Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Free Practice Exam Questions (2026 Updated)

Referencing Terraform Built-in Functions:

✅chomp: removes trailing newlines

✅join: combines list into string

✅split: splits string into list

❌slice:is nota valid Terraform string function (it ' s used in other languages like Python)

Detailed Explanation:

Rationale for Correct Answer: The terraform init command is used to initialize a working directory containing Terraform configuration files. It performs tasks such as downloading providers, initializing backends, and setting up modules. It does not create any configuration files, including main.tf. Users must create .tf files manually.

Analysis of Incorrect Options (Distractors):

A. True Incorrect because Terraform does not automatically generate configuration files during initialization. It only prepares the environment for execution.

Key Concept: Understanding the role of terraform init in initializing the working directory, not generating configuration files.

Detailed Explanation:

Rationale for Correct Answer: To bring existing infrastructure under Terraform management, Terraform needs both a matching resource block in the configuration and an import declaration or import command that maps the real cloud object to the Terraform resource address. With modern configuration-driven import, you add an import block and a corresponding resource block, then run Terraform to import the object into state.

Analysis of Incorrect Options (Distractors):

A. Pick the two correct responses below. Incorrect. This is an instruction, not an action.

B. Run terraform state pull. Incorrect. This only downloads and displays the current state. It does not import existing cloud resources.

E. Run terraform apply -refresh-only. Incorrect. Refresh-only updates Terraform state for resources already managed in state. It does not import unmanaged VMs.

Key Concept: Existing infrastructure must be imported into Terraform state and represented in Terraform configuration before Terraform can manage it.

Detailed Explanation:

Rationale for Correct Answer:Terraform requires provider aliases when you configure the same provider multiple times in one configuration. You must define the second AWS provider with an alias, then explicitly tell the resource to use it with the provider meta-argument:

provider " aws " {

region = " us-east-1 "

}

provider " aws " {

alias = " west "

region = " us-west-2 "

}

resource " aws_instance " " example_us_west_2 " {

provider = aws.west

ami = data.aws_ami.ubuntu.id

instance_type = " t3.micro "

}

This is a core Terraform objective: selecting the correct provider configuration for a resource when multiple instances exist.

Analysis of Incorrect Options (Distractors):

B: Incorrect. Provider blocks do not support the syntax provider " aws " " west " { ... }. Aliasing is done with alias = " west " .

C: Incorrect. You cannot invent a new provider type name like aws_west. The provider remains aws; you differentiate configurations via alias.

D: Incorrect. Terraform will not automatically choose between multiple provider configurations for the same provider; you must disambiguate using aliases and provider = ....

Key Concept:Provider aliases and the provider meta-argument for multi-region (or multi-account) deployments.

The execution plan for terraform apply will not be the same as the one you ran locally with terraform plan, if your teammate manually modified the infrastructure component you are working on. This is because Terraform will refresh the state file before applying any changes, and will detect any differences between the state and the real resources.

Detailed Explanation:

Rationale for Correct Answer: terraform force-unlock should be used only when Terraform’s normal automatic unlocking has failed and you are sure no other Terraform process is actively using the state. It manually removes a stale lock.

Analysis of Incorrect Options (Distractors):

A. When terraform apply has failed due to a state lock. Incorrect. A lock error alone does not justify force unlocking. Another valid Terraform operation may still be running.

B. When you have a high-priority change. Incorrect. Urgency is not a valid reason to bypass state locking safeguards.

D. When you see a status message stating that Terraform cannot acquire the lock. Incorrect. This may simply mean another run is active. You should investigate before using force-unlock.

Key Concept: Force unlocking is a recovery action for stale locks, not a normal operational shortcut.

This is the scenario that poses a challenge for this team, if they adopt AWS CloudFormation as their standardized method for provisioning public cloud resources, as CloudFormation only supports AWS services and resources, and cannot be used to provision infrastructure on other cloud platforms such as Azure.

To make Terraform ' s logging more verbose for troubleshooting purposes, you must configure the TF_LOG environment variable. This variable controls the level of logging and can be set to TRACE, DEBUG, INFO, WARN, or ERROR, with TRACE providing the most verbose output.References = Detailed debugging instructions and the use of environment variables like TF_LOG for increasing verbosity are part of Terraform ' s standard debugging practices

You should run terraform init after you start coding a new Terraform project and before you run terraform plan for the first time. This command will initialize the working directory by downloading the required providers and modules, creating the initial state file, and performing other necessary tasks. References = : Initialize a Terraform Project

Detailed Explanation:

Rationale for Correct Answer: Terraform supports detailed logging through the TF_LOG environment variable. Setting TF_LOG=TRACE enables the most verbose logging level, which includes detailed information about provider installation, plugin loading paths, and execution steps. This is the correct way to debug how Terraform is resolving and loading providers.

