How Terraform Associate Weights Its Domains, and Where to Spend Your Hours

Cloud certifications27 September 2026·7 min read·PractiseExam

How Terraform Associate Weights Its Domains, and Where to Spend Your Hours

The HashiCorp Terraform Associate exam (TA-003) is not a test of memorization—it’s a test of operational judgment. You won’t be asked to write a full configuration from scratch, but you will be asked to explain why a certain pattern is used, what happens when you run terraform plan, and how to recover from a state mismatch. To pass, you need to know exactly where the exam’s weight sits, what each domain actually tests, and which areas candidates consistently underestimate.

Below is a deep, domain-by-domain breakdown based on the official exam objectives, plus a strategic recommendation for where to invest your study hours. We recommend pairing this with How PL-300 Weights Its Domains, and Where to Spend Your Hours.

Domain 1: Infrastructure as Code (15% of exam)

What it tests: This domain is conceptual but not fluffy. It expects you to articulate the benefits of IaC, understand the difference between imperative and declarative approaches, and explain how Terraform fits into a broader configuration management ecosystem (e.g., Ansible, Chef, Puppet).

Top sub-topics:

Declarative vs. imperative provisioning
Benefits of IaC: consistency, versioning, reuse, reduced drift
Agentless vs. agent-based tools
Terraform’s place in the provisioning vs. configuration management spectrum

Most underestimated area: The distinction between provisioning (creating infrastructure) and configuration (installing software on that infrastructure). Many candidates confuse Terraform’s role with that of Ansible. Expect at least one question that forces you to choose which tool is appropriate for a given task.

One resource to master: The official HashiCorp “What is Infrastructure as Code?” documentation page. Read it twice. It contains the exact vocabulary the exam uses.

Domain 2: The Core Terraform Workflow (45% of exam)

What it tests: This is the beating heart of the exam. It covers the entire lifecycle: terraform init, terraform validate, terraform plan, terraform apply, and terraform destroy. But it’s not just about command syntax—it’s about understanding the state of the system, how providers are installed, and how to handle errors in a real-world workflow.

Top sub-topics:

The purpose and outcome of each CLI command
State: why we have it, how it’s stored, and how to manage it (local vs. remote)
Provider installation and version constraints
The difference between plan and apply, and when to use -auto-approve
Using terraform fmt and terraform validate for code quality

Most underestimated area: The terraform refresh command. It’s not in the main workflow anymore, but the exam still tests your understanding of how Terraform reconciles state with real infrastructure. Also, candidates frequently forget that terraform plan does not change infrastructure—it only reads. Expect a question that asks you to identify what a plan file contains (a binary state snapshot, not a human-readable diff). Another useful resource: How CKAD Weights Its Domains, and Where to Spend Your Hours.

One resource to master: The official “Terraform CLI Commands” documentation. Focus on the init, plan, and apply pages. Pay special attention to the -target flag and its risks—it appears more than you’d think.

Domain 3: Write and Modify Configuration (30% of exam)

What it tests: This is where you prove you can actually read and reason about Terraform code. You’ll be shown snippets of HCL and asked to predict outputs, identify errors, or choose the correct block structure. It’s not about writing from scratch—it’s about understanding syntax, expressions, and resource dependencies.

Top sub-topics:

Resource blocks: arguments, attributes, and meta-arguments (depends_on, count, for_each)
Data sources: when to use them vs. variables
Variables and outputs: type constraints, validation, and sensitivity
Expressions: references, functions, and conditional logic
Resource behavior: create_before_destroy, prevent_destroy, and lifecycle rules

Most underestimated area: The for_each vs. count distinction. The exam loves to test whether you know that count requires a known value at plan time, while for_each can work with maps of unknown keys. Also, candidates often overlook the sensitive = true argument on variables and outputs—it affects how values appear in logs and plan output.

One resource to master: The official “Terraform Language” documentation, specifically the “Expressions” and “Resources” pages. The “Meta-Arguments” section is gold—it covers depends_on, count, for_each, and provider blocks in detail.

