HashiCorp Terraform Associate (003) — All Questions

Which statement best describes the core value of Infrastructure as Code (IaC) as practiced with Terraform?

• a.It replaces the need for any cloud provider accounts
• b.It defines infrastructure in machine-readable configuration files that can be versioned, reviewed, and reused✓
• c.It only works for on-premises virtual machines
• d.It guarantees infrastructure can never be changed after creation

IaC expresses infrastructure as declarative configuration files that live in version control, enabling code review, repeatability, and collaboration. Terraform still requires provider credentials, works across many cloud and on-prem providers, and infrastructure can absolutely be changed by editing configuration and re-applying.

Terraform is described as a provisioning tool that uses a declarative approach. What does declarative mean in this context?

• a.You write step-by-step imperative scripts describing each API call
• b.You must run commands in a specific manual order every time
• c.You describe the desired end state, and Terraform determines the actions needed to reach it✓
• d.You can only describe infrastructure that already exists

A declarative tool lets you specify the desired final state of your infrastructure; Terraform compares that to current state and computes the create, update, or destroy actions required. This contrasts with imperative approaches where you script each individual step. Declarative configuration makes Terraform predictable and idempotent.

Which of the following is a benefit that Terraform provides as a cloud-agnostic, multi-cloud provisioning tool?

• a.A single workflow and configuration language can manage resources across many providers✓
• b.It removes the need to learn any provider-specific resource attributes
• c.It can only manage a single provider per organization
• d.It automatically makes all clouds behave identically

Terraform uses one consistent workflow (write, plan, apply) and one configuration language (HCL) to manage resources across many providers such as AWS, Azure, GCP, and Kubernetes. You still work with provider-specific resource types and attributes, and each cloud keeps its own semantics; Terraform unifies the workflow, not the clouds.

How does Terraform's approach differ from configuration management tools like Ansible, Chef, or Puppet in typical usage?

• a.Terraform can only configure software inside existing servers
• b.Terraform and configuration management tools are the exact same category
• c.Configuration management tools provision cloud infrastructure but cannot install software
• d.Terraform focuses on provisioning and managing infrastructure resources, while configuration management tools focus on configuring software on existing systems✓

Terraform is primarily a provisioning tool that creates and manages infrastructure resources such as networks, servers, and managed services. Configuration management tools specialize in installing and configuring software on machines that already exist. The two are often complementary rather than interchangeable.

What is the correct order of the core Terraform workflow when starting a new configuration?

• a.apply, then plan, then init
• b.init, then plan, then apply✓
• c.plan, then init, then destroy
• d.validate, then apply, then init

The core workflow is init (initialize the working directory and download providers), plan (preview the changes Terraform will make), then apply (execute those changes). Running init first is required because plan and apply depend on the installed providers and backend configuration.

What does the terraform init command do?

• a.It permanently deletes all managed infrastructure
• b.It applies the configuration to the target provider immediately
• c.It initializes the working directory, downloading provider plugins and configuring the backend✓
• d.It formats configuration files to the canonical style

terraform init prepares a working directory: it downloads the required provider plugins, initializes the configured backend for state storage, and installs modules. It makes no changes to real infrastructure. Formatting is handled by terraform fmt, and applying changes is done by terraform apply.

Why is running terraform plan before terraform apply considered a best practice?

• a.It shows a preview of the actions Terraform will take so you can review them before making changes✓
• b.It is the only way to download provider plugins
• c.It permanently locks the configuration from further edits
• d.It uploads your credentials to HashiCorp

terraform plan produces an execution plan describing what will be created, updated, or destroyed, letting you review the impact before applying. This preview reduces the risk of unexpected changes. Provider downloads happen during init, and plan does not lock files or transmit credentials to HashiCorp.

Which command safely tears down all resources tracked in the current Terraform state?

• a.terraform init -upgrade
• b.terraform fmt
• c.terraform validate
• d.terraform destroy✓

terraform destroy removes all infrastructure managed in the current state, prompting for confirmation first. validate checks configuration syntax and internal consistency, fmt rewrites files to canonical style, and init -upgrade updates providers. Only destroy deprovisions resources.

A teammate wants to verify that a configuration is syntactically valid and internally consistent without contacting any provider APIs. Which command fits best?

• a.terraform apply
• b.terraform validate✓
• c.terraform import
• d.terraform state rm

terraform validate checks that the configuration is syntactically valid and internally consistent, using only local files, without reaching out to provider APIs or refreshing state. apply makes changes, import brings existing resources under management, and state rm edits state, none of which is a lightweight local validation.

What is the primary purpose of Terraform state?

• a.To map real-world resources to your configuration and track metadata so Terraform can plan changes✓
• b.To store your provider credentials in plain text for reuse
• c.To serve as the human-readable documentation of your architecture
• d.To replace the need for a version control system

Terraform state records the mapping between resources defined in configuration and the real objects that exist, along with metadata and dependencies, so Terraform can determine what needs to change. It is not a documentation format or a substitute for version control, and while state can contain sensitive values it is not intended as a credential store.

A team collaborating on shared infrastructure wants to avoid two people applying changes to the same state at once. Which remote-state feature addresses this?

• a.terraform fmt
• b.provider aliasing
• c.State locking✓
• d.The count meta-argument

Remote backends that support state locking prevent concurrent operations from corrupting state by holding a lock during writes. This is essential for team collaboration on shared state. Formatting, provider aliases, and count are unrelated to protecting state from concurrent modification.

