TA-004 Practice Questions — Free

The Terraform Associate is a tool certification rather than a cloud one. What you learn applies to whichever provider your employer runs on, and it stays useful when that changes. It is meant for anyone writing infrastructure as code, and it checks that you understand Terraform's workflow from end to end.

It has eight domains, more than any other exam in this catalog. None of them goes especially deep; together they are wide. The failure mode is a candidate who is fluent in plan and apply and has never been asked about state locking or workspace management — and state is where most real Terraform incidents begin.

Modules, configuration, the core workflow, day-two maintenance and HCP Terraform all sit alongside state management, so a study plan built around the commands you type every day will leave gaps you cannot see from the inside. Checking each of the eight domains separately is the only reliable way to find out which of them you have actually covered.

The 8 TA-004 domains

Infrastructure as Code with Terraform
Terraform Fundamentals
Core Terraform Workflow
Terraform Configuration
Terraform Modules
Terraform State Management
Maintain Infrastructure with Terraform
HCP Terraform

HashiCorp does not publish how the exam weights its domains.

Infrastructure as Code with Terraform

3 questions

Question 1 of 25
What advantage does Terraform's state give over a tool that only issues API calls?
- A.It removes the need to authenticate against the target platform
- B.It stores the configuration files so they need not be committed
- C.It guarantees the infrastructure can never be changed elsewhere
- D.It records what is managed so changes can be planned and detectedCorrect
Answer: D
State is what enables planning, dependency tracking, and drift detection.
Question 2 of 25
Which capability lets Terraform manage resources from many different services?
- A.A translation layer converting HCL into each vendor's own language
- B.A built-in library covering every cloud service natively
- C.A single universal API endpoint shared by all cloud providers
- D.Provider plugins published for each service or platformCorrect
Answer: D
Providers are plugins that implement resources for a given platform.
Question 3 of 25
What does the concept of immutable infrastructure, often associated with IaC practices, generally favor?
- A.Manually patching servers one at a time rather than ever redeploying them
- B.Replacing a resource entirely with a new version rather than modifying it in placeCorrect
- C.A practice that has no actual relationship to how Terraform manages resources
- D.Modifying every resource in place indefinitely, never replacing it under any circumstance
Answer: B
Immutable infrastructure favors replacing resources wholesale (a new server instance, a new container image) over patching them in place, reducing configuration drift and making the actual running state easier to reason about.

Terraform Fundamentals

3 questions

Question 4 of 25
Where does Terraform download provider plugins during initialisation?
- A.From an environment variable set on the local machine
- B.From the configured registry into the working directoryCorrect
- C.From the module source referenced in the configuration
- D.From the state file recorded by the previous apply
Answer: B
init fetches providers from the registry into the working directory.
Question 5 of 25
What generally happens if a required provider's version constraint in a configuration cannot be satisfied?
- A.terraform init fails with an error explaining the version conflict, rather than silently proceedingCorrect
- B.Terraform automatically ignores the constraint and installs an arbitrary version instead
- C.The configuration proceeds normally as if no version constraint had been specified
- D.Terraform deletes the required_providers block permanently and continues
Answer: A
Terraform surfaces version constraint conflicts explicitly during init rather than silently picking an incompatible version, giving the operator a chance to resolve the mismatch deliberately.
Question 6 of 25
Why does Terraform need to maintain state rather than simply querying the target platform fresh on every run?
- A.State exists purely as a historical log with no functional role in plan or apply
- B.State lets Terraform map configuration to specific real-world objects and detect drift efficientlyCorrect
- C.Querying live infrastructure is always faster than reading a local state file
- D.Terraform is incapable of making any API calls to query a platform directly
Answer: B
State provides the mapping between configuration and actual resources (especially important since many resources don't have IDs derivable purely from configuration), and lets Terraform compute a plan efficiently without a full live query of everything on every run.

