiple vendors, defining vendor-agnostic APIs is not the primary purpose of IaC.

Correct answer: A

AWS CloudFormation is AWS-specific and cannot deploy resources to Microsoft Azure or other cloud providers. A team standardized on CloudFormation would face significant challenges when required to provision infrastructure outside the AWS ecosystem, as they would need to learn and adopt different tools for other cloud platforms.

Why the other options are wrong:

• B. CloudFormation is excellent for automating manual web console-based provisioning; this is a primary use case.
• C. CloudFormation supports multi-region deployments within AWS through parameters and regional references.
• D. CloudFormation is designed specifically for managing AWS-native services and workloads.

Correct answer: C

A GUI (Graphical User Interface) is not a benefit of adopting IaC; in fact, IaC explicitly moves away from GUI-based provisioning toward code-based management. The actual benefits of IaC include reusability of code, automation of infrastructure provisioning, and versioning of infrastructure configurations.

Why the other options are wrong:

• A. Reusability of code is a direct benefit of IaC, allowing templates and modules to be reused across projects.
• B. Automation is a core benefit of IaC, eliminating manual provisioning steps.
• D. Versioning is a fundamental benefit of IaC, enabling infrastructure to be tracked and managed like application code.

Correct answer: B

Terraform describes infrastructure with version- controlled, repeatable configurations that specify the desired state. Terraform differs fundamentally from conventional infrastructure management by using declarative configuration files that describe the desired state of infrastructure. These configurations are version-controlled, repeatable, and enable teams to manage infrastructure through code rather than manual API calls or imperative scripts. Terraform abstracts away the complexity of directly calling cloud provider APIs while maintaining compatibility with them.

Why the other options are wrong:

• A. Terraform does not replace cloud provider APIs; it abstracts and simplifies interaction with them.
• C. While Terraform uses cloud provider APIs under the hood, it provides significant abstraction and differs substantially from calling APIs directly.
• D. Terraform uses declarative configuration, not imperative scripts, to define the desired state rather than procedural steps.

Correct answer: D

Reviewing proposed changes for potential security issues is uniquely enabled by Infrastructure as Code. When infrastructure is defined as code, changes can be submitted as code reviews (pull requests) before deployment, allowing security teams and peers to inspect the changes for vulnerabilities and policy violations. Options A, B, and C can all be accomplished through various means independent of IaC.

Why the other options are wrong:

• A. Automatic scaling is enabled by cloud provider features and can be configured manually or through IaC.
• B. Cost optimization can be achieved through manual resource selection and cloud provider cost analysis tools.
• C. Role-based access control is a cloud provider feature independent of whether infrastructure is managed through code.

Correct answer: D

Terraform uses vendor-specific providers to deploy infrastructure for different cloud platforms. Each provider contains the logic to interact with a particular cloud service's API, abstracting the vendor's API complexity into a consistent Terraform configuration syntax. Providers are the core mechanism enabling Terraform to work across AWS, Azure, Google Cloud, and thousands of other platforms.

Why the other options are wrong:

• A. Terraform uses vendor APIs, not custom APIs developed by HashiCorp, to interact with cloud services.
• B. Terraform does not depend on or wrap vendors' CLI tools for deployment.
• C. Terraform does not use cloud provider UIs; it interacts programmatically through APIs via providers.

Correct answer: B

The TF_LOG environment variable enables verbose logging in Terraform for troubleshooting purposes. Setting this variable to DEBUG, TRACE, or other log levels outputs detailed diagnostic information about Terraform's execution, API calls, and internal operations. This is the standard and documented method for enabling verbose logging in Terraform.

Why the other options are wrong:

• A. Terraform does not use a log level command line flag for verbose logging.
• C. While the terraform block configures provider behavior and backend settings, it is not used to set logging verbosity.

Correct answer: A

The terraform console command provides an interactive REPL environment where you can experiment with and evaluate Terraform expressions, functions, and variable values. This is useful for testing expressions before using them in configurations or for debugging complex variable interpolations.

Why the other options are wrong:

• B. terraform env manages Terraform workspaces and is not used for expression evaluation.
• C. terraform validate checks configuration syntax and validity but does not provide an interactive expression environment.
• D. terraform test runs test files but does not provide an interactive console for expression experimentation.

