Hashicorp Terraform Associate Exam Guide

Infrastructure as Code

Which of the following is a key principle of infrastructure as code?

⬜ Versioned infrastructure
⬜ Golden images
✅ Idempotence
⬜ Self-describing infrastructure

Reference: https://learn.microsoft.com/en-us/devops/deliver/what-is-infrastructure-as-code

Which of the following best describes Terraform?

⬜ A programming language
✅ An infrastructure as code (IaC) tool
⬜ A cloud provider
⬜ A containerization tool

What are the main advantages to use Terraform as the IaC tool?

⬜ Terraform can manage infrastructure on multiple cloud platforms.
⬜ Terraform’s state allows you to track resource changes throughout your deployments.
⬜ You can commit your configurations to version control to safely collaborate on infrastructure.
✅ All of the above

Reference: https://developer.hashicorp.com/terraform/tutorials/aws-get-started/infrastructure-as-code

Does Terraform support multiple cloud providers?

✅ true
⬜ false

What are three Terraform Cloud features? (Choose 3 answers)

✅ Remote state management.
✅ Remote Terraform Execution.
✅ Private Module Registry.
⬜ Terraform Linting.

Reference: https://developer.hashicorp.com/terraform/cloud-docs/overview

What is the core terraform workflow?

⬜ Plan, write, apply.
✅ Write, plan, apply.
⬜ Apply, write, plan.
⬜ Apply, plan, write.

Reference: https://developer.hashicorp.com/terraform/intro/core-workflow

Your boss has asked you to come up with a new cloud automation provider that supports a Private Module registry as part of the offering. Which Cloud Provider and plan do you choose?

✅ Terraform Cloud with a Terraform Enterprise
⬜ Amazon Web Services and the Enterprise Terraform Plus Plan
⬜ The Azure Supercharged Automation Professional Direct plan from Microsoft
⬜ The Google GCP Terraform Deluxe Plan

Reference: https://developer.hashicorp.com/terraform/cloud-docs/registry

Terraform Configuration

Which file is typically used to define resources in a Terraform configuration?

✅ main.tf
⬜ terraform.tfvars
⬜ variables.tf
⬜ outputs.tf

Which of the following is NOT a valid Terraform block type?

⬜ provider
⬜ resource
⬜ output
⬜ module
⬜ data
✅ bucket

What is the workflow for deploying new infrastructure with Terraform?

⬜ terraform plan to import the current infrastructure to the state file, make code changes, and terraform apply to update the infrastructure.
⬜ Write a Terraform configuration, run terraform show to view proposed changes, and terraform apply to create new infrastructure.
⬜ terraform import to import the current infrastructure to the state file, make code changes, and terraform apply to update the infrastructure.
✅ Write a Terraform configuration, run terraform init, run terraform plan to view planned infrastructure changes, and terraform apply to create new infrastructure.

Which language does terraform configuration support from the below list?

⬜ XML
✅ JSON
✅ Hashicorp Configuration Language (HCL)
⬜ YAML

Reference: https://developer.hashicorp.com/terraform/language/syntax

What Terraform feature is most applicable for managing small differences between different environments, for example development and production?

✅ Workspaces
⬜ States
⬜ Repositories
⬜ Versions

Reference: https://developer.hashicorp.com/terraform/language/state/workspaces

What’s the correct syntax for referencing a resource within the configuration file?

✅ <RESOURCE TYPE>.<NAME>
⬜ <NAME>.<RESOURCE TYPE>
⬜ <PROVIDER>.<RESOURCE TYPE>
⬜ <LOCAL/REMOTE STATE>.<RESOURCE TYPE>

Reference: https://developer.hashicorp.com/terraform/cli/state/resource-addressing#resource-spec

Terraform State

Which of the following best describes a Terraform state file?

