I85PREP
⌘ K
Terraform Associate study materials
Terraform Associate study resources

Terraform Associate practice questions

One question at a time. Build your Terraform Associate understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Infrastructure as Code (IaC) with Terraform

What is the main purpose of Terraform state?

  1. To keep a version control history of every configuration change made
  2. To cache plan output so that teammates can reuse it later
  3. To track which real infrastructure objects each declared resource represents Correct answer.
  4. To store the provider credentials used during the most recent apply run

Explanation

State is Terraform's record of the objects it created and the attribute values it last observed, keyed by resource address. Every plan compares configuration against this record to decide what to create, update, or delete. Credentials and version history live elsewhere, not in state.

Question 2Infrastructure as Code (IaC) with Terraform

Which command initializes a working directory by downloading the required providers and modules?

  1. terraform plan
  2. terraform validate
  3. terraform init Correct answer.
  4. terraform apply

Explanation

terraform init prepares a working directory: it installs provider plugins, downloads referenced modules, and configures the backend. It must be run before plan or apply in a new directory or after changing provider or module requirements.

Question 3Infrastructure as Code (IaC) with Terraform

Why is Terraform described as a declarative tool?

  1. Because it only reads existing infrastructure and never changes it
  2. Because it requires you to write ordered steps for each resource
  3. Because you describe the end state and Terraform derives the actions Correct answer.
  4. Because it records every command you run in a script file

Explanation

In a declarative model you write the desired end state of the infrastructure, and Terraform computes an ordered set of actions from the dependency graph. You do not script the individual creation steps. This is what makes the same configuration idempotent across repeated runs.

Question 4Infrastructure as Code (IaC) with Terraform

What does terraform plan do?

  1. It validates the provider credentials against the remote platform API
  2. It applies the configuration immediately without asking for approval
  3. It previews the changes needed to reach the desired state Correct answer.
  4. It deletes every resource that is currently recorded in the state file

Explanation

terraform plan refreshes known objects, compares them with the configuration, and prints the actions it would take. It does not modify infrastructure. The resulting plan can be saved and later applied.

Question 5Infrastructure as Code (IaC) with Terraform

What is a Terraform provider?

  1. A file that stores the current state of managed infrastructure
  2. A plugin that manages resources through a platform API Correct answer.
  3. A script that runs on a new server after it is created
  4. A module published in the public registry of reusable configurations

Explanation

A provider is a plugin that maps resource types and data sources onto the API of a target platform, such as a cloud or a SaaS service. Providers are installed by terraform init and declared with source and version requirements.

Question 6Infrastructure as Code (IaC) with Terraform

Which command removes all objects managed by the current configuration?

  1. terraform init -upgrade
  2. terraform state rm
  3. terraform destroy Correct answer.
  4. terraform plan

Explanation

terraform destroy plans and then deletes every object tracked in state for the current configuration, after confirmation. It is equivalent to planning with a destroy flag and applying the result.

Question 7Infrastructure as Code (IaC) with Terraform

What is a Terraform module?

  1. A file that records the provider version constraints
  2. A command-line flag that groups plan output by resource
  3. A single resource block with no dependencies
  4. A reusable set of configuration files in a directory Correct answer.

Explanation

A module is any directory containing Terraform configuration files, and it becomes reusable when called from another configuration with a module block. The root configuration is itself a module. Modules can be local paths or downloaded from a registry.

Question 8Infrastructure as Code (IaC) with Terraform

Which block declares an input variable named region?

  1. variable "region" { default = "us-east-1" } Correct answer.
  2. locals { region = "us-east-1" }
  3. provider "region" { value = "us-east-1" }
  4. output "region" { value = "us-east-1" }

Explanation

The variable block declares an input that a caller can supply, with an optional default. References use var.region. Outputs, locals, and providers use different block types and serve different purposes.

Question 9Infrastructure as Code (IaC) with Terraform

Why is state locking important when a backend supports it?

