Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Free Practice Exam Questions (2026 Updated)

This is the kind of configuration block that will create an infrastructure object with settings specified within the block. The other options are not used for creating infrastructure objects, but for configuring providers, accessing state data, or querying data sources.

This is what will happen if you run terraform apply in the working directory again, after removing the resource definition from your Terraform configuration file. Terraform will detect that there is a resource in the state file that is not present in the configuration file, and will assume that you want to delete it.

The key principle of infrastructure as code that is not listed among the options is golden images. Golden images are pre-configured, ready-to-use virtual machine images that contain a specific set of software and configuration. They are often used to create multiple identical instances of the same environment, such as for testing or production. However, golden images are not a principle of infrastructure as code, but rather a technique that can be used with or without infrastructure as code. The other options are all key principles of infrastructure as code, as explained below:

Self-describing infrastructure: This means that the infrastructure is defined in code that describes its desired state, rather than in scripts that describe the steps to create it. This makes the infrastructure easier to understand, maintain, and reproduce.

Idempotence: This means that applying the same infrastructure code multiple times will always result in the same state, regardless of the initial state. This makes the infrastructure consistent and predictable, and avoids errors or conflicts caused by repeated actions.

Versioned infrastructure: This means that the infrastructure code is stored in a version control system, such as Git, that tracks the changes and history of the code. This makes the infrastructure code reusable, auditable, and collaborative, and enables practices such as branching, merging, and rollback. References = [Introduction to Infrastructure as Code with Terraform], [Infrastructure as Code in a Private or Public Cloud]

This is a bad practice, as it exposes your credentials to anyone who can access your configuration files or state files. You should use environment variables, credential files, or other mechanisms to provide credentials to Terraform.

Rationale for Correct Answer: A Terraform configuration supports only one backend at a time. The backend determines where state is stored and how locking works. Terraform does not support writing the same state to multiple backends simultaneously via multiple backend blocks.

Analysis of Incorrect Options (Distractors):

A (True): Incorrect—Terraform allows only a single backend configuration for a given working directory/root module.

Key Concept: Single-backend design: one state location per configuration/workspace.

Rationale for Correct Answer: To expose values from a child module to a parent module, you define an output in the child module (e.g., output " public_ip " { value = aws_instance.example.public_ip }). The parent module can then reference it via module. < child_name > .public_ip.

Analysis of Incorrect Options (Distractors):

B: A data source in the parent could look up an instance, but that’s unnecessary and brittle compared to using module outputs (and may require extra identifiers).

C: Import is for bringing existing resources into state; it doesn’t expose attributes between modules.

D: Locals are only scoped within the module; they are not accessible from the parent.

Key Concept: Module composition: outputs are the contract for passing data from child to parent.

The -replace flag is used with the terraform apply command when there is a need to explicitly force Terraform to destroy and then recreate a specific resource during the next apply. This can be necessary in situations where a simple update is insufficient or when a resource must be re-provisioned to pick up certain changes.

The terraform import command is used to import existing infrastructure into your Terraform state. This command takes the existing resource and associates it with a resource defined in your Terraform configuration, updating the state file accordingly. It does not generate configuration for the resource, only the state.

Detailed Explanation:

Rationale for Correct Answer: In Terraform, data sources are referenced using the format:data. < DATA_SOURCE_TYPE > . < NAME > . < ATTRIBUTE >

In this case:

Data source type = aws_ami

Name = web

Attribute = id

Therefore, the correct reference is:

data.aws_ami.web.id

This follows Terraform syntax for accessing attributes from data sources, which is a key concept in configuration authoring.

Analysis of Incorrect Options (Distractors):

B. aws_ami.web.id Incorrect because this format is used for resources, not data sources.

C. web.id Incorrect because it omits both the data prefix and the resource type.

D. data.web.id Incorrect because it is missing the data source type (aws_ami).

Key Concept: Proper referencing of data sources using data. < type > . < name > . < attribute > syntax.

None of the above methods prevent credentials from being stored in the state file. Terraform stores the provider configuration in the state file, which may include sensitive information such as credentials. This is a potential security risk and should be avoided if possible. To prevent credentials from being stored in the state file, you can use one of the following methods:

Use environment variables to pass credentials to the provider. This way, the credentials are not part of the provider configuration and are not stored in the state file. However, this method may not work for some providers that require credentials to be set in the provider block.

