Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Free Practice Exam Questions (2026 Updated)

Environment variables and connection configurations outside of Terraform are secure options for storing secrets for connecting to a Terraform remote backend. Environment variables can be used to set values for input variables that contain secrets, such as backend access keys or tokens. Terraform will read environment variables that start with TF_VAR_ and match the name of an input variable. For example, if you have an input variable called backend_token, you can set its value with the environment variable TF_VAR_backend_token1. Connection configurations outside of Terraform are files or scripts that provide credentials or other information for Terraform to connect to a remote backend. For example, you can use a credentials file for the S3 backend2, or a shell script for the HTTP backend3. These files or scripts are not part of the Terraform configuration and can be stored securely in a separate location. The other options are not secure for storing secrets. A variable file is a file that contains values for input variables. Variable files are usually stored in the same directory as the Terraform configuration or in a version control system. This exposes the secrets to anyone who can access the files or the repository. You should not store secrets in variable files1. Inside the backend block within the Terraform configuration is where you specify the type and settings of the remote backend. The backend block is part of the Terraform configuration and is usually stored in a version control system. This exposes the secrets to anyone who can access the configuration or the repository. You should not store secrets in the backend block4. References = [Terraform Input Variables]1, [Backend Type: s3] 2, [Backend Type: http] 3, [Backend Configuration]4

Detailed Explanation:

Rationale for Correct Answer:Terraform import (including the newer import block workflow) needs:

A: the target resource address (e.g., aws_db_instance.main or module.db.aws_db_instance.main) where Terraform should map the existing remote object into state, and

C: the provider-specific import ID that uniquely identifies the existing database in the provider (for AWS RDS, Azure, GCP, etc. each has a defined import ID format).These are the two required pieces to tell Terraform what to import and where to place it in state.

Analysis of Incorrect Options (Distractors):

B: Incorrect. Terraform does not require a file path; it loads configuration from the working directory. What matters is the resource address exists in the configuration, not where it is located.

D: Incorrect. Platform/version may be relevant to configuring the resource correctly afterward, but it is not required to create the import mapping.

E: Incorrect. Terraform providers typically authenticate using configured credentials, not a “connection string” for importing. Import IDs are used instead.

Key Concept:Importing existing resources: mapping remote object ID to a Terraform resource address in state.

Detailed Explanation:

Rationale for Correct Answer:

A is correct because Terraform may replace (destroy and recreate) resources when changes cannot be applied in-place. This behavior depends on the provider and resource type (e.g., immutable infrastructure changes).

B is correct because terraform apply operates on the configuration in the current working directory and uses the currently selected workspace, which determines the state being modified.

Analysis of Incorrect Options (Distractors):

C. You must pass the output of a terraform plan command to it. Incorrect because passing a saved plan file is optional. Running terraform apply without a plan will generate and apply a plan automatically.

D. By default, it does not refresh your state file. Incorrect because Terraform does refresh state by default before applying changes (unless explicitly disabled).

E. You cannot target specific resources. Incorrect because you can use the -target flag to apply changes to specific resources.

Key Concept:Behavior of terraform apply, including execution scope, state refresh, and resource lifecycle (create/update/replace).

Setting the TF_LOG environment variable to DEBUG causes debug messages to be logged into stdout, along with other log levels such as TRACE, INFO, WARN, and ERROR. This can be useful for troubleshooting or debugging purposes.

Detailed Explanation:

Rationale for Correct Answer: terraform init installs and updates modules used by a Terraform configuration. After changing a module version constraint or version number, you must run terraform init so Terraform downloads the selected module version.

Analysis of Incorrect Options (Distractors):

B. terraform modules. Incorrect. There is no standard Terraform CLI command named terraform modules.

C. terraform plan. Incorrect. plan creates an execution plan but does not install updated module packages.

D. terraform apply. Incorrect. apply applies planned infrastructure changes, but module installation must be handled during initialization first.

Key Concept: Terraform modules are installed and updated during initialization.

Terraformis written in Go, but it isdistributed as a standalone binaryanddoes notrequire the Go runtime.

Users do not need to install Go to run Terraform.

Official Terraform Documentation Reference:

Terraform Install Guide

Terraform allows usingprivate module sourceshosted in:

C (Internally hosted VCS platforms, e.g., GitLab, Bitbucket, GitHub Enterprise)✅

D (Private GitHub repositories)✅

A (Public GitHub repository)❌–GitHubis supported, but apublic repo is not " private " .

B (Public Terraform Registry)❌–The public registryis not a private source.

