Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Free Practice Exam Questions (2026 Updated)

terraform initdoes not create a main.tf file.

Itinitializesthe Terraform working directory, downloads provider plugins, and configures the backend.

Terraform does not generate an example configuration (main.tf); users must create it manually.

Official Terraform Documentation Reference:

terraform init - HashiCorp Documentation

Infrastructure as Code (IaC) provides several benefits, including the ability to version control infrastructure, reuse code, and automate infrastructure management. However, IaC is typically associated with declarative configuration files and does not inherently provide a graphical user interface (GUI). A GUI is a feature that may be provided by specific tools or platforms built on top of IaC principles but is not a direct benefit of IaC itself1.

References = The benefits of IaC can be verified from the official HashiCorp documentation on “What is Infrastructure as Code with Terraform?” provided by HashiCorp Developer1.

Rationale for Correct Answer: A parent/root module can only read values from a child module if the child module exports them via an output block. The error indicates vnet_id is not an exported output from module.my_network. Defining output "vnet_id" { value = ... } inside the networking (child) module makes module.my_network.vnet_id valid.

Analysis of Incorrect Options (Distractors):

A: Incorrect—Terraform does not use module..outputs.

; module outputs are referenced directly as module..

.

B: Incorrect—variables are inputs to a module, not values exported from it.

C: Incorrect—missing the module. prefix and still uses an invalid .outputs path.

Key Concept: Module outputs are the contract for exposing child module values to the root/parent.

The Terraform Registry allows any user to publish and share modules. Published modules support versioning, automatically generate documentation, allow browsing version histories, show examples and READMEs, and more. Public modules are managed via Git and GitHub, and publishing a module takes only a few minutes. Once a module is published, releasing a new version of a module is as simple as pushing a properly formed Git tag1.

References = The information can be verified from the Terraform Registry documentation on Publishing Modules provided by HashiCorp Developer1.

Rationale for Correct Answer: With immutable infrastructure, you don’t modify running servers/resources in place; you replace them with new versions built from a known image/artifact. This reduces configuration drift and “snowflake” issues, making deployments and rollbacks more predictable—often resulting in less operational complexity compared with troubleshooting in-place changes.

Analysis of Incorrect Options (Distractors):

A: Incorrect—immutable infrastructure specifically avoids in-place upgrades.

B: Not the best answer—upgrades can be fast in some setups, but “quicker” is not guaranteed; replacing infrastructure may take time depending on provisioning and rollout strategy.

C: Incorrect—immutability doesn’t inherently mean upgrades are “automatic”; automation is a separate practice/tooling choice.

Key Concept: Immutable vs mutable infrastructure; replace instead of modify to reduce drift and simplify operations.

You can configure Terraform to log to a file using the TF_LOG environment variable. This variable can be set to one of the log levels: TRACE, DEBUG, INFO, WARN or ERROR. You can also use the TF_LOG_PATH environment variable to specify a custom log file location. References = : Debugging Terraform

Rationale for Correct Answer (B):

Terraform uses a state file to map real-world resources to your configuration. By default, if no backend is explicitly defined, Terraform stores this information in a file named terraform.tfstate located in the same directory as your configuration files. This local state file is critical for Terraform to understand what infrastructure already exists and to plan updates correctly.

Analysis of Incorrect Options (Distractors):

A. .terraform.d (home directory subdirectory):

This is used for storing plugins and some global settings, not for resource state.

C. .terraform.lock.hcl (lock file):

This file locks provider versions to ensure reproducible runs, but it does not contain resource state information.

D. .terraform (subdirectory):

This folder contains cached provider binaries and related data, but not the actual state file.

Key Concept:

Terraform state management is at the core of "Implement and Maintain State." Understanding where Terraform stores the state by default is critical because state files should often be stored remotely (using a backend like S3, GCS, or Terraform Cloud) for collaboration and reliability.

You can develop a custom provider to manage its resources using Terraform, as Terraform is an extensible tool that allows you to write your own plugins in Go language. You can also publish your custom provider to the Terraform Registry or use it privately.

This is the variable type that you could use for this input, as it can store multiple attributes of different types within a single value. The other options are either invalid or incorrect for this use case.