⬜ A file that contains a list of available Terraform providers
✅ A file that stores the current state of infrastructure managed by Terraform
⬜ A file that contains a list of Terraform modules used in a configuration
⬜ A file that stores the output of a Terraform plan

The terraform.tfstate file always matches your currently built infrastructure?

⬜ true
✅ false

Reference: https://developer.hashicorp.com/terraform/language/state

Usernames and passwords referenced in the Terraform code, even as variables, will end up in plain text in the state file?

✅ true
⬜ false

You injected some secrets from variables into your Terraform configuration. What happens after you run the terraform apply command and they are loaded into state?

✅ They are shown in clear-text.
⬜ They are shown as their referenced variables.
⬜ They are shown as encrypted values.
⬜ They are omitted from state.

Terraform state can contain sensitive data, depending on the resources in use and your definition of “sensitive.” The state contains resource IDs and all resource attributes. For resources such as databases, this may contain initial passwords.
Reference: https://developer.hashicorp.com/terraform/language/state/sensitive-data

What is the name of the default file where Terraform stores the state?

Type your answer in the field provided. The text field is not case-sensitive and all variations of the correct answer are accepted.

✅ terraform.tfstate

Reference: https://developer.hashicorp.com/terraform/language/state

Where is the default location that Terraform stores its state in?

✅ The current working directory in which Terraform is ran.
⬜ At the users root directory.
⬜ In the same location that Terraform is installed. E.g. /usr/bin/terraform
⬜ In ~/.terraform.d/plugins

In the default configuration, Terraform stores the state in a file in the current working directory where Terraform was run.
Reference: https://developer.hashicorp.com/terraform/language/state/purpose#syncing

Where are Terraform Workspace state files stored?

✅ terraform.tfstate.d
⬜ terraform.tfstate
⬜ .tfstate
⬜ ~/.terraform.d/plugins

Reference: https://developer.hashicorp.com/terraform/cli/workspaces#workspace-internals

What is the recommended way to implement Terraform’s state for larger teams?

✅ By configuring a remote backend such that multiple teams can work in tandem and know which resources are being created and destroyed.
⬜ By sticking the state in a cloud instance, and having team members SSH into the instance to work on their configuration files.
⬜ Having your state synced to a github repo for members to compare to.
⬜ By using the daily standup you are a part of sot that you can share changes to the state file.

Remote state is the recommended solution to this problem. With a fully-featured state backend, Terraform can use remote locking as a measure to avoid two or more different users accidentally running Terraform at the same time, and thus ensure that each Terraform run begins with the most recent updated state.
Reference: https://developer.hashicorp.com/terraform/language/state/purpose#syncing

You are part of a large DevOps team using the current version of Terraform, and there can be multiple changes going on to your terraform files across the company. What would you do to ensure that the state file is locked when you run terraform apply?

⬜ Add the -lock=true flag to the command.
✅ Nothing, terraform will manage the locking by itself.
⬜ First run terraform plan to lock in your proposed changes. Then run terraform apply to commit them.
⬜ Add the -state-lock=true to the command.

State locking happens automatically on all operations that could write state. You won’t see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the -lock flag but it is not recommended.
Reference: https://developer.hashicorp.com/terraform/language/state/locking

Terraform Commands

What command does Terraform require the first time you run it within a configuration directory?

⬜ terraform plan
⬜ terraform apply
✅ terraform init
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/init

How can you init a directory with a specific source?

✅ terraform init -from-module={MODULE-SOURCE}
⬜ terraform init -source={PATH}
⬜ terraform init {PATH}
⬜ terraform init -plugin-dir={PATH}

Reference: https://developer.hashicorp.com/terraform/cli/commands/init#copy-a-source-module

Which command is used to create an execution plan in Terraform?

✅ terraform plan
⬜ terraform apply
⬜ terraform init
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/plan

By default, when running ’terraform plan’, what files are scanned?

✅ *All .tf files in the current directory.
⬜ Only files in the .terraform directory
⬜ Only files you specify with the -file-path flag.
⬜ All files on your hard drive.