Analysis of Incorrect Options (Distractors):

A. TF_VAR_log=TRACE Incorrect because TF_VAR_ is used to pass input variables into Terraform, not to control logging.

B. TF_LOG_PATH Incorrect because this variable only specifies where logs are written, not the logging level itself. It must be used in combination with TF_LOG.

D. Set verbose logging for each provider in your Terraform configuration. Incorrect because Terraform does not support configuring provider-level logging directly in .tf files; logging is controlled globally via environment variables.

Key Concept: Using TF_LOG environment variable to enable Terraform debug and trace logging.

To output returned values from a child module in the Terraform CLI output, you need to declare the output in both the child module and the root module. The child module output will return the value to the root module, and the root module output will display the value in the CLI. References = [Terraform Outputs]

Rationale for Correct Answer: A Terraform configuration supports only one backend at a time. The backend determines where state is stored and how locking works. Terraform does not support writing the same state to multiple backends simultaneously via multiple backend blocks.

Analysis of Incorrect Options (Distractors):

A (True): Incorrect—Terraform allows only a single backend configuration for a given working directory/root module.

Key Concept: Single-backend design: one state location per configuration/workspace.

Detailed Explanation:

Rationale for Correct Answer: The resource group is declared as a data source, so its name is referenced with data.azurerm_resource_group.example.name. Appending -vnet creates the required virtual network name. Option A correctly produces a string such as my-resource-group-vnet.

Analysis of Incorrect Options (Distractors):

B. Incorrect. concat() is used to concatenate lists, not strings.

C. Incorrect. join() expects a separator and a list of strings, such as join( " - " , [var.resource_group_name, " vnet " ]). The syntax shown is invalid.

D. Incorrect. This references a managed resource named azurerm_resource_group.example, but the exhibit shows a data source named data.azurerm_resource_group.example.

Key Concept: Referencing data source attributes and using string interpolation/concatenation in Terraform expressions.

Rationale for Correct Answer: terraform plan -refresh-only refreshes (reconciles) the state with the real infrastructure only for the purpose of the plan output. It does not persist (write) those updates to the state file. To actually update the stored state, you must run terraform apply -refresh-only (or a normal terraform apply). This matches the Terraform CLI objective: plan previews changes; apply makes changes (including writing state).

Analysis of Incorrect Options (Distractors):

A (True): Incorrect because terraform plan does not write state; it only calculates and displays what would change.

Key Concept: The plan vs apply workflow and when Terraform writes state.

In Terraform, the max function can be used to select the largest number from a list of numbers. The max function takes multiple arguments and returns the highest one. For the list numcpus = [18, 3, 7, 11, 2], using max(numcpus...) will return 18, which is the largest number in the list.

You cannot access state stored with the local backend by using the terraform_remote_state data source. The terraform_remote_state data source is used to retrieve the root module output values from some other Terraform configuration using the latest state snapshot from the remote backend. It requires a backend that supports remote state storage, such as S3, Consul, AzureRM, or GCS. The local backend stores the state file locally on the filesystem, which terraform_remote_state cannot access.

 To tell Terraform to stop managing a specific resource without destroying it, you can use the terraform state rm command. This command will remove the resource from the Terraform state, which means that Terraform will no longer track or update the corresponding remote object. However, the object will still exist in the remote system and you can later use terraform import to start managing it again in a different configuration or workspace. The syntax for this command is terraform state rm < address > , where  < address >  is the resource address that identifies the resource instance to remove. For example, terraform state rm aws_instance.ubuntu[1] will remove the second instance of the aws_instance resource named ubuntu from the state. References = : Command: state rm : Moving Resources

Importing Existing Resources: Theterraform importcommand brings resources already deployed in a cloud environment into Terraform’s state file, allowing Terraform to manage them.

Workflow Usage: Importing is vital when managing resources created outside of Terraform or those in place before Terraform adoption.

Refer to Terraform’s import command documentation.

Terraform detects infrastructure drift by comparing thestate filewith the actual infrastructure.

When an instance ismanually deleted, Terraformsees it as missingand marks it for recreation.

Running terraform apply willonly recreate the missing instanceswhile leaving the rest of the infrastructure unchanged.

Explanation of incorrect answers:

A (Tear down everything and rebuild)– Incorrect. Terraform does not destroy existing infrastructure unless explicitly told to.

B (Build a completely new set of infrastructure)– Incorrect. Terraform does not create duplicates unless configuration changes.

D (Stop and error out)– Incorrect. Terraform does not fail; itrebuilds missing resourcesautomatically.

Official Terraform Documentation Reference:

Handling Infrastructure Drift