HashiCorp Terraform Associate (003) — All Questions

Which statement best describes the core value of Infrastructure as Code (IaC) as practiced with Terraform?

• a.It defines infrastructure in machine-readable configuration files that can be versioned, reviewed, and reused✓
• b.It only works for on-premises virtual machines
• c.It replaces the need for any cloud provider accounts
• d.It guarantees infrastructure can never be changed after creation

IaC expresses infrastructure as declarative configuration files that live in version control, enabling code review, repeatability, and collaboration. Terraform still requires provider credentials, works across many cloud and on-prem providers, and infrastructure can absolutely be changed by editing configuration and re-applying.

Terraform is described as a provisioning tool that uses a declarative approach. What does declarative mean in this context?

• a.You describe the desired end state, and Terraform determines the actions needed to reach it✓
• b.You can only describe infrastructure that already exists
• c.You must run commands in a specific manual order every time
• d.You write step-by-step imperative scripts describing each API call

A declarative tool lets you specify the desired final state of your infrastructure; Terraform compares that to current state and computes the create, update, or destroy actions required. This contrasts with imperative approaches where you script each individual step. Declarative configuration makes Terraform predictable and idempotent.

Which of the following is a benefit that Terraform provides as a cloud-agnostic, multi-cloud provisioning tool?

• a.It removes the need to learn any provider-specific resource attributes
• b.It can only manage a single provider per organization
• c.It automatically makes all clouds behave identically
• d.A single workflow and configuration language can manage resources across many providers✓

Terraform uses one consistent workflow (write, plan, apply) and one configuration language (HCL) to manage resources across many providers such as AWS, Azure, GCP, and Kubernetes. You still work with provider-specific resource types and attributes, and each cloud keeps its own semantics; Terraform unifies the workflow, not the clouds.

How does Terraform's approach differ from configuration management tools like Ansible, Chef, or Puppet in typical usage?

• a.Terraform focuses on provisioning and managing infrastructure resources, while configuration management tools focus on configuring software on existing systems✓
• b.Terraform can only configure software inside existing servers
• c.Terraform and configuration management tools are the exact same category
• d.Configuration management tools provision cloud infrastructure but cannot install software

Terraform is primarily a provisioning tool that creates and manages infrastructure resources such as networks, servers, and managed services. Configuration management tools specialize in installing and configuring software on machines that already exist. The two are often complementary rather than interchangeable.

What is the correct order of the core Terraform workflow when starting a new configuration?

• a.apply, then plan, then init
• b.plan, then init, then destroy
• c.validate, then apply, then init
• d.init, then plan, then apply✓

The core workflow is init (initialize the working directory and download providers), plan (preview the changes Terraform will make), then apply (execute those changes). Running init first is required because plan and apply depend on the installed providers and backend configuration.

What does the terraform init command do?

• a.It formats configuration files to the canonical style
• b.It initializes the working directory, downloading provider plugins and configuring the backend✓
• c.It applies the configuration to the target provider immediately
• d.It permanently deletes all managed infrastructure

terraform init prepares a working directory: it downloads the required provider plugins, initializes the configured backend for state storage, and installs modules. It makes no changes to real infrastructure. Formatting is handled by terraform fmt, and applying changes is done by terraform apply.

Why is running terraform plan before terraform apply considered a best practice?

• a.It shows a preview of the actions Terraform will take so you can review them before making changes✓
• b.It permanently locks the configuration from further edits
• c.It uploads your credentials to HashiCorp
• d.It is the only way to download provider plugins

terraform plan produces an execution plan describing what will be created, updated, or destroyed, letting you review the impact before applying. This preview reduces the risk of unexpected changes. Provider downloads happen during init, and plan does not lock files or transmit credentials to HashiCorp.

Which command safely tears down all resources tracked in the current Terraform state?

• a.terraform init -upgrade
• b.terraform destroy✓
• c.terraform validate
• d.terraform fmt

terraform destroy removes all infrastructure managed in the current state, prompting for confirmation first. validate checks configuration syntax and internal consistency, fmt rewrites files to canonical style, and init -upgrade updates providers. Only destroy deprovisions resources.

A teammate wants to verify that a configuration is syntactically valid and internally consistent without contacting any provider APIs. Which command fits best?

• a.terraform apply
• b.terraform import
• c.terraform validate✓
• d.terraform state rm

terraform validate checks that the configuration is syntactically valid and internally consistent, using only local files, without reaching out to provider APIs or refreshing state. apply makes changes, import brings existing resources under management, and state rm edits state, none of which is a lightweight local validation.

What is the primary purpose of Terraform state?

• a.To store your provider credentials in plain text for reuse
• b.To serve as the human-readable documentation of your architecture
• c.To replace the need for a version control system
• d.To map real-world resources to your configuration and track metadata so Terraform can plan changes✓

Terraform state records the mapping between resources defined in configuration and the real objects that exist, along with metadata and dependencies, so Terraform can determine what needs to change. It is not a documentation format or a substitute for version control, and while state can contain sensitive values it is not intended as a credential store.

A team collaborating on shared infrastructure wants to avoid two people applying changes to the same state at once. Which remote-state feature addresses this?

• a.provider aliasing
• b.terraform fmt
• c.The count meta-argument
• d.State locking✓

Remote backends that support state locking prevent concurrent operations from corrupting state by holding a lock during writes. This is essential for team collaboration on shared state. Formatting, provider aliases, and count are unrelated to protecting state from concurrent modification.

