CertArea
All HashiCorp exams

Free Terraform Infrastructure Engineer Professional practice test: 30 questions with answers

30 original questions for Terraform Infrastructure Engineer Professional, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
111 questions

Terraform Infrastructure Engineer Professional exam guide: topics, cost and format

All 30 Terraform Infrastructure Engineer Professional questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Resource Lifecycle (5 questions)

  1. Question 1

    A team changes a resource attribute that the provider can only set at creation. Terraform plans a destroy-and-recreate for a database that holds production data. What should the engineer do FIRST?

    1. AApply the plan, since Terraform always preserves data during a replacement
    2. BRemove the resource block from the configuration so that the plan no longer includes it
    3. CRun terraform state rm on the database so that Terraform stops tracking it before the apply
    4. DReview why the replacement is forced, and find a safer alternative
    Show answer and explanation
    Correct answer: D

    A forced replacement destroys the old object, so the engineer should first confirm why it is forced and look for a safe alternative, such as a lifecycle prevent_destroy guard. Applying blindly risks data loss, while state rm and deleting the block hide the resource rather than managing the change safely.

  2. Question 2

    Which meta-argument prevents a resource from being destroyed by a plan, without removing it from the configuration?

    1. Alifecycle with prevent_destroy set to true on the resource block
    2. Bcount set to zero, which removes every instance of the resource from the plan
    3. Cdepends_on pointing at a data source that never changes during the life of the stack
    4. Dfor_each over an empty map, which deletes the instances for the next apply
    Show answer and explanation
    Correct answer: A

    The lifecycle block with prevent_destroy = true makes Terraform refuse to plan a destroy for that resource. Setting count to zero or using an empty for_each destroys instances, and depends_on controls ordering rather than deletion.

  3. Question 3

    Which lifecycle setting makes Terraform create the replacement before destroying the old resource?

    1. Aprecondition with a condition that always evaluates to false
    2. Bignore_changes listing every attribute of the resource
    3. Creplace_triggered_by set to an empty list on the resource
    4. Dcreate_before_destroy set to true in the lifecycle block
    Show answer and explanation
    Correct answer: D

    create_before_destroy makes the replacement resource exist before the original is removed, which avoids downtime. ignore_changes suppresses updates, replace_triggered_by with an empty list does nothing, and an always-false precondition blocks the plan.

  4. Question 4

    An engineer needs to move an existing resource into a module without destroying it. Which approach is correct?

    1. ADelete the resource from state and let Terraform recreate it inside the module on the next apply
    2. BUse a moved block that maps the old address to the new module address, so the state is updated without a replacement
    3. CRename the resource in the configuration only, and expect Terraform to match it by name automatically
    4. DCopy the resource's state file into the module directory by hand before running terraform plan
    Show answer and explanation
    Correct answer: B

    A moved block records that the resource's address has changed, so Terraform updates state without destroying the object. Deleting from state causes recreation, a rename alone is treated as a delete and create, and hand-copied state files are unsafe.

  5. Question 5

    A resource is created outside Terraform, and the team wants Terraform to manage it from now on. Which feature brings it under management declaratively?

    1. AAn import block in the configuration, paired with a matching resource block, which is then applied
    2. BA data block that reads the resource, so that Terraform can display its attributes in the plan
    3. CA local value that copies the resource ID into a variable for use in other modules
    4. DAn output block that exports the resource's ID, which adds it to the state automatically
    Show answer and explanation
    Correct answer: A

    An import block with a matching resource block brings an existing object under management declaratively. A data block only reads, a local value holds an expression, and an output exports values without adding state.

Security and Policy (5 questions)

  1. Question 6

    Which practice keeps cloud credentials out of Terraform configuration files?

    1. AUsing dynamic credentials, such as workload identity or short-lived tokens, supplied by the environment
    2. BCommitting the credentials to a private repository, so that only the team can read them
    3. CHard-coding the access key in the provider block, so that the configuration works everywhere
    4. DWriting the credentials in a comment at the top of the main file for the team's reference
    Show answer and explanation
    Correct answer: A

    Dynamic, short-lived credentials supplied by the environment keep secrets out of code. Hard-coded keys, committed credentials and comments all expose them.

  2. Question 7

    A sensitive output, such as a generated password, should be hidden in the console output of a run. Which setting does this?

    1. ADeleting the output block, which hides the value but also removes it from the configuration
    2. BMarking the output as sensitive, so its value is redacted in the run output
    3. CSetting the output's description to a secret phrase that is known only to the team
    4. DWriting the output to a public file, so that it is visible to everyone who needs it
    Show answer and explanation
    Correct answer: B

    Marking the output sensitive redacts it in the run output. Deleting the block removes the value entirely, descriptions do not hide anything, and public files expose it.

  3. Question 8

    Which tool enforces organisational rules, such as allowed instance types, on Terraform plans before apply?

    1. Aterraform fmt, which only formats the configuration files into the standard style
    2. Bterraform console, which evaluates expressions interactively for the engineer's testing
    3. CPolicy-as-code with Sentinel or OPA, which evaluates the plan against defined rules
    4. Dterraform version, which prints the version of the CLI installed on the engineer's machine
    Show answer and explanation
    Correct answer: C

    Policy-as-code with Sentinel or OPA evaluates plans against organisational rules before apply. fmt, console and version do not enforce policy.

  4. Question 9

    An engineer must confirm that a module behaves correctly before the team relies on it. Which Terraform capability provides automated tests for modules?