Reference: https://developer.hashicorp.com/terraform/cli/commands/plan

Which command is used to apply changes to infrastructure in Terraform?

⬜ terraform destroy
✅ terraform apply
⬜ terraform plan
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/apply

Which command is used to destroy infrastructure in Terraform?

✅ terraform destroy
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/destroy

If different teams are working on the same configuration. How do you make files to have consistent formatting?

✅ terraform fmt
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/fmt

What Terraform command modifies a HashiCorp Configuration Language (HCL) file to adhere to the recommended spacing rules for HCL files?

✅ terraform fmt
⬜ terraform apply
⬜ terraform plan
⬜ terraform validate

Reference: https://developer.hashicorp.com/terraform/cli/commands/fmt

Your teammate is worried that if they run the terraform fmt command on their current directory, it will change their configuration files too much. What flag do you tell them to pass into the command such that they can see the differences?

✅ -diff
⬜ -check
⬜ -refresh
⬜ -list=true

Reference: https://developer.hashicorp.com/terraform/cli/commands/fmt#diff

Which command can be used to verify whether a configuration is syntactically valid and internally consistent?

✅ terraform validate
⬜ terraform apply
⬜ terraform plan
⬜ terraform fmt

Reference: https://developer.hashicorp.com/terraform/cli/commands/validate

How would you get the JSON output of the terraform validate command?

✅ terraform validate -json
⬜ terraform validate json
⬜ terraform validate -output=json
⬜ terraform json validate

When you use the -json option, Terraform will produce validation results in JSON format to allow using the validation result for tool integrations, such as highlighting errors in a text editor.
Reference: https://developer.hashicorp.com/terraform/cli/commands/validate#json-output-format

Does the validate command connect to remote APIs and state when being ran?

✅ No it does not.
⬜ Only if configured to do so on the backend.
⬜ If the -remote=true is set, yes it does.
⬜ If there are providers set, it will attempt to.

Reference: https://developer.hashicorp.com/terraform/cli/commands/validate

Which command provides an interactive command-line console for evaluating and experimenting with expressions?

⬜ terraform show
⬜ terraform eval
✅ terraform console
⬜ terraform exec

Reference: https://developer.hashicorp.com/terraform/cli/commands/console

Which command is used to extract the value of an output variable from the state file?

⬜ terraform exec
⬜ terraform show
✅ terraform output
⬜ terraform state

Reference: https://developer.hashicorp.com/terraform/cli/commands/output

When are output variables ran and sent to stdout?

✅ Only with terraform apply.
⬜ Only on terraform plan or apply.
⬜ With any terraform command.
⬜ Only if you specify the -outputs flag on apply.

Reference: https://developer.hashicorp.com/terraform/language/values/outputs

You have defined the values for your variables in the file terraform.tfvars, and saved it in the same directory as your Terraform configuration. Which of the following commands will use those values when creating an execution plan?

⬜ terraform plan
⬜ terraform plan -var-file=terraform.tfvars
✅ All of the above
⬜ None of the above

Reference: https://developer.hashicorp.com/terraform/cli/commands/plan

Which two steps are required to provision new infrastructure in the Terraform workflow? Choose TWO correct answers.

✅ terraform init
⬜ terraform import
✅ terraform apply
⬜ terraform validate
⬜ terraform destroy

Reference: https://developer.hashicorp.com/terraform/intro/core-workflow

You have an EC2 instance that is acting up in the cloud. It handles a relatively light ephemeral workload, so it can be restarted/destroyed with no repercussions. What full command would you use to target only this instance for recreation?

✅ terraform apply -replace=aws_instance.{INSTANCE_NAME}
⬜ terraform apply -replace aws_instance
⬜ terraform apply -replace {INSTANCE_NAME}
⬜ terraform destroy --target=aws.instance{INSTANCE_NAME} and terraform apply

Reference: https://developer.hashicorp.com/terraform/cli/commands/plan#replace-address

You would like to reuse the same Terraform configuration for your development and production environments with a different state file for each. Which command would you use?