  1. It keeps a backup of each previous state version automatically
  2. It compresses the state file before uploading it to the backend
  3. It encrypts the state file so that operators cannot read resource attributes
  4. It stops two runs from writing to the same state concurrently Correct answer.

Explanation

A lock ensures only one operation writes state at a time, preventing lost updates and corruption when several people or pipelines run Terraform. If a lock cannot be acquired, Terraform stops the run rather than proceeding unsafely.

Question 10Infrastructure as Code (IaC) with Terraform

What does terraform import do?

  1. It copies the state file from one backend to another
  2. It adds an existing resource to state so Terraform manages it Correct answer.
  3. It downloads a module from the public registry into the working directory
  4. It reads provider schemas and writes them to the lock file

Explanation

terraform import takes an existing real object's identifier and records it at a given resource address in state, after which Terraform treats it as managed. It does not modify the object itself, and the configuration must already describe the resource to keep the plan clean.

Question 11Infrastructure as Code (IaC) with Terraform

Why is for_each often preferred over count for a set of similar resources?

  1. It creates the resources in parallel, while count creates them serially
  2. Instances are keyed by value, so removing one item leaves the others intact Correct answer.
  3. It allows each instance to use a different provider configuration
  4. It does not require the values to be known at plan time

Explanation

With for_each, each instance is addressed by a stable key such as a map key or set member, so inserting or removing an item does not renumber the remaining instances. count addresses instances by position, so removing a middle element shifts the indexes and can cause unrelated resources to be replaced.

Question 12Infrastructure as Code (IaC) with Terraform

What is a main benefit of a remote backend such as an object storage bucket?

  1. It converts the configuration into a declarative language
  2. It gives teams shared and locked access to one state file Correct answer.
  3. It removes the need to run terraform init
  4. It stores the provider credentials so they need not be configured

Explanation

A remote backend stores state outside the local machine, so everyone works from the same copy and can rely on locking to avoid concurrent writes. Many backends also keep version history, allowing recovery of earlier state.

Question 13Infrastructure as Code (IaC) with Terraform

What does terraform validate check?

  1. Syntax and internal consistency of the configuration, without remote API calls Correct answer.
  2. Whether the provider plugins match the lock file checksums
  3. Whether the real infrastructure still matches the state file
  4. Whether the plan can be applied without any resource replacement

Explanation

validate parses the configuration, resolves references between blocks, and reports errors such as invalid argument names or missing required values. It runs offline and does not compare against real infrastructure. Checksums are verified during init.

Question 14Infrastructure as Code (IaC) with Terraform

How does Terraform infer that resource B must be created after resource A?

  1. Because A declares depends_on for B
  2. Because both resources are declared in the same file
  3. Because B's arguments reference an attribute of A Correct answer.
  4. Because A appears earlier in the directory listing

Explanation

Any expression that references another resource's attribute creates an implicit dependency edge in the graph, so the referenced resource is handled first. File layout and declaration order do not establish dependencies.

Question 15Infrastructure as Code (IaC) with Terraform

What is the role of a locals block?

  1. It declares values that the user must supply at apply time
  2. It marks values so they are hidden from CLI output
  3. It exports values for other configurations to read from state
  4. It names an expression that is reused within the module Correct answer.

Explanation

Locals assign a name to a computed expression so it can be referenced as local.<name> in several places without repetition. They are not inputs and cannot be set by a caller. Values are evaluated from the configuration, variables, and resource attributes.

Question 16Infrastructure as Code (IaC) with Terraform

What is the purpose of saving a plan with terraform plan -out=tfplan?

  1. It records a backup copy of the current state before any change
  2. It uploads the plan to the remote backend for automatic approval
  3. It lets the reviewed plan be applied exactly as shown Correct answer.
  4. It locks the state so no other run can start until it is applied

Explanation

A saved plan file captures the exact set of actions and is applied with terraform apply tfplan without recomputing them. This suits review workflows where the approved plan is the one that runs. Applying a saved plan does not permit new variables or a different target.