Use dynamic credentials to authenticate with your cloud provider. This way, Terraform Cloud or Enterprise will request temporary credentials from your cloud provider for each run and use them to provision your resources. The credentials are not stored in the state file and are revoked after the run is completed. This method is supported for AWS, Google Cloud Platform, Azure, and Vault. References = : [Sensitive Values in State] : Authenticate providers with dynamic credentials

You should use the force-unlock command when automatic unlocking failed. Terraform will lock your state for all operations that could write state, such as plan, apply, or destroy. This prevents others from acquiring the lock and potentially corrupting your state. State locking happens automatically on all operations that could write state and you won’t see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the -lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn’t output a message, state locking is still occurring if your backend supports it. Terraform has a force-unlock command to manually unlock the state if unlocking failed. Be very careful with this command. If you unlock the state when someone else is holding the lock it could cause multiple writers. Force unlock should only be used to unlock your own lock in the situation where automatic unlocking failed. To protect you, the force-unlock command requires a unique lock ID. Terraform will output this lock ID if unlocking fails. This lock ID acts as a nonce, ensuring that locks and unlocks target the correct lock. The other situations are not valid reasons to use the force-unlock command. You should not use the force-unlock command if you have a high priority change, if apply failed due to a state lock, or if you see a status message that you cannot acquire the lock. These situations indicate that someone else is holding the lock and you should wait for them to finish theiroperation or contact them to resolve the issue. Using the force-unlock command in these cases could result in data loss or inconsistency. References = [State Locking], [Command: force-unlock]

This will trigger a run in the Terraform Cloud workspace, which will perform a plan and apply operation on the infrastructure defined by the Terraform configuration files in the VCS repository.

Rationale for Correct Answer: Marking a variable (or output) as sensitive = true primarily prevents Terraform from displaying the value in CLI output and in some UI contexts. It does not prevent the value from being stored in the state file if that value is used by resources. Terraform state must often store attribute values to track and manage infrastructure; sensitive marking is about redaction, not state omission.

Analysis of Incorrect Options (Distractors):

A (True): Incorrect—sensitive values can still be written to state; you must protect state storage (encryption, access control) and avoid storing secrets in state where possible.

Key Concept: Sensitive values are redacted in output, but still can exist in state.

B (terraform init)–Must be run firstto initialize the Terraform working directory, download providers, and configure the backend.

A (terraform apply)– Requires initialization first, so itcannotbe run before terraform init.

C (terraform plan)– Also requires terraform init first to generate a plan.

D (terraform show)– Displays the state,not relevantfor first-time deployment.

Official Terraform Documentation Reference:

terraform init - HashiCorp Documentation

Rationale for Correct Answer:

A (State versions and run history): HCP Terraform workspaces track state versions and maintain run history for auditability and rollback/reference—this is a hosted workflow feature beyond local-only Community Edition.

C (Variable sets): HCP Terraform provides variable sets to centrally manage and share Terraform/environment variables across multiple workspaces—Community Edition does not have this workspace-level managed feature.

D (Remote execution): HCP Terraform can execute plans/applies remotely in its managed runners, instead of requiring local execution.

Analysis of Incorrect Options (Distractors):

B: Not a standard “workspace feature” guaranteed as part of HCP Terraform workspaces in the same way as state/run history/remote runs/variables; security scanning depends on additional capabilities/policies/integrations rather than being the core baseline feature described here.

E: Storing configuration in VCS is not unique to HCP Terraform—you can store Terraform code in VCS with Community Edition as well. (HCP Terraform can integrate with VCS-driven workflows, but it doesn’t uniquely “store” your configuration.)

F: Terraform Community Edition also supports multiple cloud providers via providers; this is not exclusive to HCP Terraform.

Key Concept: Differences between local Terraform (Community Edition) and HCP Terraform workspace capabilities: remote runs, state history, centralized variables.

This will enable additional logging messages to find out from which paths Terraform is loading providers referenced in your Terraform configuration files, as it will set the log level to TRACE, which is the most verbose and detailed level.

This is the best time to run terraform validate, as it will check your code for syntax errors, typos, and missing arguments before you attempt to create a plan. The other options are either incorrect or unnecessary.

terraform apply can runwithout explicitly running terraform plan first.

Running terraform plan before apply isrecommendedbutnot mandatory.

If no plan file is provided, terraform applyautomatically creates and executes a planbefore applying changes.

Official Terraform Documentation Reference:

terraform apply - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer:Terraform requires provider aliases when you configure the same provider multiple times in one configuration. You must define the second AWS provider with an alias, then explicitly tell the resource to use it with the provider meta-argument:

provider " aws " {

region = " us-east-1 "

}

provider " aws " {

alias = " west "

region = " us-west-2 "

}

resource " aws_instance " " example_us_west_2 " {

provider = aws.west

ami = data.aws_ami.ubuntu.id

instance_type = " t3.micro "

}

This is a core Terraform objective: selecting the correct provider configuration for a resource when multiple instances exist.

Analysis of Incorrect Options (Distractors):

B: Incorrect. Provider blocks do not support the syntax provider " aws " " west " { ... }. Aliasing is done with alias = " west " .

C: Incorrect. You cannot invent a new provider type name like aws_west. The provider remains aws; you differentiate configurations via alias.

D: Incorrect. Terraform will not automatically choose between multiple provider configurations for the same provider; you must disambiguate using aliases and provider = ....

Key Concept:Provider aliases and the provider meta-argument for multi-region (or multi-account) deployments.