⬜ terraform import
✅ terraform workspace
⬜ terraform state
⬜ terraform init

Reference: https://developer.hashicorp.com/terraform/cli/commands/workspace

One of your colleagues is new to Terraform and wants to add a new workspace named new-hire. What command he should execute from the following?

⬜ terraform workspace –new –new-hire
✅ terraform workspace new new-hire
⬜ terraform workspace init new-hire
⬜ terraform workspace new-hire

As a prestigious Sr. Cloud Engineer, your colleague comes up to you and asks for a new Development workspace. What’s the fastest way to accomplish this?

✅ **terraform workspace new dev
⬜ Head to the Terraform Enterprise console and create a new workspace there.
⬜ Specify in the configuration block the new workspace to be created.
⬜ Have them submit a Jira ticket and tell them you’ll get around to it in the next Sprint.

How does terraform import run?

⬜ As a part of terraform init
⬜ As a part of terraform plan
⬜ As a part of terraform refresh
✅ By an explicit call
⬜ All of the above

Reference: https://developer.hashicorp.com/terraform/tutorials/state/state-import

What must be provided with the terraform import command for Terraform to successfully import resources?

✅ Resource Id, module path, and the resource spec.
⬜ The resource name.
⬜ The full resource ARN.
⬜ Only resource Id

Import will find the existing resource from ID and import it into your Terraform state at the given ADDRESS. ID is dependent on the resource type being imported. For example, for AWS instances it is the instance ID (i-abcd1234) but for AWS Route53 zones it is the zone ID (Z12ABC4UGMOZ2N). ADDRESS must be a valid resource address which is made up of two parts: [module path][resource spec]
Reference: https://developer.hashicorp.com/terraform/cli/commands/import

A user wants to list all resources which are deployed using Terraform. How can this be done?

⬜ terraform state show
✅ terraform state list
⬜ terraform show
⬜ terraform show list

Reference: https://developer.hashicorp.com/terraform/cli/commands/state/list

Which terraform state subcommand will give you all of the resources in your state?

✅ list
⬜ show
⬜ refresh
⬜ apply

Reference: https://developer.hashicorp.com/terraform/cli/commands/state/list

A user wants to see the resource block for resource aws_instance having name foo in state file. How can this be done?

⬜ terraform show aws_instance.foo
⬜ terraform show aws_instance foo
✅ terraform state show aws_instance.foo
⬜ terraform state show aws_instance foo

Reference: https://developer.hashicorp.com/terraform/cli/commands/state/show

Which of the following command provides the JSON reprentation of the state?

⬜ terraform state -json
⬜ terraform state show -json
✅ terraform show -json
⬜ terraform show state -json

Reference: https://developer.hashicorp.com/terraform/cli/commands/show

Why would you use the terraform taint command?

⬜ When you want to force Terraform to destroy a resource on the next apply
✅ When you want to force Terraform to destroy and recreate a resource on the next apply
⬜ When you want Terraform to ignore a resource on the next apply
⬜ When you want Terraform to destroy all the infrastructure in your workspace

Reference: https://developer.hashicorp.com/terraform/cli/commands/taint

The command terraform.taint is deprecated in v0.15.2, which command you should use intead?

✅ terraform apply -replace
⬜ terraform plan -replace
⬜ terraform apply -taint
⬜ terraform plan -taint

Reference: https://developer.hashicorp.com/terraform/cli/commands/taint

What is not processed when running a terraform refresh?

⬜ State file
✅ Configuration file
⬜ Credentials
⬜ Cloud provider

Reference: https://developer.hashicorp.com/terraform/cli/commands/refresh

Which of the following Terraform commands will automatically refresh the state unless supplied with additional flags or arguments? Choose TWO correct answers.

