Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Free Practice Exam Questions (2026 Updated)

Detailed Explanation:

Rationale for Correct Answer:Module input variables are set by providing arguments in the module block whose names match the module’s declared variables. Since the module expects servers, you pass it directly as servers = 3. This is the standard Terraform module input pattern.

Analysis of Incorrect Options (Distractors):

A: Incorrect. var.servers is how you reference an input variable in expressions, not how you assign a module input. Module inputs are set as arguments, not through the var. namespace.

B: Incorrect. Terraform module blocks do not use an inputs = { ... } argument (that pattern is common in some other tools, but not Terraform).

D: Incorrect. inputs.servers is not valid HCL syntax for setting module input arguments.

Key Concept:Passing input variables to modules by setting arguments on the module block.

The execution plan for terraform apply will not be the same as the one you ran locally with terraform plan, if your teammate manually modified the infrastructure component you are working on. This is because Terraform will refresh the state file before applying any changes, and will detect any differences between the state and the real resources.

Rationale for Correct Answer:A Terraform resource block has the following structure:

resource " < RESOURCE TYPE > " " < RESOURCE NAME > " {

}

In the exhibit:

Resource type: azurerm_resource_group

Resource name: dev

The resource name is the second label in the resource block and is used internally by Terraform to reference the resource (e.g., azurerm_resource_group.dev).

Analysis of Incorrect Options (Distractors):

A. azurerm: This is the provider name, not the resource name.

B. azurerm_resource_group: This is the resource type, not the name.

D. test: This is the value of the name argument inside the resource, not the Terraform resource name.

Key Concept:Understanding the distinction between resource type, resource name, and resource arguments in Terraform configurations.

Rationale for Correct Answer: Remote state storage is configured using a backend block, which lives inside the top-level terraform block (for example, terraform { backend " s3 " { ... } }). Backends control where Terraform stores state (local vs remote), locking, and related settings—this is squarely in the Terraform configuration’s global settings area, not in resources or providers.

Analysis of Incorrect Options (Distractors):

A (The resource block): Resources define infrastructure objects (e.g., servers, buckets). They do not configure where Terraform stores state.

B (The provider block): Providers configure how Terraform talks to an API (credentials/regions/features). They don’t define state storage.

C (The data block): Data sources read existing infrastructure; they are unrelated to backend/state storage configuration.

Key Concept: Backends and remote state configuration using terraform { backend ... }.

Detailed Explanation:

Rationale for Correct Answer:Run triggers in HCP Terraform allow you to automatically initiate runs in one workspace based on changes in another workspace. In this scenario, when the networking workspace is updated, a run trigger ensures that the compute workspace automatically runs plan and apply, keeping dependent infrastructure in sync.

Analysis of Incorrect Options (Distractors):

B. Policy — Incorrect because policies (e.g., Sentinel) enforce rules and compliance but do not trigger runs between workspaces.

C. Run tasks — Incorrect because run tasks integrate external tools into the Terraform workflow (e.g., security scanning), not for chaining workspace executions.

D. Projects — Incorrect because projects are used for organizing workspaces, not for triggering operations.

Key Concept:Run triggersandIn in HCP Terraform.

To output returned values from a child module in the Terraform CLI output, you need to declare the output in both the child module and the root module. The child module output will return the value to the root module, and the root module output will display the value in the CLI. References = [Terraform Outputs]

Some backends support state locking, which prevents other users from modifying the state file while a Terraform operation is in progress. This prevents conflicts and data loss. Not all backends support this feature, and you can check the documentation for each backend type to see if it does.

This is not true, as modules can be either public or private, depending on your needs and preferences. You can use the Terraform Registry to publish and consume public modules, or use Terraform Cloud or Terraform Enterprise to host and manage private modules.

A secure string is not a valid option to keep secrets out of Terraform configuration files. A secure string is a feature of AWS Systems Manager Parameter Store that allows you to store sensitive data encrypted with a KMS key. However, Terraform does not support secure strings natively and requires a custom data source to retrieve them. The other options are valid ways to keep secrets out of Terraform configuration files. A Terraform provider can expose secrets as data sources that can be referenced in the configuration. Environment variables can be used to set values for input variables that contain secrets. A -var flag can be used to pass values for input variables that contain secrets from the command line or a file. References = [AWS Systems Manager Parameter Store], [Terraform AWS Provider Issue #55] , [Terraform Providers], [Terraform Input Variables]

Infrastructure as Code (IaC) refers to managing infrastructureprogrammatically, enabling automation and repeatability.

Ais incorrect becauseIaC is not just about software delivery pipelines; it specifically deals with infrastructure.