If you would like a week-by-week schedule built around your exam date, the free HashiCorp Certified: Terraform Associate study plan lays one out for you.

Domain 4: Manage Resource Lifecycle (10% of exam)

What it tests: This domain is about the operational side of Terraform. It tests your ability to handle drift, upgrade providers, and troubleshoot common errors. It’s less about writing code and more about knowing what to do when things go wrong.

Top sub-topics:

Detecting and resolving drift (terraform plan vs. actual state)
Upgrading providers and managing version constraints
Understanding the state command (list, show, mv, rm)
Handling errors: “Resource already exists”, “Provider not found”, “State lock”

Most underestimated area: The terraform state subcommands. Many candidates know they exist but can’t recall the difference between mv and rm. The exam will give you a scenario where a resource was moved in code but not in state—you need to know that terraform state mv is the fix, not just re-running apply. Before moving on, consider reading How Google Cloud DevOps Engineer Weights Its Domains, and Where to Spend Your Hours.

One resource to master: The official “State” documentation. Specifically, the “Purpose of Terraform State” and “State Command” pages. Also, practice with the terraform state list and terraform state show commands locally—they’re the most likely to appear in scenario questions.

Domain 5: Using Terraform Cloud (10% of exam)

What it tests: Terraform Cloud (TFC) is now a core part of the exam, not an afterthought. This domain tests your understanding of remote state, remote runs, and the collaboration features that TFC provides. You don’t need to be a TFC admin, but you need to know what it does and why you’d use it.

Top sub-topics:

Remote state storage and locking
Remote runs (plan/apply in the cloud) vs. local runs
Workspaces: how they separate environments
Variable sets and environment variables
The difference between Terraform Cloud and Terraform Enterprise (licensing, not features)

Most underestimated area: The concept of run triggers and policy as code (Sentinel). Many candidates skip these because they’re not “core” Terraform, but the exam expects you to know that Sentinel policies can block a plan/apply before it happens. Also, be clear on the difference between a workspace (state + configuration) and a project (folder of workspaces).

One resource to master: The official “Terraform Cloud” documentation, specifically the “Workspaces” and “State” sections. The “Run Workflow” page is a must-read—it explains the queueing, planning, and applying stages in detail.

Where to Spend Your Hours: A Strategic Guide

If you have 40 hours to study, here’s how to allocate them:

20 hours on Domain 2 (Core Workflow). This is the highest-weight domain and the most common source of failure. Drill the command sequence until you can explain it in your sleep. Practice with plan and apply on a local provider (like null_resource or random) to see state changes in action.
10 hours on Domain 3 (Write and Modify Configuration). Focus on for_each, count, and lifecycle rules. These are the most testable sub-topics. Use the official docs to build small examples and predict outputs.
4 hours on Domain 1 (IaC Concepts). Read the docs, but don’t over-study. This is a “recognition” domain—you either know the terms or you don’t.
3 hours on Domain 5 (Terraform Cloud). Learn the workspace model and remote state. Don’t go deep into Sentinel syntax—just know what it does.
3 hours on Domain 4 (Lifecycle Management). Spend this on terraform state commands and drift detection. Practice with a broken state file to see how errors appear.

The most underestimated area across all domains: The concept of sensitive data and state file security. The exam will ask you where secrets live (in state, in plain text) and how to protect them (use remote state with encryption, avoid committing state to VCS). Many candidates miss this because they focus on syntax, not security.

Final Exam-Day Tips

Read every question twice. The exam often asks for the best answer, not the correct one—there will be two technically right options, but only one that matches Terraform’s recommended pattern.
Memorize the command order: init → validate → plan → apply. You’ll see this sequence in multiple questions.
Know the difference between terraform show (displays state or plan) and terraform output (displays output values only). This is a classic trick.

Prove your readiness to yourself — sit full-length HashiCorp Certified: Terraform Associate mock tests and review every rationale.

For a quick sense of where you stand, try the free HashiCorp Certified: Terraform Associate readiness check, with an explanation for every question.

HashiCorpHashiCorp Terraform AssociateblueprintCloud & AI

All posts Sit a full-length mock