Correct answer: A

The terraform init command can install Community and Partner providers and plugins from the Terraform Registry. When you reference a provider in your configuration, terraform init automatically downloads and installs the required provider, enabling use of community- developed and vendor-partner plugins alongside official providers.

Correct answer: B

Terraform automatically infers resource dependencies based on resource references and attributes without requiring explicit depends_on arguments. When one resource references another resource's output or attribute, Terraform builds a dependency graph and deploys resources in the correct order automatically. The depends_on argument is only necessary for implicit dependencies that Terraform cannot detect from configuration references.

Why the other options are wrong:

• A. Terraform infers most dependencies automatically from resource references; explicit depends_on is only needed for implicit dependencies.

Correct answer: D

Terraform supports three collection types: list, map, and set. The tree type does not exist in Terraform's type system. Lists are ordered collections of values of the same type, maps are key-value pairs, and sets are unordered collections of unique values.

Why the other options are wrong:

• A. Set is a valid Terraform collection type for storing unique values.
• B. List is a valid Terraform collection type for ordered sequences.
• C. Map is a valid Terraform collection type for key-value pairs.

Correct answer: C

In a Terraform resource block, the provider is the first argument in the resource declaration. The syntax is resource "provider_type" "local_name", so in resource "aws_vpc" "main", the provider is aws. The resource type is vpc and main is the local reference name.

Why the other options are wrong:

• A. Main is the local name assigned to this resource instance, not the provider.
• B. Vpc is the resource type within the aws provider, not the provider itself.
• D. Test is a value assigned to the name argument, not the provider.

Correct answer: B

Terraform is cloud-agnostic and uses the same core commands regardless of the target cloud provider. The terraform plan, apply, destroy, and other commands work identically whether deploying to AWS, Azure, Google Cloud, or any other supported provider. The differences are handled through provider configurations, not different commands.

Why the other options are wrong:

• A. This is false; Terraform uses the same commands across all cloud providers.

Correct answer: B

Terraform providers are not always installed from the internet. Providers can be installed from the Terraform Registry, local filesystem, or other sources. Additionally, once a provider is cached locally, Terraform can use the cached version without downloading from the internet. The terraform init command manages provider installation based on the configuration.

Why the other options are wrong:

• A. This is false; providers can be sourced locally or from caches without internet access.

Correct answer: B

The TF_LOG environment variable controls Terraform logging verbosity, with TRACE being the most detailed level that shows provider loading paths and other low-level operations. Setting TF_LOG=TRACE enables the diagnostic output needed to see from which paths providers are being loaded.

Why the other options are wrong:

• A. TF_VAR_log is not a valid environment variable; TF_VAR prefix is for input variables.
• C. PATH is not a valid TF_LOG value; the correct value is TRACE.
• D. Verbose logging is not configured per-provider in the Terraform configuration file; it uses the TF_LOG environment variable.

Correct answer: A

Terraform requires a different provider for each cloud platform. Each provider (aws, azurerm, google, etc.) has its own configuration and manages resources specific to that cloud platform. To deploy to multiple clouds, you must explicitly configure and use multiple providers.

Why the other options are wrong:

• B. This is false; Terraform requires different providers for different cloud platforms.

Correct answer: A

Terraform requires the terraform init command to initialize a backend configuration before it can be used. This command sets up the backend infrastructure, validates the configuration, and prepares Terraform to manage state using that backend. Without running terraform init, Terraform cannot interact with a newly-defined backend.

Why the other options are wrong:

• B. This is false; terraform init is mandatory for initializing a new backend.

Correct answer: B

The max() function is the Terraform built-in function that returns the largest value from a list of numbers. When called with a list like numcpus, it evaluates all elements and returns the maximum value, which would be 18 in this case.

Why the other options are wrong:

• A. top() is not a valid Terraform function.
• C. ceil() rounds a number up to the nearest integer but does not select the maximum from a list.
• D. high[numcpus] is not valid Terraform syntax; indexing with brackets is for accessing specific elements, not finding the maximum.