Which practice is recommended for storing Terraform state when a team collaborates on the same infrastructure?

• a.Commit terraform.tfstate to a public Git repository
• b.Use a remote backend such as Terraform Cloud or an object store with locking✓
• c.Email the state file to teammates after each apply
• d.Delete state after every apply to keep things clean

Teams should keep state in a remote backend (for example Terraform Cloud, S3 with DynamoDB locking, or similar) that provides shared access, locking, and often encryption. Committing state to version control risks leaking secrets and causes conflicts, and deleting state would lose the mapping Terraform needs to manage resources.

You provisioned a resource manually in the cloud console and now want Terraform to manage it without recreating it. Which command brings it under Terraform management?

• a.terraform apply -replace
• b.terraform destroy
• c.terraform refresh only
• d.terraform import✓

terraform import associates an existing real-world resource with a resource address in your configuration and records it in state, so Terraform manages it going forward without recreating it. You still must write matching configuration. apply -replace forces recreation, and destroy would remove infrastructure.

What does terraform state rm do to a resource?

• a.It removes the resource from Terraform state without destroying the real infrastructure✓
• b.It deletes the real resource in the cloud provider
• c.It renames the resource in the configuration file
• d.It refreshes the resource's attributes from the provider

terraform state rm removes a resource's entry from state so Terraform stops tracking it, while the actual cloud object continues to exist. It does not touch real infrastructure. To also delete the real resource you would use destroy, and to update tracked attributes you would refresh.

What is a Terraform module?

• a.A command-line flag that enables debug logging
• b.A remote service that stores state
• c.A container for multiple resources that are used together, defined as a set of configuration files✓
• d.A special provider that only manages networking

A module is a reusable container for a group of related resources defined in a set of .tf files. Every configuration has a root module, and it can call child modules to organize and reuse code. Modules are not CLI flags, state backends, or providers.

You want to pass a value into a module and receive a computed value back out. Which pair of constructs do you use?

• a.provisioners for input and locals for output
• b.input variables for values passed in and outputs for values returned✓
• c.data sources for input and providers for output
• d.backends for input and workspaces for output

Input variables (variable blocks) define the values a module accepts, and output values (output blocks) expose results from the module to its caller. Locals are internal helpers, data sources read existing information, and providers configure plugins, none of which serve as the module's public input/output interface.

Which Terraform construct reads information about existing infrastructure that Terraform does not manage, for use elsewhere in your configuration?

• a.A data source✓
• b.A resource block
• c.An output value
• d.A variable block

A data source (data block) fetches information about existing objects, such as an AMI ID or an existing VPC, so it can be referenced in configuration without Terraform managing that object. resource blocks create and manage objects, outputs expose values, and variables accept inputs.

You need to create several nearly identical resources that differ by a value from a list. Which meta-argument iterates over a collection to create one resource instance per element with a stable key?

• a.depends_on
• b.provider
• c.lifecycle
• d.for_each✓

for_each creates one instance per element of a map or set, keying instances by their map key or set value, which keeps instances stable when the collection changes. count also creates multiple instances but keys by numeric index, which can cause churn. depends_on, provider, and lifecycle serve other purposes.

How does Terraform decide the order in which to create resources when one resource references another's attribute?

• a.It always creates resources alphabetically by name
• b.It builds a dependency graph from references and creates dependencies first✓
• c.It creates them in the order they appear in the file, top to bottom
• d.It creates all resources simultaneously regardless of dependencies

Terraform builds a dependency graph by analyzing references between resources; when resource B uses an attribute of resource A, Terraform creates A before B automatically. This implicit dependency handling is why explicit ordering is rarely needed. depends_on is only for dependencies Terraform cannot infer.

In Terraform, what is the role of a provider?

• a.It stores the remote state file
• b.It defines reusable groups of resources
• c.It is a plugin that lets Terraform interact with a specific API, such as a cloud platform or SaaS✓
• d.It formats configuration to canonical style

A provider is a plugin that understands a particular API (AWS, Azure, GitHub, Kubernetes, and many others) and exposes its resource and data source types to Terraform. Providers are declared and their versions constrained so runs are reproducible. State storage is a backend concern, and reusable resource groups are modules.

Which capability is a distinguishing benefit of using Terraform Cloud or Terraform Enterprise compared with running Terraform purely from a laptop?

• a.It removes the need to write any HCL configuration
• b.It eliminates the concept of Terraform state entirely
• c.It only supports a single cloud provider
• d.It provides remote runs, secure remote state storage, and team access controls✓

Terraform Cloud adds remote execution of plans and applies, secure and shared remote state, VCS-driven workflows, policy enforcement, and team-based access controls. It still uses HCL and state, and it supports many providers. These collaboration and governance features are its main advantages over ad hoc local runs.

Why should you pin or constrain provider versions in the required_providers block?

• a.To ensure reproducible runs and avoid unexpected breaking changes from newer provider releases✓
• b.Because Terraform cannot download providers without an exact version
• c.To make plans run faster by skipping the dependency graph
• d.Because version constraints are required to store remote state

Constraining provider versions makes runs reproducible across machines and over time, preventing a newer provider release from silently introducing breaking changes. The lock file records the selected versions. Terraform can resolve providers from constraints without an exact pin, and version constraints are unrelated to plan speed or state storage.