✅ terraform plan
⬜ terraform state
✅ terraform apply
⬜ terraform validate
⬜ terraform output

Reference: https://developer.hashicorp.com/terraform/cli/commands/refresh

The command terraform refresh is deprecated in v0.15.4, which command is recommended to use instead? Choose TWO correct answers.

✅ terraform apply -refresh-only
✅ terraform plan -refresh-only
⬜ terraform apply -refresh
⬜ terraform plan -refresh

Reference: https://developer.hashicorp.com/terraform/cli/commands/refresh

Which of the following command will give you an opportunity to review the changes that Terraform has detected during refresh? Choose TWO correct answers.

⬜ terraform apply -refresh-only -auto-approve
✅ terraform apply -refresh-only
⬜ terraform refresh
✅ terraform plan -refresh-only

Reference: https://developer.hashicorp.com/terraform/cli/commands/refresh

What happens when you apply Terraform configuration? Choose TWO correct answers.

✅ Terraform makes any infrastructure changes defined in your configuration.
⬜ Terraform gets the plugins that the configuration requires.
✅ Terraform updates the state file with any configuration changes it made.
⬜ Terraform corrects formatting errors in your configuration.
⬜ Terraform destroys and recreates all your infrastructure from scratch.

Which flag is used to find more information about a Terraform command? For example, you need additional information about how to use the plan command. You would type: terraform plan _____.

Type your answer in the field provided. The text field is not case-sensitive and all variations of the correct answer are accepted.

✅ -h
✅ -help
✅ --help

Answers that would also receive full credit:
--h
terraform plan -h
terraform plan --h
terraform plan -help
terraform plan --help
terraform -h plan
terraform -help plan
terraform --help plan
plan -h
plan --h
plan -help
plan --help
-h plan
-help plan
--help plan

Which flag would you add to terraform plan to save the execution plan to a file? You would type: terraform plan _____

Type your answer in the field provided. The text field is not case-sensitive and all variations of the correct answer are accepted.

✅ -out=FILENAME

Reference: https://developer.hashicorp.com/terraform/cli/commands/plan#out-filename

You just added a new set of resources to your configuration and would only like to see them when you run your terraform plan command. What flag do you specify when running the plan command to only see their plans?

✅ -target={resources}
⬜ -refresh=true
⬜ -state={new_state_file}
⬜ -lock=true

You can use the -target option to focus Terraform’s attention on only a subset of resources. You can use resource address syntax to specify the constraint
Reference: https://developer.hashicorp.com/terraform/cli/commands/plan#resource-targeting

You have a simple Terraform configuration containing one virtual machine (VM) in a cloud provider. You run terraform apply and the VM is created successfully. What will happen if you delete the VM using the cloud provider console, and run terraform apply again without changing any Terraform code?

⬜ Terraform will remove the VM from state file
⬜ Terraform will report an error
⬜ Terraform will not make any changes
✅ Terraform will recreate the VM

You have multiple team members collaborating on infrastructure as code (IaC) using Terraform, and want to apply formatting standards for readability.How can you format Terraform HCL (HashiCorp Configuration Language) code according to standard Terraform style convention?

✅ Run the terraform fmt command during the code linting phase of your CI/CD process
⬜ Designate one person in each team to review and format everyone’s code
⬜ Manually apply two spaces indentation and align equal sign “=” characters in every Terraform file (*.tf)
⬜ Write a shell script to transform Terraform files using tools such as AWK, Python, and sed

You have deployed a new webapp with a public IP address on a clod provider. However, you did not create any outputs for your code. What is the best method to quickly find the IP address of the resource you deployed?

✅ Run terraform output ip_address to view the result
⬜ In a new folder, use the terraform_remote_state data source to load in the state file, then write an output for each resource that you find the state file
⬜ Run terraform state list to find the name of the resource, then terraform state show to find the attributes including public IP address
⬜ Run terraform destroy then terraform apply and look for the IP address in stdout

Reference: https://developer.hashicorp.com/terraform/cli/commands/output

What is the default number of concurrent operations supported by terraform apply command?