Question 17Infrastructure as Code (IaC) with Terraform

What does terraform state rm do?

  1. It drops a resource from state but leaves the real object intact Correct answer.
  2. It marks a resource for replacement on the next apply
  3. It destroys the object and then removes it from state
  4. It deletes the entire state file from the backend

Explanation

state rm removes the given address from the state file so Terraform stops tracking it, leaving the real object untouched and unmanaged. It is commonly used when handing a resource over to another configuration. It does not call the provider to delete anything.

Question 18Infrastructure as Code (IaC) with Terraform

Where do you set a version constraint for a provider?

  1. In the .terraform.lock.hcl file by hand
  2. In the required_providers block of a terraform block Correct answer.
  3. In the variable block for the provider
  4. In the provider block's version argument

Explanation

Provider source addresses and version constraints are declared in the terraform block's required_providers map. Terraform selects a version satisfying those constraints and records the choice in the dependency lock file. Older versions of Terraform accepted a version argument in the provider block, which is now deprecated.

Question 19Infrastructure as Code (IaC) with Terraform

What effect does setting sensitive = true on an input variable have?

  1. It prevents the value from ever being sent to the provider
  2. It encrypts the value in both the state file and the plan file
  3. It forces the value to be supplied through an environment variable
  4. It redacts the value in CLI output but keeps it in state Correct answer.

Explanation

The sensitive flag suppresses the value in plan and apply output so it is not displayed in logs or terminals. The value is still written to state, which is why state storage must be protected. Encryption is a backend concern, not something this flag provides.

Question 20Infrastructure as Code (IaC) with Terraform

Which command rewrites configuration files into Terraform's canonical formatting?

  1. terraform state push
  2. terraform fmt Correct answer.
  3. terraform validate
  4. terraform plan -refresh-only

Explanation

terraform fmt reformats files to the standard style, such as aligning equals signs and normalizing indentation. It edits files in place unless run with -check or -diff. It does not evaluate expressions or contact providers.

Question 21Infrastructure as Code (IaC) with Terraform

You want to see whether real infrastructure has drifted from configuration without changing any infrastructure. Which command fits best?

  1. terraform plan -refresh-only Correct answer.
  2. terraform destroy -refresh=false
  3. terraform apply -auto-approve
  4. terraform state pull

Explanation

A refresh-only plan updates the in-memory view of real objects and reports discrepancies, then proposes only state updates rather than infrastructure changes. Approving it would write refreshed values to state without altering resources. Other commands either change infrastructure or do not compare it with configuration.

Question 22Infrastructure as Code (IaC) with Terraform

You renamed a resource block in configuration while the real object still exists. What keeps the existing object instead of replacing it?

  1. terraform refresh after the rename
  2. terraform state mv from the old address to the new one Correct answer.
  3. terraform import using the new address
  4. terraform apply -replace with the new address

Explanation

state mv rewrites the address of an existing state entry, so the renamed block now maps to the same real object and no create or destroy is planned. It can also move entries between modules or into a child module. Importing is for objects not yet in state.

Question 23Infrastructure as Code (IaC) with Terraform

Which lifecycle setting creates a replacement object before the existing one is destroyed?

  1. ignore_changes = [tags]
  2. create_before_destroy = true Correct answer.
  3. prevent_destroy = true
  4. replace_triggered_by = [aws_instance.web]

Explanation

create_before_destroy reverses the default destroy-then-create order so the new object is provisioned first, which reduces downtime for resources that must always exist. It requires the provider to allow two objects with the same identifying name. The other settings control protection, attribute drift, and replacement triggers.

Question 24Infrastructure as Code (IaC) with Terraform

What is the role of the .terraform.lock.hcl file?

  1. It stores the outputs of the last successful apply
  2. It lists the modules installed in the .terraform directory
  3. It records the state file's serial number and lineage
  4. It pins provider versions and records checksums for verification Correct answer.