Core Terraform Workflow

4 questions

Question 7 of 25
A plan shows a resource will be replaced but the team expected an in-place update. What explains this?
- A.The changed argument forces a new resource in that providerCorrect
- B.The configuration was not formatted with terraform fmt first
- C.The provider version constraint was omitted from the configuration
- D.The state file was stored in a local rather than remote backend
Answer: A
Some arguments are immutable, so changing them forces replacement.
Question 8 of 25
What does terraform init do?
- A.Initializes a working directory, downloading providers and configuring the backendCorrect
- B.Deletes any existing state file before starting a fresh deployment
- C.Immediately provisions every resource declared in the configuration
- D.Formats the configuration files according to Terraform's canonical style
Answer: A
init prepares a working directory for use - installing provider plugins, initializing modules, and setting up the configured backend - a prerequisite before plan or apply can run.
Question 9 of 25
What does terraform init -upgrade do?
- A.Applies pending changes to the managed infrastructure
- B.Upgrades the Terraform binary to its newest release
- C.Re-evaluates version constraints and updates the lock fileCorrect
- D.Migrates the state file to a newer schema version
Answer: C
The upgrade flag lets provider and module selections move within constraints.
Question 10 of 25
What happens if terraform fmt is run against a directory whose files are already correctly formatted?
- A.The command always makes at least one cosmetic change regardless of prior formatting
- B.Every file is deleted and regenerated fresh from the current formatting rules
- C.Terraform reports an error, since formatting the same files twice is not permitted
- D.No files are modified, and the command reports no changes were neededCorrect
Answer: D
fmt is idempotent - running it against already-correctly-formatted files makes no changes and simply reports that nothing needed reformatting.

Terraform Configuration

5 questions

Question 11 of 25
What is the purpose of a locals block in Terraform?
- A.Defining named values computed once and reused throughout a configurationCorrect
- B.Declaring which provider versions a configuration is compatible with
- C.Exposing a value from the configuration to a parent module or the CLI
- D.Accepting external input values supplied by the user running Terraform
Answer: A
Locals let you compute or alias a value once (like combining several variables into a derived name) and reference it by a short name throughout the configuration, avoiding repeated expressions.
Question 12 of 25
A configuration must convert a list of objects into a map keyed by name. Which function family fits?
- A.Date functions such as timestamp evaluated at plan time
- B.Filesystem functions such as file reading an external source
- C.String functions such as join applied to the list elements
- D.Collection functions such as tomap combined with a for expressionCorrect
Answer: D
for expressions with collection functions reshape complex types.
Question 13 of 25
What does referencing var.example.attribute imply about the declared type of the example input variable?
- A.This syntax is invalid regardless of how the variable's type was declared
- B.The variable is expected to be an object (or similar structured type) with that attributeCorrect
- C.Attribute-style access only works for output values, never for input variables
- D.The variable must necessarily be declared using the primitive string type
Answer: B
Dot-notation attribute access implies the variable holds a structured value (like an object) with a defined attribute of that name - referencing it this way only works if the variable's type actually supports it.
Question 14 of 25
A module author wants to assert that a provisioned resource returns a healthy status before the module reports success. What fits?
- A.A precondition checking the input variables before the apply
- B.A postcondition checking the resource attribute after the applyCorrect
- C.A variable validation block on the module's input variable
- D.A lifecycle ignore_changes entry for the status attribute
Answer: B
Postconditions assert guarantees about a resource after it is created or updated.
Question 15 of 25
What does the lifecycle block's create_before_destroy setting change about how a resource is replaced?
- A.The replacement resource is created before the old one is destroyed, reducing downtimeCorrect
- B.It has no effect on resource replacement ordering, only on resource creation speed
- C.The old resource is always destroyed first, before any replacement is created
- D.It prevents the resource from ever being replaced under any configuration change
Answer: A
create_before_destroy flips the default destroy-then-create replacement order, creating the new resource first - useful for minimizing downtime on resources like load balancer target groups where a brief gap would otherwise be disruptive.

Terraform Modules

2 questions

Question 16 of 25
What does a module block's source argument specify?
- A.A human-readable description of the module with no functional effect
- B.The specific AWS Region the module's resources will be created in
- C.The exact version of Terraform itself required to run the module
- D.Where Terraform should retrieve the module's configuration fromCorrect
Answer: D
The source argument tells Terraform where to find the module's actual configuration - a local relative path, a registry address, a Git URL, and so on.
Question 17 of 25
What is a key difference between a private registry module and a public registry module?
- A.Public registry modules require a paid subscription, while private ones are free
- B.Private registry modules can never be versioned the way public ones are
- C.Private registry modules are scoped to and only visible within one organizationCorrect
- D.There is no actual functional difference between these two registry module types
Answer: C
A private registry (available within HCP Terraform, for example) hosts modules scoped to an organization's own internal use, versus the public registry's openly available, broadly shared modules.

