Validate Your Terraform Knowledge Before Exam Day

Take on 25 practice questions across eight Terraform Associate domains.
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Infrastructure as Code Concepts: Basic understanding of what IaC is and why declarative configuration beats manual provisioning.
  • Basic Terminal Skills: Comfort running commands in a shell and working with files and directories.
  • Cloud and On-Prem Architecture Basics: General awareness of how infrastructure is provisioned across cloud and on-premises environments.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
Which statement correctly compares an HCP Terraform workspace with a Terraform CLI workspace?
An HCP workspace holds its own variables, state, and runs; a CLI workspace separates state only
A CLI workspace automatically creates a matching HCP Terraform project and workspace with the same name
Both types of workspace provide the same access controls and run history
Every HCP Terraform workspace in an organization shares one state file
A
HCP Terraform workspaces are full units of management with variables, state, run history, and access controls. CLI workspaces are named states for the same configuration in one working directory.
HCP Terraform
25
Select One
An HCP Terraform organization wants to group the workspaces that belong to one application and give that application's team access to all of them at once. Which feature fits?
Variable sets
Run triggers
Projects
Organizations
C
Projects group related workspaces, and team access can be granted at the project level. Variable sets share variables, run triggers connect workspaces, and an organization contains all projects.
HCP Terraform
24
Select One
An engineer needs detailed Terraform logs to troubleshoot a provider error. Which environment variable enables logging and sets its level?
TF_LOG_PATH
TF_LOG
TF_INPUT
TF_CLI_ARGS
B
TF_LOG enables logging at a level such as TRACE or DEBUG. TF_LOG_PATH only sets the log file location and has no effect unless TF_LOG is also set.
Maintain infrastructure with Terraform
23
Select One
A configuration contains the following import block and no matching resource block. An engineer runs terraform plan -generate-config-out=generated.tf. What happens? import { to = aws_s3_bucket.assets id = "company-assets" }
Terraform creates a new bucket named company-assets
The plan fails, because a resource block must exist before running plan
Terraform deletes the existing bucket and recreates it from the new file
Terraform writes a resource block to generated.tf and plans the import
D
With -generate-config-out, Terraform generates configuration for import targets that have no resource block, and the plan shows the import. The engineer should review the generated file before applying.
Maintain infrastructure with Terraform
22
Select One
A resource named aws_instance.web must be renamed to aws_instance.app in the configuration. Terraform must keep managing the same instance without destroying or recreating it. What should the engineer add?
A moved block from aws_instance.web to aws_instance.app
An import block that imports the instance as aws_instance.app
terraform state rm aws_instance.web, then a new apply
lifecycle { ignore_changes = all } on the renamed resource
A
A moved block tells Terraform that the existing object now has a new address, so it updates state instead of destroying and recreating. Removing it from state and applying again would create a new instance.
Terraform state management
21
Select One
True or false: terraform state rm aws_instance.web destroys the EC2 instance in the cloud provider.
True
False
B
terraform state rm only removes the resource from state, so Terraform stops managing it while the instance keeps running. If the configuration still declares it, the next plan proposes creating a new one.
Terraform state management
20
Select One
Two engineers might run terraform apply against the same remote state at the same moment. Which mechanism prevents both runs from writing the state at once, when the backend supports it?
The dependency lock file
Running terraform refresh first
State locking
Marking all outputs sensitive
C
Backends that support locking lock the state during operations that write it, so a second run waits or fails. The dependency lock file is about provider versions, not concurrency.
Terraform state management
19
Select One
A module block sources a module from the public registry with version = "~> 3.2.0". Which version could Terraform select?
3.3.0
3.2.7
4.0.0
3.1.9
B
~> 3.2.0 allows only the patch component to increase, which means versions from 3.2.0 up to but not including 3.3.0. The other versions fall outside that range.
Terraform modules
18
Select One
A root module calls a child module named network that declares an output named vpc_id. How does the root module reference this value?
module.network.vpc_id
var.network.vpc_id
output.network.vpc_id
network.outputs.vpc_id
A
Child module outputs are referenced as module.<MODULE_NAME>.<OUTPUT_NAME>. Only declared outputs are visible to the caller.