Explanation

The dependency lock file records the exact provider versions selected and their checksums so later runs on other machines install identical packages. It should be committed to version control. Provider upgrades are then deliberate, done with terraform init -upgrade.

Question 25Infrastructure as Code (IaC) with Terraform

Which command schedules a single resource for replacement without editing the configuration?

  1. terraform state rm aws_instance.web
  2. terraform plan -refresh-only
  3. terraform destroy -target=aws_instance.web
  4. terraform apply -replace=aws_instance.web Correct answer.

Explanation

The -replace option on plan or apply tells Terraform to plan a destroy-and-create cycle for the named address in that run only, leaving the configuration unchanged. The older taint and untaint commands served this purpose and are deprecated. The other commands either stop tracking, skip changes, or delete without recreating.

Question 26Terraform fundamentals

What is the main effect of running `terraform init` in a working directory that contains Terraform configuration?

  1. Apply the configuration to the target platform
  2. Install the required providers and modules Correct answer.
  3. Generate an execution plan for the pending changes
  4. Destroy the resources tracked in the state file

Explanation

Initialization prepares a working directory for use: it downloads provider plugins, installs referenced modules, and configures the backend that stores state. It does not compute or apply any infrastructure changes. Plan and apply are separate commands run after initialization completes.

Question 27Terraform fundamentals

Which command rewrites configuration files into Terraform's canonical formatting and indentation?

  1. terraform validate
  2. terraform fmt Correct answer.
  3. terraform show
  4. terraform plan

Explanation

The `terraform fmt` command reformats configuration files to the canonical style Terraform expects, adjusting alignment and indentation. It changes file content rather than reporting errors or producing plans.

Question 28Terraform fundamentals

By default, which filename does Terraform use for local state in the working directory?

  1. variables.tf
  2. terraform.tfstate Correct answer.
  3. main.tf
  4. terraform.tfvars

Explanation

When no remote backend is configured, Terraform stores state locally in a file named `terraform.tfstate` in the working directory. This file records the mapping between configuration addresses and real remote objects.

Question 29Terraform fundamentals

Which configuration block declares an input value that callers can supply to the configuration?

  1. resource
  2. variable Correct answer.
  3. output
  4. locals

Explanation

A `variable` block declares an input parameter, optionally with a type, default, and description, whose value is referenced as `var.<name>`. Values come from files, environment variables, or command-line flags.

Question 30Terraform fundamentals

Which command previews the changes Terraform would make without performing them?

  1. terraform validate
  2. terraform apply
  3. terraform plan Correct answer.
  4. terraform refresh

Explanation

`terraform plan` compares configuration against recorded state and current remote objects, then prints the actions it would take. Passing a plan to `terraform apply` is what actually makes changes.

Question 31Terraform fundamentals

What does `terraform validate` confirm about a configuration?

  1. That the state file is encrypted at rest
  2. That every provider plugin is already installed in the working directory
  3. That the files are syntactically valid and internally consistent Correct answer.
  4. That the remote objects match the configuration exactly

Explanation

Validation parses the configuration and checks references, argument names, and types for internal consistency without contacting any remote service. It therefore cannot detect drift or confirm that plugins are installed.

Question 32Terraform fundamentals

A managed resource is declared as `resource "aws_instance" "web" {}`. How is its computed ID referenced elsewhere in the same configuration?

  1. aws_instance.web[id]
  2. resource.aws_instance.web.id
  3. aws_instance.web.id Correct answer.
  4. var.aws_instance.web.id

Explanation

Splatted references are not used here: an attribute is reached with the resource type, the local name, and the attribute separated by dots, as in `aws_instance.web.id`. The type and name together form the resource address, and the trailing element names an exported attribute.

Question 33Terraform fundamentals

What does `terraform destroy` do to the infrastructure described by the configuration?