Correct answer: A

The .terraform directory stores downloaded providers and modules required by your configuration. When you run terraform init, Terraform downloads the necessary providers and modules into this directory so they can be used during planning and applying. The lock file is stored at the root level as .terraform.lock.hcl, the state file is stored at the root as terraform.tfstate, and configuration files remain in your working directory.

Why the other options are wrong:

• B. The lock file (.terraform.lock.hcl) is stored in the root directory, not in .terraform.
• C. The state file (terraform.tfstate) is stored in the root directory, not in .terraform.
• D. Configuration files are stored in your working directory, not in .terraform.

Correct answer: A

The variable 'tags' needs to store metadata tags as key-value pairs for resources. In Terraform, a map(string) type is the standard and most appropriate choice for representing a collection of key-value pairs where both keys and values are strings. This allows users to pass tags like {environment = "prod", team = "devops"} to resources. The map type natively supports the key-value pair structure required for tagging resources across multiple Terraform resources.

Why the other options are wrong:

• B. type = any is too permissive and lacks type safety; it defeats the purpose of variable validation and doesn't explicitly communicate that key-value pairs are expected.
• C. type = list(string) represents an ordered collection of strings, not key-value pairs, making it unsuitable for metadata tags that require distinct keys and values.
• D. type = object({tags = string}) defines an object with a single 'tags' property of string type, not a collection of key-value pairs, and would not properly represent multiple tag entries.

Correct answer: A

The variable name 'name' is a valid identifier for a Terraform variable. The options 'source', 'version', and 'count' are reserved keywords or meta-arguments in Terraform that cannot be used as variable names. Reserved words and meta-arguments are protected syntax elements that serve specific purposes in Terraform configurations.

Why the other options are wrong:

• B. source is a reserved keyword used in module and provider blocks.
• C. version is a reserved keyword used in provider version constraints.
• D. count is a reserved meta-argument used for resource iteration.

Correct answer: B

Terraform providers are not part of the core binary. Providers are separate plugins that Terraform downloads and manages independently. The Terraform core binary contains the language interpreter and primary commands, while providers are distributed separately and downloaded on demand during terraform init based on your configuration requirements.

Correct answer: B

Terraform cannot load a provider from source code directly. Providers must be compiled binaries. Terraform can load providers from the provider plugin cache (local directory), the official HashiCorp distribution on releases.hashicorp.com, and the plugins directory. Source code would need to be compiled first before it could be used as a provider plugin.

Why the other options are wrong:

• A. Terraform can load providers from the local provider plugin cache.
• C. Terraform can load providers from the official HashiCorp releases.hashicorp.com distribution.
• D. Terraform can load providers from the plugins directory in .terraform.

Correct answer: B

The terraform init command does not create an example main.tf file. It only initializes the working directory by downloading necessary providers and modules based on existing configuration files. You must create your own configuration files before or after running init. The command prepares the environment but does not generate sample Terraform code.

Correct answer: D

The terraform init command must be run first before any plan or apply operation. This command initializes the working directory, downloads required providers and modules, and prepares the environment for Terraform operations. Without running init, Terraform lacks the necessary dependencies to execute plans or apply configurations.

Why the other options are wrong:

• A. terraform validate checks configuration syntax but does not initialize the working directory.
• B. terraform workspace manages state file workspaces but is not a prerequisite.
• C. terraform import brings existing resources into state but requires init to have already run.

Correct answer: C

The terraform init -upgrade command downloads and installs the latest versions of providers and modules allowed by version constraints in your configuration. The -upgrade flag tells init to check for and download newer versions rather than using cached versions. This is the correct way to ensure plugins are up-to-date with the latest compatible versions.

Why the other options are wrong:

• A. terraform apply does not have an -upgrade flag for provider updates.
• B. terraform providers does not accept an -upgrade flag; it only lists provider information.
• D. terraform refresh does not have an -upgrade flag for updating providers.

Correct answer: B

When terraform plan is executed, it captures the current state at that moment. If a teammate manually modifies infrastructure between your terraform plan and terraform apply, the actual infrastructure state has changed. When terraform apply runs, it will refresh the state and detect these manual changes, potentially resulting in a different execution plan than what was originally generated by terraform plan.

