Terraform Infrastructure Engineer Professional

Last checked October 22, 2026 against the official HashiCorp exam page.

1. Question 1Resource Lifecycle

   A team changes a resource attribute that the provider can only set at creation. Terraform plans a destroy-and-recreate for a database that holds production data. What should the engineer do FIRST?

   1. AApply the plan, since Terraform always preserves data during a replacement
   2. BRemove the resource block from the configuration so that the plan no longer includes it
   3. CRun terraform state rm on the database so that Terraform stops tracking it before the apply
   4. DReview why the replacement is forced, and find a safer alternative
   Show answer and explanationHide answer

   Correct answer: D

   A forced replacement destroys the old object, so the engineer should first confirm why it is forced and look for a safe alternative, such as a lifecycle prevent_destroy guard. Applying blindly risks data loss, while state rm and deleting the block hide the resource rather than managing the change safely.

2. Question 2Security and Policy

   Which practice keeps cloud credentials out of Terraform configuration files?

   1. AUsing dynamic credentials, such as workload identity or short-lived tokens, supplied by the environment
   2. BCommitting the credentials to a private repository, so that only the team can read them
   3. CHard-coding the access key in the provider block, so that the configuration works everywhere
   4. DWriting the credentials in a comment at the top of the main file for the team's reference
   Show answer and explanationHide answer

   Correct answer: A

   Dynamic, short-lived credentials supplied by the environment keep secrets out of code. Hard-coded keys, committed credentials and comments all expose them.

3. Question 3State Management

   Two engineers run terraform apply against the same state at the same time. What protects the state from corruption?

   1. ASetting parallelism to one on the CLI, which serialises the apply for every user of the workspace
   2. BStoring the state file in version control so that merges resolve any differences automatically
   3. CBackend locking, such as a DynamoDB lock table or the run queue
   4. DDeleting the lock file manually before each apply, so that only one engineer's run is ever active
   Show answer and explanationHide answer

   Correct answer: C

   Backends that support locking, such as S3 with a DynamoDB table or Terraform Cloud's run queue, prevent concurrent writes. Version control does not lock state, parallelism settings do not serialise separate machines, and deleting locks removes the protection.

4. Question 4Modules

   What is the purpose of a Terraform module?

   1. ATo hold the provider credentials used by every configuration in the same repository
   2. BTo package a reusable set of resources behind input variables and outputs
   3. CTo store the state of a configuration in a separate file on a remote backend
   4. DTo define the order in which resources are created, without grouping them logically
   Show answer and explanationHide answer

   Correct answer: B

   A module packages reusable resources behind inputs and outputs. Credentials belong in provider or variable configuration, state is stored by backends, and ordering is handled by dependencies, not modules.

5. Question 5Providers and Configuration

   A configuration uses two instances of the same AWS provider in different regions. Which feature selects between them?

   1. AProvider aliases, referenced in resources with the provider meta-argument
   2. BTwo separate provider blocks with the same name and no alias set
   3. CA variable named region, which the provider reads automatically from the environment
   4. DA data block that looks up the region and switches the provider at plan time
   Show answer and explanationHide answer

   Correct answer: A

   Provider aliases define multiple configurations of the same provider, which resources select with the provider argument. Duplicate unaliased blocks are an error, and variables or data blocks do not select a provider instance.