Free Practice Questions for HashiCorp Terraform-Associate-004 Exam

From the Terraform Output Docs – Sensitive:

" Marking an output as sensitive prevents Terraform from showing its value in the CLI output,but it will still bestored in the state file. "

Thus, it protects display, not storage.

Rationale for Correct Answer: The pessimistic constraint operator ~ > allows updates that do not change the leftmost specified digits beyond what’s declared. With ~ > 11.0, Terraform allows any version that is > = 11.0 but < 12.0 (i.e., any 11.x release). This pins to the major version while allowing minor/patch updates.

Analysis of Incorrect Options (Distractors):

A: Incorrect—this excludes exactly 11.0 and doesn’t express the upper bound that ~ > imposes.

B: Incorrect—missing the upper bound; ~ > always implies an upper limit.

D: Incorrect— > = 11.0.0 and < 11.1.0 corresponds to ~ > 11.0.0, not ~ > 11.0.

Key Concept: Module version constraints using the pessimistic (~ > ) operator.

Rationale for Correct Answer: Remote state storage is configured using a backend block, which lives inside the top-level terraform block (for example, terraform { backend " s3 " { ... } }). Backends control where Terraform stores state (local vs remote), locking, and related settings—this is squarely in the Terraform configuration’s global settings area, not in resources or providers.

Analysis of Incorrect Options (Distractors):

A (The resource block): Resources define infrastructure objects (e.g., servers, buckets). They do not configure where Terraform stores state.

B (The provider block): Providers configure how Terraform talks to an API (credentials/regions/features). They don’t define state storage.

C (The data block): Data sources read existing infrastructure; they are unrelated to backend/state storage configuration.

Key Concept: Backends and remote state configuration using terraform { backend ... }.

When declaring a Terraform output, the value argument is required. Outputs are a way to extract information from Terraform-managed infrastructure, and the value argument specifies what data will be outputted. While other arguments like description and sensitive can provide additional context or security around the output, value is the only mandatory argument needed to define an output.References = The requirement of the value argument for outputs is specified in Terraform ' s official documentation, which provides guidelines on defining and using outputs in Terraform configurations.

terraform graphgeneratesGraphviz DOT formatoutput, which allows visualization ofresource dependenciesin Terraform.

A (terraform refresh)– Incorrect, as it only updates the state file.

C (terraform output)– Incorrect, as it only displays Terraform output values.

D (terraform show)– Incorrect, as it only displays the Terraform state.

Official Terraform Documentation Reference:

terraform graph - HashiCorp Documentation

 This is the command that can add existing resources into Terraform state, by matching them with the corresponding configuration blocks in your files. 

Terraform state is a representation of the infrastructure that Terraform manages. Terraform uses state to track the current status of the resources it creates and to plan future changes. However, Terraform state is not aware of any changes made to the resources outside of Terraform, such as through the Azure Cloud Console, the Azure CLI, or the Azure API. Therefore, changing resources via the Azure Cloud Console does not update the current state file, and it may cause inconsistencies or conflicts with Terraform’s desired configuration. To avoid this, it is recommended to manage resources exclusively through Terraform or to use the terraform import command to bring existing resources under Terraform’s control.

When you change a Terraform-managed resource via the Azure Cloud Console, Terraform does not immediately update the state file to reflect the change. However, the next time you run terraform plan or terraform apply, Terraform will compare the state file with the actual state of the resources in Azure and detect any drifts or differences. Terraform will then update the state file to match the current state of the resources and show you the proposed changes in the execution plan. Depending on the configuration and the change, Terraform may try to undo the change, modify the resource further, or recreate the resource entirely. To avoid unexpected or destructive changes, it is recommended to review the execution plan carefully before applying it or to use the terraform refresh command to update the state file without applying any changes.

References = Purpose of Terraform State, Terraform State, Managing State, Importing Infrastructure, [Command: plan], [Command: apply] , [Command: refresh]

 This is the command that you would use to access all of the attributes and details of a resource managed by Terraform, by providing the resource address as an argument. For example, terraform state show ' aws_instance.example '  will show you all the information about the AWS instance named example.

Terraform keeps track of the infrastructure state via the state file. When you initially ran terraform plan, Terraform determined that the port should be changed from80 to 443. However, since another team member manually modified the load balancer, Terraform ' s local state file is now outdated.

When you run terraform apply, Terraform willcompare the expected state (from the plan) with the actual state (from the provider API).

Since the port is already set to443, but the local state file still shows80, Terraform willfail with an errordue to the state mismatch.

To resolve this, you should run terraform refresh or use terraform apply -refresh-only to update the local state before applying changes.

Official Terraform Documentation Reference:

State Management - HashiCorp Documentation

Managing Drift in Terraform

Rationale for Correct Answer: To expose values from a child module to a parent module, you define an output in the child module (e.g., output " public_ip " { value = aws_instance.example.public_ip }). The parent module can then reference it via module. < child_name > .public_ip.

Analysis of Incorrect Options (Distractors):

B: A data source in the parent could look up an instance, but that’s unnecessary and brittle compared to using module outputs (and may require extra identifiers).

C: Import is for bringing existing resources into state; it doesn’t expose attributes between modules.

D: Locals are only scoped within the module; they are not accessible from the parent.

Key Concept: Module composition: outputs are the contract for passing data from child to parent.