8 Terraform Associate Questions Most Candidates Get Wrong
Here are 8 multiple-choice questions designed to match the difficulty and style of the HashiCorp Terraform Associate exam.
Introduction: These questions cover core concepts including state management, CLI workflows, expressions, and provisioning strategies. Read each question carefully, as some options are designed to test common misconceptions. Good luck! Want to go further? 10 Databricks ML Associate Questions Most Candidates Get Wrong is a good next step.
Question 1
A team is managing a large infrastructure deployment. They want to ensure that if a terraform apply command is executed simultaneously by two different engineers, the second execution does not corrupt the state file or create conflicting resources. Which feature is specifically designed to prevent this scenario?
A. State file locking
B. Sentinel policies
C. Workspace isolation
D. Plan file hashing
Answer: A
Explanation: Terraform automatically locks the state file for all operations that could write to it (like apply or destroy). This prevents other team members from modifying the state concurrently, which could lead to corruption or lost updates. While workspaces help separate environments, they do not prevent concurrent writes to the same state file.
Question 2
A developer needs to reference the ID of an AWS subnet that was created by a separate Terraform configuration. The subnet ID is stored in a Terraform Cloud workspace. Which data source allows the developer to retrieve this value dynamically during the plan phase?
A. terraform_remote_state
B. http
C. aws_vpc
D. terraform_data
Answer: A
Explanation: The terraform_remote_state data source reads the latest state output from a specified backend (like Terraform Cloud or an S3 bucket). This allows you to extract output values from other configurations without hardcoding IDs. The other options are for fetching generic HTTP data, querying VPCs, or managing lifecycle-specific resources.
Question 3
While refactoring a module, a user changes the resource name from aws_instance.web to aws_instance.app. What is the most appropriate command to run to update the state file to reflect this rename without destroying and recreating the physical resource?
A. terraform refresh
B. terraform apply -replace="aws_instance.web"
C. terraform state mv
D. terraform import aws_instance.app i-1234567890 Our post on 10 AWS Cloud Practitioner Questions Most Candidates Get Wrong covers this further.
Answer: C
Explanation: The terraform state mv command is used to move an item in the state, which is perfect for renaming resources. It updates the address in the state file to match the new configuration, preserving the association with the real-world object. terraform refresh updates state attributes but does not change addresses, and import is for bringing existing infrastructure under management.
Question 4
A user wants to conditionally create a resource only when a specific variable is set to true. Which expression syntax allows them to define this conditional creation directly in the resource block?
A. count = var.create ? 1 : 0
B. for_each = var.create
C. lifecycle { create_before_destroy = var.create }
D. depends_on = [var.create]
Answer: A
Explanation: Using the conditional expression with count is the standard pattern for conditionally creating a resource. If the condition is true, the count is 1 (resource created); if false, the count is 0 (resource skipped). for_each requires a map or set, not a boolean, and the other options are not valid for conditional creation.
Question 5
A developer is using a module from the public Terraform Registry. They want to ensure that a specific version is used to prevent unexpected changes from upstream updates. Which argument within the source parameter or block handles this?
A. version
B. ref
C. registry
D. constraint
Answer: A
Explanation: For modules sourced from a registry, the version argument specifies a version constraint (e.g., ~> 1.2). This pins the module to a specific version or range, ensuring consistency across environments. The ref argument is for Git sources, and registry is not a valid argument in the source block.
Question 6
Which command sequence is required to provision infrastructure for the first time with a new configuration in a clean directory, ensuring the provider plugins are installed and the execution plan is reviewed?
A. terraform init and terraform plan
B. terraform validate and terraform apply You can explore this further in 10 AWS Advanced Networking Specialty Questions Most Candidates Get Wrong.
C. terraform fmt and terraform plan
D. terraform plan and terraform apply
Answer: A
Explanation: terraform init is mandatory before any other command in a new directory; it downloads the necessary provider plugins and initializes the backend. After initialization, terraform plan creates an execution plan to review what changes will be made. While validate and fmt are good practices, they do not install providers.
Question 7
A user has defined a variable as a list of strings. They want to iterate over this list to create multiple IAM users. Which meta-argument is the most appropriate to use for this task to ensure the users are indexed by their name rather than a numeric index?
A. count
B. for_each
C. dynamic
D. provider
Answer: B
Explanation: for_each is ideal for creating multiple instances of a resource from a set or map of strings. When used with a set, the each.key and each.value are the same, allowing you to name resources logically. count uses a numeric index, which is less readable and can cause issues if the list order changes.
Question 8
During a terraform apply, a resource successfully creates, but the subsequent resource in the configuration fails due to a transient network error. The user fixes the network issue and runs terraform apply again. What is the primary benefit of Terraform's state file in this scenario?
A. It deletes the failed resource automatically.
B. It knows the first resource already exists and will skip creating it again.
C. It changes the configuration to avoid the error.
D. It stores the error log for debugging.
Answer: B
Explanation: The state file maps configuration to real-world resources. On the second apply, Terraform compares the configuration to the state. It sees the first resource is already in the state and matches the config, so it only proceeds to create the failed second resource. This makes Terraform idempotent and efficient.
Closing Paragraph: These questions represent the critical thinking and practical knowledge required to pass the Terraform Associate exam. Remember to focus not just on the syntax, but on the why behind each feature, particularly around state management and workflow execution.
For a schedule that fits your available study time, use the free HashiCorp Certified: Terraform Associate study plan as you prepare.
Strengthen your weakest domains by targeting them in HashiCorp Certified: Terraform Associate mock test.
A free HashiCorp Certified: Terraform Associate readiness check gives you a quick read on which topics need more review.