Free Terraform Associate practice test: 30 questions with answers

for_each creates instances keyed by map keys or set members, which gives stable addresses when items are added or removed. count indexes by number, depends_on orders resources, and lifecycle changes replacement behavior.

replace_triggered_by forces replacement when a listed resource or attribute changes, which covers cross-resource dependencies. ignore_changes suppresses updates, prevent_destroy blocks replacement, and create_before_destroy only changes the order of a replacement.

join takes a separator and a list and returns one string, which is the operation described. concat combines lists rather than strings, format fills templates, and split does the reverse of join.

The conditional expression evaluates the condition and returns one of two values, which suits a choice inside an argument. For expressions transform collections, splat expressions extract attributes, and dynamic blocks generate nested blocks.

Remote backends that support locking hold a lock during a run, so a second run waits or fails rather than overwriting the state. Versioning does not merge states, and Terraform writes state during apply.

State records resource attributes, and some of them can be secrets stored in plaintext, so access controls and encryption at rest are required. State is written to disk or to the backend, and it is not encrypted with a key kept beside it.

terraform state rm forgets the object in state while leaving it in place, which is useful when handing an object to another configuration. Destroy deletes real infrastructure, replace recreates it, and taint marks a resource for replacement.

Remote backends with locking prevent concurrent writes, and versioning allows recovery of earlier state. Local copies shared by email, hand edits and parallel applies from different branches each make corruption more likely.

terraform fmt applies the standard HCL formatting to files, which keeps code consistent across a team. Validate checks correctness, plan writes a plan file and show displays state or plans without changing formatting.

terraform init installs providers and modules and initializes the backend, which must happen before planning with a new provider. Refresh, workspace creation and state push do not install provider plugins.

Some arguments cannot be modified in place, so the provider marks them as force-new and Terraform replaces the object. Tag changes are usually in place, and output descriptions and workspace names do not affect resources.

terraform validate checks the configuration without reaching providers or state, which makes it quick to run in CI. Plan, refresh-only apply and show all read remote data or state.

A module block references the child module's source and supplies its input variables. Resource, data and provider blocks do not call child modules.

Version constraints let consumers adopt changes deliberately, and a new major version signals breaking changes. Tracking the main branch or copying code forces every change on consumers, and unversioned hashes give no stable contract.

terraform init retrieves referenced modules into the .terraform directory so that later commands can evaluate them. It does not apply resources, delete local copies or create separate state files.

Documented, validated inputs and outputs form the contract between a module and its callers. Hard-coded accounts, embedded credentials and undocumented defaults make modules unsafe or hard to reuse.

Policy as code evaluates the plan against rules, such as allowed regions or tag requirements, and can block the apply. The registry, variable sets and VCS integration support sharing and triggering runs rather than enforcing plan rules.

With manual apply, the run pauses after the plan until someone confirms it, which is the approval gate. Auto-apply removes the gate, speculative plans never apply, and local execution does not add approval.

Remote runs and state with run history, plus role-based access on workspaces, support shared, auditable work. Local-only modes, unlimited private provider access and JSON-only rules are not features of HCP Terraform collaboration.

Storing definitions in version control makes changes reviewable and repeatable, which is the central value of IaC. Price discounts for repositories are not a benefit of the approach, and drift can still happen when people change resources outside the code.

A declarative configuration states the end result and the tool plans the steps needed to reach it, while an imperative approach spells out each action in order. The other statements reverse the two models or describe approval workflows that are unrelated to the distinction.

Idempotent runs converge on the declared state, and comparing reality with the declaration reveals drift. Duplicate creation, removing review and orphaned resources are the opposite of what idempotent, declarative management provides.

Locals name computed expressions for reuse inside a module and are not inputs from outside. Variables come from callers, outputs go back to callers, and provider blocks configure API access.

The sensitive flag hides values in CLI output, but the state still records them, so state must be protected separately. The other options claim encryption, a reference ban or state removal that Terraform does not perform.

A data source reads an object that exists outside the configuration, so its attributes can be used without taking ownership. Resources manage objects, modules package resources and outputs expose values.

terraform plan computes the proposed changes and displays them without applying anything. Apply, destroy and import all modify infrastructure or state, so they do not meet the requirement for a read-only preview.

A plan file saved with -out captures the exact proposed changes, and applying it runs those changes without re-planning. The variable file, backend file and lock file configure inputs, storage and provider versions rather than capturing a plan.

The core workflow is write, plan, apply, so the plan is the step that precedes apply. Init comes first, writing comes before planning, and destroy is a separate operation.

Terraform's providers translate the same HCL resource model into calls to each platform's API, which is what makes it multi-cloud. Compilers, a single vendor SDK and automatic template conversion do not describe how providers work.

Terraform provisions infrastructure through provider APIs, and configuration management tools manage the software and settings inside hosts. The other statements swap these roles or wrongly limit Terraform to Kubernetes.