  1. Deletes the configuration files from the working directory
  2. Deletes the managed infrastructure recorded in state Correct answer.
  3. Removes provider plugins from the plugin cache
  4. Forgets resources from state without touching real infrastructure

Explanation

Destroy builds a plan to remove every object managed by the current configuration and state, then calls the providers to delete those objects. The configuration files themselves remain on disk.

Question 34Terraform fundamentals

A variable is declared as `variable "region" {}`. How is its value referenced inside the configuration?

  1. variable.region
  2. local.region
  3. ${region}
  4. var.region Correct answer.

Explanation

Input variables are read through the `var` namespace followed by the declared name, for example `var.region`. The `local` namespace is reserved for values defined in a `locals` block.

Question 35Terraform fundamentals

What is the role of an `output` block?

  1. It exposes a value from the configuration for display or reuse Correct answer.
  2. It configures provider-specific settings for the platform
  3. It prevents the state file from being modified
  4. It declares a value that the user must supply before apply

Explanation

Outputs publish selected values after an apply, showing them in the CLI and making them available to parent modules or remote state consumers. They never accept input values.

Question 36Terraform fundamentals

What is a data source used for in Terraform configuration?

  1. Storing sensitive values outside of state
  2. Reading information about objects Terraform does not manage Correct answer.
  3. Creating a new managed object in the target platform
  4. Declaring a reusable child configuration

Explanation

Data sources query a provider for facts about existing infrastructure, such as an existing VPC's ID or the latest machine image, and expose the results as read-only attributes. They do not create, update, or delete anything.

Question 37Terraform fundamentals

Which file does Terraform load automatically to supply input variable values without any command-line flag?

  1. main.tf
  2. terraform.tfstate
  3. terraform.tfvars Correct answer.
  4. variables.tf

Explanation

Terraform automatically reads `terraform.tfvars` and files named `*.auto.tfvars` from the working directory to populate input variables. Other filenames must be passed explicitly with `-var-file`.

Question 38Terraform fundamentals

What does the `create_before_destroy` lifecycle setting change about a replacement?

  1. The object is recreated on every apply regardless of changes
  2. Creation is deferred until all other resources are destroyed
  3. The replacement object is provisioned before the existing object is removed Correct answer.
  4. The object becomes permanently exempt from destruction

Explanation

By default Terraform destroys the old object first; `create_before_destroy` reverses that order so the new object exists before the old one is removed, reducing downtime. It does not force replacement on its own.

Question 39Terraform fundamentals

Two resources have no attribute reference between them, but one must be created before the other. What expresses that ordering?

  1. Add a lifecycle block with ignore_changes
  2. Place both resources in the same module
  3. Reference the other resource inside a local value
  4. Use the depends_on meta-argument Correct answer.

Explanation

Terraform derives ordering from references; when no reference exists, `depends_on` declares the dependency explicitly by resource address. Modules and locals do not by themselves create an ordering edge between two unrelated resources.

Question 40Terraform fundamentals

What is the primary purpose of Terraform state?

  1. To map declared resources to real remote objects Correct answer.
  2. To record which users ran each apply
  3. To cache provider API responses for faster plans
  4. To keep a backup copy of the configuration files

Explanation

State stores the binding between configuration addresses and real object identifiers, along with attribute values and dependency metadata. Terraform relies on it to compute diffs and decide what to create, update, or delete.

Question 41Terraform fundamentals

Why does Terraform lock state during operations that write to it?

  1. To give priority to interactive runs over CI runs
  2. To encrypt sensitive attribute values on disk
  3. To prevent concurrent writes to the same state Correct answer.
  4. To compress the state file before uploading it

Explanation

Locking ensures only one Terraform process at a time can modify a given state, protecting against corruption and conflicting applies. The lock is released when the operation completes.

Question 42Terraform fundamentals

Why save a plan with `terraform plan -out=tfplan` and then run `terraform apply tfplan`?

