15 Free Terraform Associate (004) Practice Questions with Answers (2026)

The ~> operator lets only the rightmost version component you wrote increase. With 5.40, the minor version can rise (5.41, 5.90), but the major version cannot reach 6.

• A would need the constraint ~> 5.40.0.
• C would need >= 5.40.
• D would need = 5.40.0 or just 5.40.0.

The provider meta-argument on a resource selects a non-default provider configuration, referenced as <provider>.<alias>.

• B is set on the provider block to name it, not on a resource.
• C is the syntax for passing providers into a module block, not a resource.
• D declares a dependency on objects. It does not choose a provider.

Any backend change requires terraform init. The -migrate-state option copies the existing local state into the new backend so nothing is lost.

• A checks the configuration but does not set up the backend.
• C still needs an initialised backend, and refreshing does not move state.
• D writes a state file to a backend that has not been initialised yet, and is a risky manual step.

-check makes terraform fmt report unformatted files and exit with a non-zero code without changing them. -recursive includes subdirectories.

• A checks syntax and internal consistency, not formatting style.
• B rewrites the files instead of failing the build.
• D reports whether the plan has changes. It says nothing about formatting.

A data source reads an existing object without managing it, so you can reference its ID in your own resources.

• A would try to create a second VPC.
• B would bring the VPC under your configuration's management, which you must not do.
• C renames resource addresses inside your own state. It cannot find external objects.

count tracks instances by position, so removing an item shifts everything after it. for_each tracks instances by key, so removing "ben" only affects aws_iam_user.this["ben"].

• A makes the plan fail with an error. It does not fix the addressing.
• B does not change how instances are tracked.
• D still uses positions, so removing an item still shifts the others.

A validation block is a custom condition on an input variable. If the condition is false, Terraform reports the error message and stops.

• A hides the value in output. It does not check it.
• B only rejects null.
• D sets a fallback value but still accepts anything that is passed in.

The version argument only works for modules from a module registry. For Git sources, you pin a tag, branch or commit with the ref query parameter in the source address.

• B still uses version, which Git sources do not support.
• C is a setting in the terraform block that constrains the Terraform CLI version. It is not a module argument.
• D upgrades within constraints but does not fix an unsupported argument.

A child module's resources are private to it. The only way to expose a value to the caller is an output, which the caller reads as module.<name>.<output>.

• A is not allowed: resources inside a module cannot be referenced from outside it.
• B does not work. Variables are inputs, and nothing fills them from a child module.
• C is unreliable and ignores the value the module already knows.

Locking stops two operations from writing state at the same time. With the default lock timeout of zero, a second run fails straight away if it cannot get the lock.

• B is what locking prevents.
• C does not happen. Terraform never merges concurrent runs.
• D is not the default. Waiting only happens if you set -lock-timeout, and even then only for that long.

A refresh-only apply reads the real infrastructure and, after you approve, updates state to match. It proposes no infrastructure changes.

• A shows the drift but does not save anything to state.
• B would change the tag back to the value in the configuration.
• D removes the instance from state, so Terraform would stop managing it.

Config-driven import uses an import block. With -generate-config-out, the plan writes HCL for resources that do not have a configuration yet. You then review it and apply to complete the import.

• A imports into state but does not generate any configuration.
• C only reads the bucket. Terraform would not manage it.
• D means hand-editing state, which is error-prone and creates no configuration.

TF_LOG turns on detailed logs at the level you choose, and TF_LOG_PATH writes them to a file instead of the terminal.

• A is not a valid option for terraform apply.
• B is not an environment variable Terraform reads.
• C is for evaluating expressions. It cannot run an apply.

Policy sets attach Sentinel or OPA policies to workspaces or projects. Policies run after the plan and can stop a run from applying.

• B shares variables across workspaces. It does not enforce rules.
• C starts a run in one workspace when another workspace applies.
• D shares approved modules and providers but does not check runs.