Official Terraform Documentation Reference:

Terraform Module Sources

The name of the default file where Terraform stores the state is terraform.tfstate. This file contains a JSON representation of the current state of the infrastructure managed by Terraform. Terraform uses this file to track the metadata and attributes of the resources, and to plan and apply changes. By default, Terraform stores the state file locally in the same directory as the configuration files, but it can also be configured to store the state remotely in a backend. References = [Terraform State], [State File Format]

Rationale for Correct Answer: The Terraform import block (used with configuration-driven import) must specify:

id: the resource ID from the provider (the remote object identifier).

to: the target resource address in your configuration (where the imported object should map in state, e.g., aws_s3_bucket.example).These are the essential inputs Terraform needs to associate an existing remote object with a resource address in state.

Analysis of Incorrect Options (Distractors):

B (Provider): Not required as a parameter in the import block. Provider selection is determined by the configuration/provider setup (and optionally by provider meta-arguments on the resource), not by a required import block field.

D (Backend): Backends configure state storage and are set in the terraform block, unrelated to the import block’s required arguments.

Key Concept: Configuration-driven import requires mapping an existing remote object (id) to a resource address (to).

Terraform is built on a plugin-based architecture, enabling developers to extend Terraform by writing new plugins or compiling modified versions of existing plugins1. Terraform plugins are executable binaries written in Go that expose an implementation for a specific service, such as a cloud resource, SaaS platform, or API2. If there is no existing provider for your API, you can create one using the Terraform Plugin SDK3 or the Terraform Plugin Framework4. References =

•1: Plugin Development - How Terraform Works With Plugins | Terraform | HashiCorp Developer

•2: Lab: Terraform Plug-in Based Architecture - GitHub

•3: Terraform Plugin SDK - Terraform by HashiCorp

•4: HashiCorp Terraform Plugin Framework Now Generally Available

Running terraform fmt without any flags in a directory with Terraform configuration files will not check the formatting of those files without changing their contents, but will actually rewrite them to a canonical format and style. If you want to check the formatting without making changes, you need to use the -check flag.

The two steps that are required to provision new infrastructure in the Terraform workflow are init and apply. The terraform init command initializes a working directory containing Terraform configuration files. It downloads and installs the provider plugins that are needed for the configuration, and prepares the backend for storing the state. The terraform apply command applies the changes required to reach the desired state of the configuration, as described by the resource definitions in the configuration files. It shows a plan of the proposed changes and asks for confirmation before making any changes to the infrastructure. References = [The Core Terraform Workflow], [Initialize a Terraform working directory with init] , [Apply Terraform Configuration with apply]

Terraform can call modules from various sources including the public Terraform Registry, private registries, local file paths, or version control systems like GitHub.

D

Rationale for Correct Answer:A check block in Terraform is used to validate conditions and provide warnings or errors, but it does not block the execution of the operation by default. Failed checks will report issues, but Terraform continues execution unless explicitly configured otherwise. Therefore, the statement is false.

Analysis of Incorrect Options (Distractors):

A. True — Incorrect because checkwith*

Key Concept:Check blocks are used for validation and observability but do not enforce execution blocking like preconditions or postconditions.

These are some of the ways that a ticket-based system can slow down infrastructure provisioning and limit the ability to scale, as they introduce delays, bottlenecks, and manual interventions in the process of creating and modifying infrastructure.

Detailed Explanation:

Rationale for Correct Answer:

A: IaC enables a plan/review workflow (for Terraform: terraform plan) where changes can be inspected and approved before applying, reducing accidental outages.

E: Declarative IaC helps reduce configuration drift because desired state is defined in code and Terraform continuously reconciles differences during plans/applies (drift becomes visible and correctable).

Analysis of Incorrect Options (Distractors):

B: Incorrect. Auto-scaling is a capability of specific platforms/services (e.g., AWS ASG), not a guaranteed property of IaC.

C: Incorrect. IaC reduces the chance of mistakes, but it does not make incorrect configurations impossible—bad code can still be applied.

D: Incorrect. Zero-downtime updates require architecture and deployment strategies (blue/green, rolling updates, etc.); IaC alone doesn’t guarantee it.

Key Concept:Reliability improvements from IaC: reviewable change plans and reduced drift through declarative desired state.

The terraform import command is not part of any other Terraform workflow. It must be explicitly invoked by the user with the appropriate arguments, such as the resource address and the ID of the existing infrastructure to import. References = [Importing Infrastructure]

You should run terraform fmt to rewrite all Terraform configurations within the current working directory to conform to Terraform-style conventions. This command applies a subset of the Terraform language style conventions, along with other minor adjustments for readability. It is recommended to use this command to ensure consistency of style across different Terraform codebases. The command is optional, opinionated, and has no customization options, but it can help you and your team understand the code more quickly and easily. References = : Command: fmt : Using Terraform fmt Command to Format Your Terraform Code

Not all standard backend types support state locking and remote operations like plan, apply, and destroy. For example, the local backend does not support remote operations and state locking. State locking is a feature that ensures that no two users can make changes to the state file at the same time, which is crucial for preventing race conditions. Remote operations allow running Terraform commands on a remote server, which is supported by some backends like remote or consul, but not all.