  1. To let the plan keep running after the apply finishes
  2. To write the plan into state without creating resources
  3. To apply exactly the changes that were reviewed in that plan Correct answer.
  4. To apply changes without consulting any state file

Explanation

A saved plan captures the precise set of actions computed at review time, and applying it executes exactly those actions. Terraform also refuses to apply a saved plan if state has changed since it was created.

Question 43Terraform fundamentals

What is the job of a provider block such as `provider "aws" { region = "us-east-1" }`?

  1. To store cloud credentials inside the state file
  2. To configure the plugin used to talk to that platform Correct answer.
  3. To name the workspace used for deployments
  4. To declare an AWS resource that Terraform will manage

Explanation

Provider blocks supply settings such as region, endpoint, or authentication options to the plugin that implements resource types. The plugin then handles all API calls for those types.

Question 44Terraform fundamentals

Which argument creates one resource instance per element of a map, with each instance addressable by its key?

  1. depends_on
  2. count
  3. for_each Correct answer.
  4. dynamic

Explanation

`for_each` accepts a map or set and produces one instance per element, reachable via `each.key` and `each.value`. Instances are addressed by key, so removing one element does not shift the others.

Question 45Terraform fundamentals

A resource was renamed in configuration, so its state entry still holds the old address. Which command updates the state to the new address without destroying anything?

  1. terraform apply -refresh-only
  2. terraform state mv Correct answer.
  3. terraform state rm
  4. terraform refresh

Explanation

`terraform state mv` rewrites an object's address in state, for example from the old resource name to the new one. Because the object is not destroyed, it continues to be managed under the new address.

Question 46Terraform fundamentals

Which lifecycle setting makes a plan fail when the resource it belongs to would be destroyed?

  1. create_before_destroy = true
  2. ignore_changes = all
  3. deletion_protection = true
  4. prevent_destroy = true Correct answer.

Explanation

`prevent_destroy` causes Terraform to error during planning whenever the resource would be destroyed, acting as a guard against accidental deletion. Any such destruction must be explicitly allowed by removing the setting first.

Question 47Terraform fundamentals

In Terraform's architecture, which component actually makes the API calls that create and update remote objects?

  1. Terraform Core, which talks to each platform directly
  2. The backend, which proxies requests to the target platform
  3. The registry, which brokers connections to cloud APIs
  4. The provider plugins invoked by Core Correct answer.

Explanation

Core is responsible for parsing configuration, building the dependency graph, and computing diffs, but every create, read, update, and delete is delegated to a provider plugin. Providers implement a defined interface that Core calls.

Question 48Terraform fundamentals

What must be true before `terraform import aws_instance.web i-0123456789abcdef0` can succeed?

  1. The resource block must already be in the configuration Correct answer.
  2. The state must be stored in a backend that supports locking
  3. The object must already be recorded in state
  4. The object must first be deleted by Terraform

Explanation

Import attaches an existing object to an address that must already be declared in configuration, so the resource block has to exist. Import only writes the object to state; it does not generate configuration for it.

Question 49Terraform fundamentals

Which argument to `terraform apply` marks a single existing object for replacement without editing the configuration?

  1. -target=aws_instance.web
  2. -refresh=false
  3. -replace=aws_instance.web Correct answer.
  4. -parallelism=1

Explanation

The `-replace` flag tells Terraform to plan destruction and re-creation of the named address in the current run, replacing the older taint workflow. It affects only the specified address, leaving the rest of the plan intact.

Question 50Terraform fundamentals

How does a configuration call a child module stored in a local directory?

  1. module "vpc" { source = "./modules/vpc" } Correct answer.
  2. resource "module" "vpc" { source = "./modules/vpc" }
  3. include "vpc" { path = "./modules/vpc" }
  4. import "vpc" from "./modules/vpc"

Explanation

A `module` block with a `source` argument instantiates a child module, and its outputs are read through `module.vpc.<output>`. The source may be a local path, a registry address, or a VCS URL.