Bis incorrect because " Write once, run anywhere " applies more to software development than IaC.

Dis incorrect becauseIaC does not enforce vendor-agnostic APIs; it depends on the tool and provider.

Official Terraform Documentation Reference:

What is Infrastructure as Code?

Rationale for Correct Answer:terraform destroy removes all resources currently tracked in the Terraform state file by issuing destroy requests to the configured providers. It does not delete configuration files or providers themselves.

Analysis of Incorrect Options (Distractors):

B: Terraform never deletes configuration files.

C: Terraform only destroys resources it manages, not all provider infrastructure.

D: Terraform does not delete the state file by default.

Key Concept:terraform destroy enforces removal of all managed infrastructure.

You can install third party plugins using terraform init, as long as you specify the plugin directory in your configuration or as a command-line argument. You can also use the terraform providers mirror command to create a local mirror of providers from any source.

From the official Terraform Type Constraints Documentation:

The object({ name = string, age = number }) type expects:

name to be aquoted string, e.g. " John "

age to be anumber, e.g. 52

Option Bsatisfies both:

{

name = " John " #✅Valid string

age = 52 #✅Valid number

}

Let ' s analyze the incorrect ones:

❌Option A: " fifty two " is not a valid number.

❌Option C: John is unquoted (invalid string), and " fifty two " is not a number.

❌Option D: name = John is not quoted, making it an invalid string in HCL.

Terraform is strict about type and formatting. Stringsmust be quoted, and numbersmust be numeric literals.

The description argument for Terraform variables and outputs is purely for documentation purposes and isnotstored in the Terraform state file.

Terraform variables and outputs can have descriptions for readability and clarity in .tf files.

However, these descriptions are not retained in the Terraform state file.

The state file only stores actual values and references needed for resource management, not metadata such as descriptions.

Official Terraform Documentation Reference:

Terraform Variables - HashiCorp Documentation

Terraform Outputs - HashiCorp Documentation

Rationale for Correct Answer: terraform plan creates and displays an execution plan showing what Terraform would change, add, or destroy to reach the desired state—this is the standard preview step before applying changes.

Analysis of Incorrect Options (Distractors):

A: terraform show displays a human-readable view of an existing state or plan file; it doesn’t compute proposed changes by itself.

C: terraform validate checks configuration syntax and internal consistency, not proposed infrastructure changes.

D: terraform get downloads modules; it doesn’t preview infrastructure changes.

Key Concept: Previewing changes with plan in the Terraform workflow.

This is where Terraform cannot load a provider from, as it requires a compiled binary file that implements the provider protocol. You can load a provider from a plugins directory, a provider plugin cache, or the official HashiCorp distribution on releases.hashicorp.com.

This command will initialize the new backend and prompt you to migrate the existing state file to the new location3. The other commands are not relevant for this task.

Detailed Explanation:

Rationale for Correct Answer:The terraform validate command checks whether the Terraform configuration is syntactically valid and internally consistent, but it does not check runtime state, enforce formatting preferences, or require all optional blocks to exist. None of the listed scenarios will cause terraform validate to fail:

Terraform does not require a variable block unless a variable is referenced incorrectly.

Tabs vs. spaces are formatting concerns handled by terraform fmt, not validate.

State drift is not checked by validate.

Analysis of Incorrect Options (Distractors):

A. The state file does not match the current infrastructure. Incorrect because terraform validate does not compare state with real infrastructure; that is handled during plan or apply.

B. The code contains tabs for indentation instead of spaces. Incorrect because formatting issues are handled by terraform fmt, not validate.

C. There is a missing variable block. Incorrect because Terraform does not require variable blocks unless variables are declared and improperly referenced. Simply missing a variable block is not a validation error.

Key Concept:terraform validate checks syntax and internal consistency, not formatting, runtime state, or infrastructure drift.

Detailed Explanation:

Rationale for Correct Answer: The resource group is declared as a data source, so its name is referenced with data.azurerm_resource_group.example.name. Appending -vnet creates the required virtual network name. Option A correctly produces a string such as my-resource-group-vnet.

Analysis of Incorrect Options (Distractors):

B. Incorrect. concat() is used to concatenate lists, not strings.

C. Incorrect. join() expects a separator and a list of strings, such as join( " - " , [var.resource_group_name, " vnet " ]). The syntax shown is invalid.

D. Incorrect. This references a managed resource named azurerm_resource_group.example, but the exhibit shows a data source named data.azurerm_resource_group.example.

Key Concept: Referencing data source attributes and using string interpolation/concatenation in Terraform expressions.