Which practice is recommended for storing Terraform state when a team collaborates on the same infrastructure?

• a.Email the state file to teammates after each apply
• b.Delete state after every apply to keep things clean
• c.Commit terraform.tfstate to a public Git repository
• d.Use a remote backend such as Terraform Cloud or an object store with locking✓

Teams should keep state in a remote backend (for example Terraform Cloud, S3 with DynamoDB locking, or similar) that provides shared access, locking, and often encryption. Committing state to version control risks leaking secrets and causes conflicts, and deleting state would lose the mapping Terraform needs to manage resources.

You provisioned a resource manually in the cloud console and now want Terraform to manage it without recreating it. Which command brings it under Terraform management?

• a.terraform destroy
• b.terraform apply -replace
• c.terraform import✓
• d.terraform refresh only

terraform import associates an existing real-world resource with a resource address in your configuration and records it in state, so Terraform manages it going forward without recreating it. You still must write matching configuration. apply -replace forces recreation, and destroy would remove infrastructure.

What does terraform state rm do to a resource?

• a.It refreshes the resource's attributes from the provider
• b.It renames the resource in the configuration file
• c.It removes the resource from Terraform state without destroying the real infrastructure✓
• d.It deletes the real resource in the cloud provider

terraform state rm removes a resource's entry from state so Terraform stops tracking it, while the actual cloud object continues to exist. It does not touch real infrastructure. To also delete the real resource you would use destroy, and to update tracked attributes you would refresh.

What is a Terraform module?

• a.A command-line flag that enables debug logging
• b.A remote service that stores state
• c.A special provider that only manages networking
• d.A container for multiple resources that are used together, defined as a set of configuration files✓

A module is a reusable container for a group of related resources defined in a set of .tf files. Every configuration has a root module, and it can call child modules to organize and reuse code. Modules are not CLI flags, state backends, or providers.

You want to pass a value into a module and receive a computed value back out. Which pair of constructs do you use?

• a.data sources for input and providers for output
• b.backends for input and workspaces for output
• c.provisioners for input and locals for output
• d.input variables for values passed in and outputs for values returned✓

Input variables (variable blocks) define the values a module accepts, and output values (output blocks) expose results from the module to its caller. Locals are internal helpers, data sources read existing information, and providers configure plugins, none of which serve as the module's public input/output interface.

Which Terraform construct reads information about existing infrastructure that Terraform does not manage, for use elsewhere in your configuration?

• a.A variable block
• b.A data source✓
• c.A resource block
• d.An output value

A data source (data block) fetches information about existing objects, such as an AMI ID or an existing VPC, so it can be referenced in configuration without Terraform managing that object. resource blocks create and manage objects, outputs expose values, and variables accept inputs.

You need to create several nearly identical resources that differ by a value from a list. Which meta-argument iterates over a collection to create one resource instance per element with a stable key?

• a.lifecycle
• b.provider
• c.depends_on
• d.for_each✓

for_each creates one instance per element of a map or set, keying instances by their map key or set value, which keeps instances stable when the collection changes. count also creates multiple instances but keys by numeric index, which can cause churn. depends_on, provider, and lifecycle serve other purposes.

How does Terraform decide the order in which to create resources when one resource references another's attribute?

• a.It builds a dependency graph from references and creates dependencies first✓
• b.It always creates resources alphabetically by name
• c.It creates them in the order they appear in the file, top to bottom
• d.It creates all resources simultaneously regardless of dependencies

Terraform builds a dependency graph by analyzing references between resources; when resource B uses an attribute of resource A, Terraform creates A before B automatically. This implicit dependency handling is why explicit ordering is rarely needed. depends_on is only for dependencies Terraform cannot infer.

In Terraform, what is the role of a provider?

• a.It is a plugin that lets Terraform interact with a specific API, such as a cloud platform or SaaS✓
• b.It stores the remote state file
• c.It formats configuration to canonical style
• d.It defines reusable groups of resources

A provider is a plugin that understands a particular API (AWS, Azure, GitHub, Kubernetes, and many others) and exposes its resource and data source types to Terraform. Providers are declared and their versions constrained so runs are reproducible. State storage is a backend concern, and reusable resource groups are modules.

Which capability is a distinguishing benefit of using Terraform Cloud or Terraform Enterprise compared with running Terraform purely from a laptop?

• a.It removes the need to write any HCL configuration
• b.It provides remote runs, secure remote state storage, and team access controls✓
• c.It only supports a single cloud provider
• d.It eliminates the concept of Terraform state entirely

Terraform Cloud adds remote execution of plans and applies, secure and shared remote state, VCS-driven workflows, policy enforcement, and team-based access controls. It still uses HCL and state, and it supports many providers. These collaboration and governance features are its main advantages over ad hoc local runs.

Why should you pin or constrain provider versions in the required_providers block?

• a.To ensure reproducible runs and avoid unexpected breaking changes from newer provider releases✓
• b.Because version constraints are required to store remote state
• c.To make plans run faster by skipping the dependency graph
• d.Because Terraform cannot download providers without an exact version

Constraining provider versions makes runs reproducible across machines and over time, preventing a newer provider release from silently introducing breaking changes. The lock file records the selected versions. Terraform can resolve providers from constraints without an exact pin, and version constraints are unrelated to plan speed or state storage.