Terraform modules
17
Select One
A child module declares an input variable named region. How does the calling module supply its value?
Root module variables are passed to every child module automatically
By setting the TF_VAR_region environment variable for the child only
By adding a variable "region" block with a default to the root module
By setting region as an argument in the module block
D
Module input variables receive values from arguments in the calling module block. Root module variables are not inherited by child modules, and TF_VAR_ variables apply only to the root module.
Terraform modules
16
Select One
A configuration sets a database password with a write-only argument, as shown below. The provider supports write-only arguments. Which two statements are correct? ephemeral "random_password" "db" { length = 20 } resource "aws_db_instance" "main" { # other arguments omitted password_wo = ephemeral.random_password.db.result password_wo_version = 1 }
Terraform stores the password in state but redacts it from plan output
Any provider argument can be made write-only by adding the _wo suffix
Terraform does not store the password_wo value in the plan or state
To change the password later, increment password_wo_version
C
Write-only arguments accept ephemeral values and are never persisted, so Terraform cannot detect changes to them; the version argument signals when to send a new value. Only arguments that the provider defines as write-only work this way.
Terraform configuration
15
Select Two
D
True or false: Setting sensitive = true on a variable redacts its value from CLI output, but the value can still be stored in the state file.
True
False
A
sensitive only redacts values in plan and output displays. The value can still appear in state and plan files, so state must be protected, or ephemeral and write-only features used.
Terraform configuration
14
Select One
True or false: When an assertion in a check block fails, Terraform reports a warning, and the plan or apply continues.
True
False
A
Check block assertions report failures as warnings and do not block operations. Variable validations and resource preconditions and postconditions, by contrast, return errors.
Terraform configuration
13
Select One
A module declares the following variable. A user runs terraform plan -var environment=test. What happens? variable "environment" { type = string validation { condition = contains(["dev", "staging", "prod"], var.environment) error_message = "environment must be dev, staging, or prod." } }
Terraform prints the message as a warning and continues the plan
Terraform ignores the value and uses the first allowed value, dev
Terraform reports an error with the message, and the plan stops
Validation runs only during apply, so the plan succeeds
C
When a variable validation condition is false, Terraform returns an error with the error_message and stops before planning. Validation does not substitute values.
Terraform configuration
12
Select One
A load balancer change requires replacement. The platform allows the old and new load balancers to exist at the same time, and downtime must be avoided. Which lifecycle setting fits?
create_before_destroy = true
prevent_destroy = true
ignore_changes = all
replace_triggered_by = []
A
This setting creates the replacement before destroying the original, as long as unique names and quotas allow both to exist. prevent_destroy blocks the replacement, and ignore_changes hides the change.
Terraform configuration
11
Select One
An application server must be created only after an IAM policy is attached to its role, but the server's configuration does not reference the policy attachment in any argument. Which meta-argument declares this dependency?
lifecycle { ignore_changes }
provider
count
depends_on
D
depends_on declares a dependency that Terraform cannot infer from references. Prefer references when possible, and use depends_on only for hidden dependencies such as this one.
Terraform configuration
10
Select One
A configuration creates buckets with for_each. How is the ARN of the web bucket referenced elsewhere in the configuration? resource "aws_s3_bucket" "logs" { for_each = toset(["app", "web", "db"]) bucket = "example-${each.key}-logs" }
aws_s3_bucket.logs[1].arn
aws_s3_bucket.logs["web"].arn
aws_s3_bucket.logs.arn["web"]
aws_s3_bucket["web"].logs.arn
B
Instances created with for_each are addressed by their key in square brackets, placed right after the resource name. Numeric indexes apply to count, a set has no position-based index, and the collection itself has no arn attribute to index into. Dot notation such as aws_s3_bucket.logs.web.arn can also work for keys that are valid identifiers, but the bracket form is the documented and safest choice.
Terraform configuration
9
Select One
A CI job must fail when any Terraform file in the repository is not in canonical format, without changing the files. Which command fits?
terraform fmt -recursive
terraform validate -json
terraform fmt -check -recursive
terraform plan -detailed-exitcode