Terraform State Management

3 questions

Question 18 of 25
Why might a large infrastructure codebase be deliberately split into several separate Terraform configurations, each with its own state, rather than one single combined configuration?
- A.Terraform technically enforces a hard limit on how many resources one state may contain
- B.Splitting configurations has no practical benefit over one single combined state file
- C.Smaller, focused states reduce blast radius and can be applied independentlyCorrect
- D.A single combined state file is always both faster and objectively safer to manage
Answer: C
Smaller states mean a mistake or a slow plan/apply in one area doesn't affect unrelated infrastructure, and different teams or components can be applied on independent schedules - a common reason for splitting by boundary (like networking vs application layers).
Question 19 of 25
What is a practical reason a team might want state stored remotely with encryption at rest, beyond simply enabling team collaboration?
- A.Encryption at rest is only relevant for application data, never for state files
- B.Remote storage has no security benefit at all compared to a local state file
- C.State files never contain anything worth protecting, regardless of storage location
- D.Protecting potentially sensitive resource attribute values the state file containsCorrect
Answer: D
Since state can contain sensitive attribute values, encrypting it at rest in remote storage (as most managed backends do by default) protects that data - a security consideration beyond just enabling shared team access.
Question 20 of 25
Why is the local backend generally unsuitable for a team collaborating on the same infrastructure?
- A.Local backend usage is technically restricted to a single named user account
- B.Local backend state files cannot be read by Terraform itself once written
- C.The local backend is incapable of storing any actual resource information at all
- D.State lives only on one machine, risking conflicts, loss, and no shared lockingCorrect
Answer: D
A locally stored state file isn't shared, isn't automatically backed up, and provides no locking mechanism to prevent two team members from running conflicting operations simultaneously - real risks for team use.

Maintain Infrastructure with Terraform

2 questions

Question 21 of 25
What generally happens if terraform import is run against a resource address that already has an object associated with it in state?
- A.Terraform reports an error, since import doesn't overwrite an already-tracked resource addressCorrect
- B.Import always succeeds silently regardless of any existing state at that address
- C.Both objects are merged together into a single combined resource entry in state
- D.The newly imported object silently and completely replaces the previous one in state
Answer: A
import expects the target resource address to be currently unmanaged - attempting to import into an address that's already associated with a tracked object produces an error rather than silently overwriting the existing association.
Question 22 of 25 · multiple response
Which of the following are appropriate uses of terraform state commands? (Select TWO)
- A.Removing a resource from management without destroying itCorrect
- B.Editing the state file's JSON directly in a text editor
- C.Storing application secrets for the deployed infrastructure
- D.Listing and inspecting the resources Terraform currently managesCorrect
Answers: A, D
State commands inspect and adjust management safely; manual editing is discouraged.

HCP Terraform

3 questions

Question 23 of 25
What is the relationship between organizations, projects, and workspaces in HCP Terraform?
- A.A workspace contains projects, and projects group organizations
- B.A project contains organizations, and organizations group workspaces
- C.All three terms describe the same container under different names
- D.An organization contains projects, and projects group workspacesCorrect
Answer: D
Projects group workspaces inside an organization, giving structure at scale.
Question 24 of 25
What generally happens to a run in HCP Terraform if it's manually discarded rather than confirmed after a plan completes?
- A.The proposed changes are not applied, and the workspace remains in its prior stateCorrect
- B.Discarding is not an available action once a plan has successfully completed
- C.The proposed changes are applied anyway, regardless of the discard action taken
- D.Discarding a run permanently deletes the workspace itself and all its history
Answer: A
Discarding a run explicitly declines to apply its proposed changes - the workspace's real infrastructure remains as it was, and a new run would need to be triggered to propose changes again.
Question 25 of 25
How does HCP Terraform typically trigger a run when using VCS-driven workflows?
- A.Runs can never be triggered automatically under any HCP Terraform configuration
- B.Exclusively through a manual button click, with no possible connection to version control
- C.Automatically, in response to a commit or pull request in the connected version control repositoryCorrect
- D.Only by a scheduled nightly job, regardless of any actual code changes made
Answer: C
VCS-driven workspaces automatically trigger a plan (and, depending on settings, an apply) when relevant commits or pull requests occur in the connected repository - integrating Terraform into a normal Git-based workflow.

20 more free after signup, then the full 400-question bank for $12.

Get 20 more free questions