Questions & answers (free, no sign-in needed)

10 beginner questions on the Terraform Associate (004) objectives: IaC benefits, providers and state, the init–plan–apply workflow, resources versus data sources, sensitive values, module scope, state locking and inspecting state.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

1. A team builds its test and production environments by clicking through a cloud console, and the two environments keep drifting apart. Which benefit of infrastructure as code (IaC) addresses this most directly?

   • A. Cloud resources become cheaper because Terraform negotiates provider pricing
   • B. Every environment is created from the same versioned, reviewable configuration ✔ correct
   • C. Servers no longer need operating system updates once Terraform creates them
   • D. The console is disabled so nobody can change resources outside Terraform

   Answer: B. IaC defines infrastructure in code that is versioned and reused, so environments are built repeatably from the same reviewed configuration. It does not change pricing, patching duties or lock the console.

   Source: developer.hashicorp.com/terraform/tutorials/aws-get-started/infrastructure-as-co · Domain: Infrastructure as Code (IaC) with Terraform

2. Where do you declare which provider a configuration needs, its source address and an allowed version range?

   • A. In a required_providers block inside the terraform block ✔ correct
   • B. In a backend block inside the terraform block, next to the state settings
   • C. In a locals block at the top of the root module
   • D. In an output block named after the provider

   Answer: A. Provider requirements (source such as hashicorp/aws and a version constraint) belong in terraform { required_providers { ... } }. The backend block configures where state is stored.

   Source: developer.hashicorp.com/terraform/language/providers/requirements · Domain: Terraform fundamentals

3. Terraform uses its state to map the resources in your configuration to the real infrastructure objects they manage.

   • A. True ✔ correct
   • B. False

   Answer: A. True. State records which real object (for example an instance ID) belongs to each resource address, so Terraform can plan updates and deletions instead of creating duplicates.

   Source: developer.hashicorp.com/terraform/language/state · Domain: Terraform fundamentals

4. An engineer clones a repository that contains Terraform configuration and wants to run a plan. Which command must run first in the new working directory?

   • A. terraform apply
   • B. terraform fmt
   • C. terraform init ✔ correct
   • D. terraform output

   Answer: C. terraform init prepares the working directory: it installs the required providers and modules and configures the backend. Plan and apply fail until it has run.

   Source: developer.hashicorp.com/terraform/cli/commands/init · Domain: Core Terraform workflow

5. Which two commands never create, change or destroy real infrastructure? (Select TWO)

   • A. terraform validate ✔ correct
   • B. terraform plan ✔ correct
   • C. terraform apply
   • D. terraform destroy
   • E. terraform apply -replace=aws_instance.web

   Answer: A, B. validate only checks the configuration, and plan only proposes changes. apply (with or without -replace) and destroy change real infrastructure.

   Source: developer.hashicorp.com/terraform/cli/commands/plan · Domain: Core Terraform workflow

6. A team's configuration must read the ID of an existing VPC that another team created and manages. Which block should they use so Terraform reads the VPC without managing it?

   • A. A resource block with the same VPC name
   • B. A module block pointing at the other team
   • C. A variable block with a default value
   • D. A data block for the VPC ✔ correct

   Answer: D. A data block (data source) reads information about an existing object without managing its lifecycle. A resource block would make Terraform try to create and own a VPC.

   Source: developer.hashicorp.com/terraform/language/data-sources · Domain: Terraform configuration

7. An input variable holds a database password and is declared with sensitive = true. What does this setting do?

   • A. It hides the value in plan and apply output, but the value is still stored in state ✔ correct
   • B. It encrypts the value inside the state file using a key that Terraform generates for each run
   • C. It blocks the value from being passed to any resource argument
   • D. It moves the value into HashiCorp Vault when you run apply

   Answer: A. sensitive only redacts the value in CLI output. Terraform still records it in state, so protect the state (remote backend with encryption and access control) and prefer a secrets manager such as Vault.

   Source: developer.hashicorp.com/terraform/language/values/variables · Domain: Terraform configuration

8. A child module can read the root module's input variables directly, without those values being passed in through the module block.

   • A. True
   • B. False ✔ correct

   Answer: B. False. Each module has its own variable scope. The calling module must pass values as arguments in the module block, and the child exposes values back through outputs.

   Source: developer.hashicorp.com/terraform/language/block/module · Domain: Terraform modules

9. Two engineers run terraform apply at the same moment against the same remote state. Which backend feature prevents them from corrupting the state?

   • A. Provider plugin caching
   • B. State locking ✔ correct
   • C. Workspace variables
   • D. Output values

   Answer: B. Backends that support state locking lock the state for all operations that could write it, so a second run waits or fails instead of overwriting the first run's changes.

   Source: developer.hashicorp.com/terraform/language/state/locking · Domain: Terraform state management

10. An administrator wants a quick list of every resource address that Terraform currently tracks in state. Which command shows this?

    • A. terraform providers
    • B. terraform output
    • C. terraform state list ✔ correct
    • D. terraform graph

    Answer: C. terraform state list prints the address of every resource in the state. output shows output values, providers lists provider requirements and graph prints a dependency graph.

    Source: developer.hashicorp.com/terraform/cli/commands/state/list · Domain: Maintain infrastructure with Terraform

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public HashiCorp exam objectives (Terraform Associate (004) exam content list, tests Terraform 1.12), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by HashiCorp; exam names are trademarks of their owners. Official exam page: developer.hashicorp.com/terraform/tutorials/certification-004/associat.