C
With -check, fmt reports files that need formatting and exits with a non-zero status without changing them. Without -check, fmt rewrites the files.
Core Terraform workflow
8
Select One
True or false: terraform validate confirms that the provider credentials in the environment are valid and that the planned resources can be created.
True
False
B
terraform validate checks syntax and internal consistency without contacting remote services. Credentials and API permissions are only exercised during plan and apply.
Core Terraform workflow
7
Select One
A change must be reviewed in a pull request, and exactly the reviewed actions must later be applied, even if the configuration changes in the meantime. Which workflow fits?
terraform plan -out=tfplan, then terraform apply tfplan
terraform plan, then terraform apply -auto-approve
terraform validate, then terraform apply -refresh-only
terraform plan -destroy, then terraform apply with the same working directory
A
Applying a saved plan file performs exactly the reviewed actions without re-planning. Running apply without a plan file creates a new plan, which may differ from the reviewed one.
Core Terraform workflow
6
Select One
Which two actions does terraform apply perform when it runs successfully?
Downloads the provider plugins that the configuration requires
Makes the infrastructure changes described in the plan
Rewrites configuration files into the canonical format
Updates the state file to record the changes it made
B
Apply carries out the planned changes and records the results in state. Plugins are downloaded by init, formatting is done by fmt, and apply changes only what the plan requires.
Core Terraform workflow
5
Select Two
D
A team adds a new module block and a new provider to an existing configuration. Which command must run before terraform plan will work?
terraform validate
terraform plan -refresh-only
terraform fmt -recursive
terraform init
D
terraform init installs new providers and modules and initializes the backend, so it must run whenever these change. Formatting and validation do not download dependencies.
Core Terraform workflow
4
Select One
True or false: The dependency lock file, .terraform.lock.hcl, records the selected versions of both providers and modules.
True
False
B
The lock file records provider versions and checksums only. Module versions come from each module block's version constraint, and terraform init keeps already-installed modules unless it runs with -upgrade.
Terraform fundamentals
3
Select One
A configuration contains the following block. Which provider versions does the constraint allow? terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 5.40" } } }
Only patch releases of 5.40, such as 5.40.1 and 5.40.2
Version 5.40 or later, but earlier than 6.0
Any version equal to or greater than 5.40, including 6.x
Exactly version 5.40.0 and no other version
B
The pessimistic constraint ~> allows only the rightmost specified component to increase, so ~> 5.40 allows 5.40 and later 5.x releases. ~> 5.40.0 would allow only 5.40.x patch releases.
Terraform fundamentals
2
Select One
Which advantage of infrastructure as code is not available when provisioning infrastructure manually through a cloud console?
It guarantees that the infrastructure costs less to run
It prevents anyone from changing resources outside the tool
Configuration can be versioned, reviewed, and reused
It stores cloud credentials securely without extra setup
C
Code can be stored in version control, reviewed through pull requests, and reused as modules. IaC does not guarantee lower cost, stop out-of-band changes, or secure credentials by itself.
Infrastructure as Code with Terraform
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

HashiCorp Certified: Terraform Associate 004

Beginner
Associate
Professional
16.67
Hours
Play icon
Ace the HashiCorp Terraform Associate (004) exam with our hands-on course. Complete TA-004 coverage with guided labs, quizzes, realistic practice tests, expert tips, and up-to-date content.
Bryan Krausen
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The Terraform Associate exam rewards real workflow fluency, not memorized HCL.

Build Real Exam Speed‍

You get 60 minutes for the full exam. Repeated practice trains you to recognize the right command fast, so you're not second-guessing init, plan, and apply under time pressure.

Know Your Weak Domains‍

Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

Realistic Scenario Questions‍

Exam-style questions, that are a mix of configuration, workflow, and state management items.

Reduce Exam-Day Anxiety‍

Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

Reinforce Through Repetition‍

Spaced repetition on frequently tested concepts, like state locking, remote backends, and module versioning, moves them from look it up to just know it.

Check Your Readiness‍

HashiCorp doesn't publish a passing score, so treat your result as a readiness check and identify topics to review before exam-day.

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.