Terraform Authoring & Operations Advanced

Last checked November 10, 2026 against the official HashiCorp exam page.

1. Question 1Manage resource lifecycle

   A CI pipeline runs `terraform plan -out=tfplan` on a merge request. After a reviewer approves the output, the deploy job runs `terraform apply tfplan`. What does the deploy job do?

   1. AIt evaluates the configuration again and applies whatever differs at that moment, ignoring any earlier review.
   2. BIt applies only the changes recorded in the saved plan, without planning again.
   3. CIt imports every resource found in the cloud account into the state file first.
   4. DIt writes a JSON copy of the plan and makes no changes to the infrastructure.
   Show answer and explanationHide answer

   Correct answer: B

   A saved plan file records the exact changes that were reviewed, so applying it runs those changes without a new plan. Option A describes an apply with no saved plan, option C describes an import, and option D describes plan output rather than an apply.

2. Question 2Develop and troubleshoot dynamic configuration

   Which description of the try function is correct?

   1. AIt retries a failing provider API call until a successful response is returned.
   2. BIt returns true when an expression is valid and false when it produces an error.
   3. CIt returns the first expression that evaluates without an error.
   4. DIt returns a fallback only when a variable is null, and errors on other values.
   Show answer and explanationHide answer

   Correct answer: C

   try evaluates its arguments in order and returns the first one that succeeds, which makes it useful for fallback values. The can function is the one that returns a boolean for validity, while the other options describe behaviour that try does not have.

3. Question 3Develop collaborative workflows

   A team's repository contains a .terraform.lock.hcl file created by terraform init. What is the recommended handling?

   1. AAdd it to .gitignore because it records the local cache path of each provider on that machine.
   2. BDelete it before each run so the newest provider versions are always selected.
   3. CCommit it so every team member and CI run installs the same provider versions and hashes.
   4. DStore it only in the remote backend, because it records secret values from state.
   Show answer and explanationHide answer

   Correct answer: C

   The dependency lock file records the provider versions and checksums chosen during init, so committing it keeps installs reproducible. Ignoring it, deleting it before each run, or keeping it only in a backend would remove that consistency, and the file holds no secrets from state.

4. Question 4Create, maintain, and use modules

   A team wants to reference a module stored in a Git repository at the release tag v2.1.0, so the version stays reproducible. Which source is correct?

   1. Agit::https://git.example.com/platform/modules.git//network with version = 2.1.0 set in the module block
   2. B./vendor/modules/network?ref=v2.1.0
   3. Cgit::https://git.example.com/platform/modules.git//network?tag=v2.1.0
   4. Dgit::https://git.example.com/platform/modules.git//network?ref=v2.1.0
   Show answer and explanationHide answer

   Correct answer: D

   Git module sources use the ref query parameter to select a tag or commit, and the double slash selects a subdirectory of the repository. The version argument works only for registry modules, a local path cannot carry a Git ref, and tag is not a recognised source parameter.

5. Question 5Configure and use providers

   Two resources in one configuration must use different regions. One resource must use the aliased provider aws.west. Which meta-argument selects that provider for the resource?

   1. AThe provider meta-argument, set to aws.west
   2. BThe alias argument inside the resource block
   3. CA separate terraform block that overrides the default provider for the resource
   4. DThe depends_on argument pointing at the aws.west provider block
   Show answer and explanationHide answer

   Correct answer: A

   The provider meta-argument picks which provider configuration a resource uses, and aliases are declared in provider blocks rather than resource blocks. A terraform block does not select providers per resource, and depends_on controls ordering rather than provider choice.