Why the other options are wrong:

• A. The execution plan will differ because Terraform will detect the manual infrastructure changes made after the plan was created.

Correct answer: B

The correct workflow requires initializing the working directory first with terraform init, which downloads provider plugins and sets up the backend. After initialization, terraform plan reviews changes and terraform apply executes them. Option A skips initialization and validation order is wrong. Option C incorrectly states terraform plan initializes the directory. Option D uses terraform show instead of plan.

Why the other options are wrong:

• A. This skips the critical terraform init step and runs validate after apply, which is backwards.
• C. terraform plan does not initialize the working directory; terraform init is required for that purpose.
• D. terraform show displays existing state, not proposed changes; terraform plan is needed for that.

Correct answer: C

terraform validate performs only syntactic and internal consistency checking of the configuration code itself. It does not interact with cloud providers, authenticate credentials, or contact remote systems. Authentication errors only surface when terraform plan attempts to communicate with the actual provider, requiring valid credentials and permissions.

Why the other options are wrong:

• A. The working directory does not need to be initialized for validate to work, and validate does not use provider plugins.
• B. The remote backend configuration is not required for validate to function; validate works locally on syntax alone.
• D. Variables are validated during terraform plan and apply, but this is unrelated to why provider authentication errors are not caught by validate.

Correct answer: B

Terraform plans are not locked to specific users. Any user with appropriate credentials and access to the state file can apply a plan that was created by another user. Plans are simply stored execution specifications that can be passed between team members and applied by whoever has the necessary permissions.

Why the other options are wrong:

• A. There is no restriction in Terraform requiring the same user to both generate and apply a plan.

Correct answer: B

terraform apply can be executed independently without a preceding terraform plan command. When apply runs without a saved plan file, it automatically generates its own plan internally and then executes it after confirmation. The terraform plan command is optional and useful for review purposes, but not a prerequisite for apply.

Why the other options are wrong:

• A. terraform apply is designed to work standalone and will generate its own plan if one is not provided.

Correct answer: C

The correct syntax for saving a terraform plan to a file is terraform plan -out=tfplan. This flag specifies the output location for the plan file, which can then be passed to terraform apply for deterministic execution. The -out flag is the standard Terraform option for this purpose.

Why the other options are wrong:

• A. -generate-config-out is not a valid terraform plan flag.
• B. -target is used to select specific resources, not to save plan output.
• D. -var-file is used to pass variable values from a file, not to output plans.

Correct answer: A

terraform validate only checks syntax and internal consistency of configuration code. None of the listed options will actually cause validate to return an error. Missing variable blocks are allowed in Terraform, state file mismatches are not checked by validate, and indentation with tabs versus spaces is not validated (HCL is flexible with whitespace).

Why the other options are wrong:

• B. Missing variable blocks are syntactically valid in Terraform and do not cause validate to error.
• C. State file mismatches are not checked by validate; that is a runtime concern during plan or apply.
• D. Terraform's HCL parser accepts both tabs and spaces for indentation without error.

Correct answer: A

The .terraform directory is created during terraform init and stores downloaded provider plugins, modules, and backend configuration data. It is essential for Terraform's operation and should not be committed to version control. Option C incorrectly describes where the state file is stored (typically as terraform.tfstate in the working directory, not within .terraform). Option B describes files that should be gitignored but not stored in .terraform. Option D describes the function of providers themselves, not the directory.

Why the other options are wrong:

• B. Credential files and .tfvars are kept outside .terraform and managed separately through .gitignore.
• C. The state file is stored in the working directory as terraform.tfstate, not inside the .terraform directory.
• D. Conversion to API calls is the function of providers, not the purpose of the .terraform directory.

Correct answer: A

terraform plan generates an execution plan showing what changes will be made to infrastructure without actually applying them. This allows you to review and validate that the planned changes match your expectations before committing them. Option B describes terraform apply, not plan. Option C describes terraform init. Option D describes terraform fmt.

Why the other options are wrong:

• B. This describes terraform apply behavior, which actually modifies state and resources.
• C. This describes the terraform init command, not plan.
• D. This describes the terraform fmt command for code formatting.