⬜ 100
✅ 10
⬜ 5
⬜ 1

Reference: https://developer.hashicorp.com/terraform/cli/commands/apply#parallelism-n

Say you wanted to increase the number of operations that terraform is concurrently using to create your resources. Which command would you run, with what specific flag, to accomplish this? (Choose 2 answers)

✅ terraform apply
✅ -parallelism={NUMBER-OF-OPERATIONS}
⬜ terraform init
⬜ -concurrent={NUMBER-OF-OPERATIONS}

Reference: https://developer.hashicorp.com/terraform/cli/commands/apply#parallelism-n

Lately you noticed that your Terraform jobs are failing in your CI/CD pipeline. The error that is coming back mentions something about hitting a rate limit. Without altering the time that the builds are ran, what could you pass into the terraform apply command to slow your operations down?

✅ -parallelism={NUMBER_OF_OPERATIONS}
⬜ -concurrent={NUMBER_OF_OPERATIONS}
⬜ -rate-limit={NUMBER_OF_OPERATIONS}
⬜ -refresh=false

Reference: https://developer.hashicorp.com/terraform/cli/commands/apply#parallelism-n

Terraform Backend

What does the default “local” Terraform backend store?

⬜ tfplan files
⬜ Terraform binary
⬜ Provider plugins
✅ State file

Reference: https://developer.hashicorp.com/terraform/language/settings/backends/local

What two configuration variables are available to a default local backend? (Choose 2 answers)

✅ path
✅ workspace_dir
⬜ working_dir
⬜ path_dest

path and workspace_dir are two optional configuration supported by local backend
Reference: https://developer.hashicorp.com/terraform/language/settings/backends/local#configuration-variables

What is not true about the Terraform backend?

⬜ A backend is where Terraform stores its state data files.
⬜ By default, Terraform uses a backend called local, which stores state as a local file on disk.
⬜ A terraform configuration can only provide one backend block.
✅ A backend block can refer to named values (like input variables, locals, or data source attributes).

Reference: https://developer.hashicorp.com/terraform/language/settings/backends/configuration

terraform {
  backend "s3" {
    bucket = "mybucket"
    key    = "path/to/my/key"
    region = "us-east-1"
  }
}

provisioner "local-exec" {
  when    = destroy
  command = "echo 'Destroy-time provisioner'"
}

resource "aws_vpc" "main" {
    name = "test"
}

provider "provider_name" {
  ...
}

# The default provider configuration
provider "aws" {
  region = "us-east-1"
}
# Additional provider configuration for west coast region
provider "aws" {
  alias  = "west"
  region = "us-west-2"
}

resource "google_computer_instance" "main" {
    name = "test"
}

data "aws_ami" "ubuntu" {
  ...
}

resource "aws_instance" "web" {
  ami           = ______________________
  instance_type = "t3.micro"
}

variable "vpc_cidrs" {
  type = map
  default = {
    us-east-1 = "10.0.0.0/16"
    us-east-2 = "10.1.0.0/16"
    us-west-1 = "10.2.0.0/16"
    us-west-2 = "10.3.0.0/16"
  }
}

resource "aws_vpc" "shared" {
  cidr_block = _____________
}

variable "num" {
 default = 3
}

export TF_VAR_num=10

num = 7

terraform apply -var num=4

module "consul" {
  source = "hashicorp/consul/aws"
  version = "0.1.0"
}

module "consul" {
  source = "hashicorp/consul/aws" #<NAMESPACE>/<NAME>/<PROVIDER>
  version = "0.1.0"
}

terraform {
  required_providers {
    mycloud = {
      source  = "mycorp/mycloud"
      version = "~> 1.0.4"
    }
  }
}

provider "google" {
  version = "~> 1.9.0"
}