HashiCorp Certified: Terraform Associate (004) practice questions

Question 1 · Infrastructure as Code (IaC) with Terraform

Brightmoor Logistics currently builds its staging network by hand in the cloud console, and each rebuild produces slightly different security group rules. The platform lead wants rebuilds to produce byte-identical results and wants the definition reviewed in pull requests. Which property of an Infrastructure as Code approach with Terraform most directly delivers this?

1. A.The infrastructure definition is codified in version-controlled files, so the same committed configuration produces the same resource set on every run
2. B.Terraform encrypts the credentials used during provisioning so different operators cannot produce different results
3. C.Terraform connects to the cloud console session and records the operator's clicks into a replayable transcript
4. D.Terraform installs an agent on each provisioned machine that continuously repairs configuration drift in real time

Question 2 · Terraform fundamentals

A new repository at Larkfield Systems contains the snippet below. A colleague asks what the `~> 5.40` constraint permits. ```hcl terraform { required_providers { dandelion = { source = "dandelion-cloud/dandelion" version = "~> 5.40" } } } ``` Which provider versions satisfy this constraint?

1. A.Any 5.x version at or above 5.40, but not 6.0.0 or later
2. B.Any 5.40.x patch release, but not 5.41.0
3. C.Only version 5.40.0 exactly
4. D.Any version at or above 5.40, including 6.x and 7.x

Question 3 · Core Terraform workflow

Pipeline policy at Selwyn Freight requires that the change a human approves is exactly the change that gets executed, with no re-evaluation between approval and execution. Which command sequence satisfies this?

1. A.`terraform plan` in one stage, then `terraform apply -auto-approve` in the approved stage
2. B.`terraform show` in one stage, then `terraform apply -target` for each listed resource
3. C.`terraform apply -refresh=false` in a single stage after a manual gate
4. D.`terraform plan -out=change.tfplan` in one stage, then `terraform apply change.tfplan` in the approved stage

Question 4 · Terraform configuration

Nadia must guarantee that the environment name callers pass into her configuration is one of three approved values, and she wants a clear error at plan time rather than a confusing downstream failure. Which construct should she add?

1. A.```hcl locals { environment = contains(["dev", "stage", "prod"], var.environment) } ```
2. B.```hcl output "environment" { value = var.environment precondition = contains(["dev", "stage", "prod"], var.environment) } ```
3. C.```hcl variable "environment" { type = string allowed = ["dev", "stage", "prod"] } ```
4. D.```hcl variable "environment" { type = string validation { condition = contains(["dev", "stage", "prod"], var.environment) error_message = "environment must be dev, stage, or prod." } } ```

Question 5 · Terraform modules

Wrenlow Retail wants to consume a community-maintained networking module from the public Terraform Registry and pin it so that unreviewed major releases cannot enter a build. Which module block does this?

1. A.```hcl module "network" { source = "https://registry.terraform.io/acme-labs/network/nimbus" version = "4.2" } ```
2. B.```hcl module "network" { source = "acme-labs/network/nimbus" required_version = "~> 4.2" } ```
3. C.```hcl module "network" { source = "acme-labs/network/nimbus" version = "~> 4.2" } ```
4. D.```hcl module "network" { source = "acme-labs/network/nimbus@4.2" } ```

Question 6 · Terraform state management

Two engineers at Ashgrove Utilities both keep a local `terraform.tfstate` copy and have already overwritten each other's changes once. Which change most directly prevents recurrence for a shared environment?

1. A.Run every apply with `-refresh=false` so remote drift cannot overwrite local state
2. B.Configure a remote backend that supports state locking so concurrent operations are serialized
3. C.Have each engineer use a separate local state file for the same environment
4. D.Add the state file to version control so merge conflicts surface the overlap

Question 7 · Maintain infrastructure with Terraform

Compliance at Merribeck Freight wants a nightly job that reports whether any managed infrastructure has been changed outside Terraform, without modifying anything. Which command best serves as the detection step?

1. A.`terraform plan -refresh-only`, checking whether the plan is empty
2. B.`terraform validate`, checking the exit code
3. C.`terraform state pull`, comparing the file against the previous night's copy
4. D.`terraform apply -auto-approve`, checking the change count in the output

Question 8 · HCP Terraform

Sable Grove Media connects a repository to HCP Terraform and sets the workspace execution mode to remote. Where do plan and apply operations run, and where is the state stored?

1. A.Operations run on HCP Terraform, but state must still be configured with a separate object storage backend
2. B.Operations run on the developer's workstation, and only the resulting state is uploaded to HCP Terraform
3. C.Operations run on a self-hosted agent that the organization must always provide before remote mode works
4. D.Operations run on HCP Terraform's managed infrastructure, and state is stored and versioned by HCP Terraform