When you use a remote backend that needs authentication, HashiCorp recommends that you:

This is how Terraform chooses which version of the provider to use, when you add a new resource to an existing Terraform configuration, but do not update the version constraint in the configuration. The lock file records the exact version of each provider that was installed in your working directory, and ensures that Terraform will always use the same provider versions until you run terraform init -upgrade to update them.

The reason why the apply fails after adding a new provider to the configuration and immediately running terraform apply in the CD using the local backend is because Terraform needs to install the necessary plugins first. Terraform providers are plugins that Terraform uses to interact with various cloud services and other APIs. Each provider has a source address that determines where to downloadit from. When Terraform encounters a new provider in the configuration, it needs to run terraform init first to install the provider plugins in a local directory. Without the plugins, Terraform cannot communicate with the provider and perform the desired actions. References = [Provider Requirements], [Provider Installation]

Rationale for Correct Answer:

A: The plan is stale because state changed after it was created. The correct fix is to recreate the plan against the latest state and apply that new plan.

B: Running terraform apply without specifying the old plan causes Terraform to re-plan using the current state and configuration, then apply the resulting changes.

Analysis of Incorrect Options (Distractors):

C: -lock=false disables locking; it does not make an old plan valid and is unsafe in team environments.

D: -refresh-only changes what’s recorded in state (when applied) but does not “unstale” an existing saved plan file.

E: terraform state push is for advanced/manual state management and does not update a saved plan file; using it here is inappropriate and risky.

Key Concept: Saved plans are tied to a specific state snapshot; if state changes, you must re-plan.

This is where Terraform saves resource state when using a remote backend or Terraform Cloud integration, as it allows you to store and manage your state file in a remote location, such as a cloud storage service or Terraform Cloud’s servers. This enables collaboration, security, and scalability for your Terraform infrastructure.

This is the Terraform style convention for indenting a nesting level compared to the one above it. The other options are not consistent with the Terraform style guide.

Rationale for Correct Answer: A major IaC advantage is declarative desired state: you describe what you want, and the tool figures out the necessary create/update/delete API calls to converge infrastructure to that end state. This reduces manual API orchestration and makes changes repeatable and reviewable.

Analysis of Incorrect Options (Distractors):

A: Incorrect—IaC reduces the need to write individual API calls; that’s the point.

B: Incorrect—IaC tools typically use provider plugins and APIs; efficiency is not about “calling CLI tools.”

C: Incorrect—IaC configurations define desired state; “current state” is discovered via refresh/state, not defined as the goal.

Key Concept: Declarative IaC: define end state, tool determines API actions.

Any user with permission to apply a plan can apply it, not only the user that generated it. This allows for collaboration and delegation of tasks among team members.

Terraform modules are referenced by specifying a source location. This location can be a URL or a file path. However, specifying query parameters such as ?version=vl.6.0 directly within the source path is not a valid or supported method for specifying a module version in Terraform. Instead, version constraints are specified using the version argument within the module block, not as part of the source string.References = This clarification is based on Terraform's official documentation regarding module usage, which outlines the correct methods for specifying module sources and versions.

Environment variables and connection configurations outside of Terraform are secure options for storing secrets for connecting to a Terraform remote backend. Environment variables can be used to set values for input variables that contain secrets, such as backend access keys or tokens. Terraform will read environment variables that start with TF_VAR_ and match the name of an input variable. For example, if you have an input variable called backend_token, you can set its value with the environment variable TF_VAR_backend_token1. Connection configurations outside of Terraform are files or scripts that provide credentials or other information for Terraform to connect to a remote backend. For example, you can use a credentials file for the S3 backend2, or a shell script for the HTTP backend3. These files or scripts are not part of the Terraform configuration and can be stored securely in a separate location. The other options are not secure for storing secrets. A variable file is a file that contains values for input variables. Variable files are usually stored in the same directory as the Terraform configuration or in a version control system. This exposes the secrets to anyone who can access the files or the repository. You should not store secrets in variable files1. Inside the backend block within the Terraform configuration is where you specify the type and settings of the remote backend. The backend block is part of the Terraform configuration and is usually stored in a version control system. This exposes the secrets to anyone who can access the configuration or the repository. You should not store secrets in the backend block4. References = [Terraform Input Variables]1, [Backend Type: s3]2, [Backend Type: http]3, [Backend Configuration]4