Terraform Associate sample questions with answers

Terraform Associate sample questions

HashiCorp Certified: Terraform Associate (004), HashiCorp.

1. Question 1

   Domain: Infrastructure as Code (IaC) with Terraform

   Which three stages make up the core Terraform workflow?

   1. Define, lint and publish
   2. Build, test and release
   3. Author, compile and deploy
   4. Write, plan and apply
   Show the answer

   Answer: D. Write, plan and apply

   HashiCorp describes the core workflow as write (author configuration), plan (preview the changes) and apply (make the changes). Build, test and release describes a general software pipeline, not the Terraform-specific loop of previewing and then executing infrastructure changes.

   Checked against: https://developer.hashicorp.com/terraform/intro/v1.12.x/core-workflow

2. Question 2

   Domain: Terraform fundamentals

   A configuration contains provider "aws" { region = "us-east-1" } and provider "aws" { alias = "dr" region = "us-west-2" }. A resource block has no provider argument.

   Which provider configuration does that resource use?

   1. The aliased dr configuration, in us-west-2
   2. Both configurations, creating one copy in each region
   3. Neither; Terraform reports an ambiguous provider error
   4. The default configuration without an alias, in us-east-1
   Show the answer

   Answer: D. The default configuration without an alias, in us-east-1

   A provider block without alias is the default configuration for that provider, and resources use it unless they set provider = aws.dr. Terraform never duplicates a resource across provider configurations automatically; one resource block maps to one provider configuration.

   Checked against: https://developer.hashicorp.com/terraform/language/v1.12.x/block/provider

3. Question 3

   Domain: Core Terraform workflow

   A single EC2 instance has a corrupted operating system, but its configuration is unchanged. You want Terraform to recreate just that instance.

   Which command is recommended?

   1. terraform state rm aws_instance.web && terraform apply -auto-approve
   2. terraform apply -recreate aws_instance.web
   3. terraform apply -refresh-only -target="aws_instance.web"
   4. terraform apply -replace="aws_instance.web"
   Show the answer

   Answer: D. terraform apply -replace="aws_instance.web"

   The -replace option plans the destruction and re-creation of a specific resource even though its configuration has not changed, and replaces the deprecated terraform taint workflow. Removing it from state instead would leave the broken instance running unmanaged and create a duplicate.

   Checked against: https://developer.hashicorp.com/terraform/cli/v1.12.x/commands/apply

4. Question 4

   Domain: Core Terraform workflow

   An operator runs terraform plan -out=release.tfplan, the plan is approved, and then runs terraform apply release.tfplan.

   What happens at apply time?

   1. Terraform discards the file and applies the current configuration instead
   2. Terraform creates a new plan and asks for confirmation before applying
   3. Terraform applies the saved plan without prompting for approval again
   4. Terraform applies the saved plan only if -auto-approve is also passed
   Show the answer

   Answer: C. Terraform applies the saved plan without prompting for approval again

   Applying a saved plan file carries out the recorded actions without another interactive approval, because the plan was already reviewed. -auto-approve is only relevant when apply generates its own plan; it is not needed for a saved plan.

   Checked against: https://developer.hashicorp.com/terraform/cli/v1.12.x/commands/apply

5. Question 5

   Domain: Terraform configuration

   A module variable should accept a list of objects, each with a required name (string) and an optional port (number) that defaults to 443.

   Which type constraint expresses this?

   1. object(list({ name = string, port = default(number, 443) }))
   2. list(object({ name = string, port = optional(number, 443) }))
   3. tuple([string, optional(number, 443)])
   4. list(map({ name = string, port = number = 443 }))
   Show the answer

   Answer: B. list(object({ name = string, port = optional(number, 443) }))

   An object type attribute can be marked optional with optional(type, default), and wrapping the object in list() accepts any number of such items. A map requires all elements to share one value type and has no per-attribute defaults, and a tuple describes a fixed sequence rather than a list of records.

   Checked against: https://developer.hashicorp.com/terraform/language/v1.12.x/expressions/type-constraints

6. Question 6

   Domain: Terraform configuration

   The variable instance_type is set in terraform.tfvars as t3.small, in a file named prod.auto.tfvars as t3.large, and through the environment variable TF_VAR_instance_type=t3.micro. You run terraform plan with no -var options.

   Which value does Terraform use?

   1. t3.large from prod.auto.tfvars
   2. t3.micro from the environment variable
   3. t3.small from terraform.tfvars
   4. The plan fails because the value is set more than once
   Show the answer

   Answer: A. t3.large from prod.auto.tfvars

   Terraform loads environment variables first, then terraform.tfvars, then *.auto.tfvars files, then -var and -var-file options, with later sources overriding earlier ones. So the *.auto.tfvars value wins here; environment variables have the lowest precedence of the sources that set it.

   Checked against: https://developer.hashicorp.com/terraform/language/v1.12.x/values/variables#variable-definition-precedence

7. Question 7

   Domain: Terraform modules

   A module lives in a private Git repository, and the team wants to pin the call to the Git tag v2.3.0.

   Which source argument is correct?

   1. source = "git::https://git.example.com/infra/network.git?ref=v2.3.0"
   2. source = "https://git.example.com/infra/network.git#tag=v2.3.0"
   3. source = "git.example.com/infra/network" with version = "v2.3.0"
   4. source = "git::https://git.example.com/infra/network.git" with version = "2.3.0"
   Show the answer

   Answer: A. source = "git::https://git.example.com/infra/network.git?ref=v2.3.0"

   For Git sources you select a tag, branch or commit with the ref query parameter in the source URL. The version argument only works with modules from a module registry, so combining it with a git:: source is not supported.

   Checked against: https://developer.hashicorp.com/terraform/language/v1.12.x/modules/configuration

8. Question 8

   Domain: Terraform state management

   A configuration in another team's repository needs outputs from a network configuration whose state is in an S3 backend.

   Which built-in data source reads those root-module outputs?

   1. aws_s3_object pointing to the state file key
   2. terraform_remote_state with backend = "s3" and the matching config
   3. terraform_state with source = "s3" and the bucket name
   4. terraform_outputs with backend = "s3" and the bucket and key of the state file
   Show the answer

   Answer: B. terraform_remote_state with backend = "s3" and the matching config

   The terraform_remote_state data source retrieves the root module outputs from another configuration's backend. Reading the state object from S3 directly would expose the whole state, including sensitive values, and does not parse the outputs for you.

   Checked against: https://developer.hashicorp.com/terraform/language/v1.12.x/state/remote-state-data

9. Question 9

   Domain: Maintain infrastructure with Terraform

   You need to see every attribute Terraform has recorded for the second instance created by resource "aws_instance" "worker" with count = 3.

   Which command shows this?

   1. terraform show aws_instance.worker 2
   2. terraform state show aws_instance.worker
   3. terraform state show 'aws_instance.worker[1]'
   4. terraform state list -id aws_instance.worker[2]
   Show the answer

   Answer: C. terraform state show 'aws_instance.worker[1]'

   terraform state show takes a single resource instance address, and count instances are indexed from zero, so the second one is aws_instance.worker[1]. Quoting the address prevents the shell from interpreting the brackets.

   Checked against: https://developer.hashicorp.com/terraform/cli/v1.12.x/commands/state/show

10. Question 10

    Domain: HCP Terraform

    A platform team wants to see which workspaces across the organisation use an outdated module version and leave an action item for each owning team.

    Which HCP Terraform features fit this need?

    1. The private registry to query workspaces, and Sentinel to open a ticket for each owner
    2. Run triggers to query workspaces, and health assessments to assign the needed work
    3. The explorer to query workspaces, and change requests to record the needed work on each workspace
    4. Variable sets to query the workspaces, and run tasks to send a message to each team that owns an affected workspace
    Show the answer

    Answer: C. The explorer to query workspaces, and change requests to record the needed work on each workspace

    The explorer surfaces data about workspaces, modules, providers and Terraform versions across the organisation, and change requests can be created from explorer results to leave tasks on specific workspaces. Run triggers only queue runs after a source workspace applies; they do not query anything.

    Checked against: https://developer.hashicorp.com/terraform/cloud-docs/workspaces/change-requests