    1. Aterraform test, which runs test files that plan or apply the configuration and assert on the results
    2. Bterraform output, which prints the outputs of the last run for the engineer to read by eye
    3. Cterraform graph, which draws the dependency graph of the resources in the configuration
    4. Dterraform providers, which lists the providers that the configuration requires for its resources
    Show answer and explanation
    Correct answer: A

    terraform test runs test files with assertions against plan or apply results, which makes module behaviour verifiable. Output, graph and providers commands display information rather than asserting behaviour.

  5. Question 10

    Which two controls reduce the risk of an unintended destroy during a Terraform apply? (Choose two.)

    1. ARequire a reviewed plan before apply, with a check for destroy actions
    2. BRun apply with auto-approve on every branch, so that changes are never delayed by review
    3. CApply prevent_destroy to critical resources, such as databases and storage with data
    4. DDelete the plan output after each run, so that no one can accidentally apply an old plan
    5. ERun apply directly against production from any branch, without a plan first
    Show answer and explanation
    Correct answer: A, C

    A reviewed plan with a destroy check and prevent_destroy on critical resources guard against accidental deletion. Auto-approve, deleting plan output and applying without a plan remove those guards.

State Management (5 questions)

  1. Question 11

    Two engineers run terraform apply against the same state at the same time. What protects the state from corruption?

    1. ASetting parallelism to one on the CLI, which serialises the apply for every user of the workspace
    2. BStoring the state file in version control so that merges resolve any differences automatically
    3. CBackend locking, such as a DynamoDB lock table or the run queue
    4. DDeleting the lock file manually before each apply, so that only one engineer's run is ever active
    Show answer and explanation
    Correct answer: C

    Backends that support locking, such as S3 with a DynamoDB table or Terraform Cloud's run queue, prevent concurrent writes. Version control does not lock state, parallelism settings do not serialise separate machines, and deleting locks removes the protection.

  2. Question 12

    A resource was changed manually in the cloud console. What should the engineer run to detect the difference from the declared configuration?

    1. Aterraform plan with refresh, which compares the real infrastructure against state and config
    2. Bterraform fmt, which rewrites the configuration files into the canonical formatting style
    3. Cterraform validate, which checks the configuration for syntax and internal consistency only
    4. Dterraform output, which prints the values of the outputs recorded in the current state file
    Show answer and explanation
    Correct answer: A

    terraform plan refreshes the state from the real infrastructure and shows any drift from the configuration. fmt formats files, validate checks syntax, and output prints recorded values without checking the real infrastructure.

  3. Question 13

    Why should sensitive values such as database passwords be kept out of the plain state file?

    1. AThe state file is read-only, so passwords stored in it can never be changed later
    2. BTerraform deletes the state file after each apply, so secrets in it are lost on their own
    3. CState contains resource attributes in plain text, so anyone with state access can read the secrets
    4. DTerraform encrypts all state values automatically, so there is no need to restrict access
    Show answer and explanation
    Correct answer: C

    State records attribute values in plain text, so secrets in state are exposed to anyone who can read it. Terraform does not encrypt state automatically, does not make it read-only, and does not delete it after apply.

  4. Question 14

    Which command removes a resource from Terraform's state without destroying the real infrastructure?

    1. Aterraform destroy, which removes every managed resource and its real infrastructure
    2. Bterraform state rm, which stops Terraform tracking the resource but leaves it in place
    3. Cterraform taint, which marks a resource for recreation on the next apply
    4. Dterraform apply -refresh-only, which updates state from the real infrastructure only
    Show answer and explanation
    Correct answer: B

    terraform state rm stops tracking the resource while leaving the real infrastructure intact. destroy removes infrastructure, taint marks a resource for replacement, and refresh-only updates state without removing it.

  5. Question 15

    Which two practices keep Terraform state safe and recoverable? (Choose two.)

    1. AStore state in a remote backend with encryption and access controls
    2. BKeep state only on each engineer's laptop, so that no shared file can be overwritten
    3. CEnable versioning on the state storage, so that an earlier state can be restored
    4. DEdit the state file by hand each time a resource changes, to keep it up to date
    5. EDelete state backups after every apply, to keep the storage small and tidy
    Show answer and explanation
    Correct answer: A, C

    A remote, encrypted backend with access control and state versioning protect and allow recovery. Laptop-only state diverges, hand edits corrupt it, and deleting backups removes recovery options.

Modules (5 questions)

  1. Question 16

    What is the purpose of a Terraform module?

    1. ATo hold the provider credentials used by every configuration in the same repository
    2. BTo package a reusable set of resources behind input variables and outputs
    3. CTo store the state of a configuration in a separate file on a remote backend
    4. DTo define the order in which resources are created, without grouping them logically
    Show answer and explanation
    Correct answer: B

    A module packages reusable resources behind inputs and outputs. Credentials belong in provider or variable configuration, state is stored by backends, and ordering is handled by dependencies, not modules.

  2. Question 17

    A shared module must be used by several teams, and each team must control which version it runs. Which practice achieves this?

    1. ACopy the module's files into each team's repository and edit them as needed for that team
    2. BReference the module from a version-pinned source, such as a Git tag or a registry version constraint
    3. CReference the module from the main branch, so every team always gets the latest changes
    4. DPoint each team at a shared local path on one developer's laptop, which is updated by hand
    Show answer and explanation
    Correct answer: B

    A version-pinned source, such as a Git tag or a registry version constraint, lets each team choose and upgrade deliberately. Copies drift, the main branch changes under every team, and a laptop path is not shared or controlled.

  3. Question 18

    Inside a module, which block exposes a value to the caller so that it can be used elsewhere in the configuration?

    1. AA variable block, which accepts an input from the caller of the module
    2. BA terraform block, which sets the required Terraform version and the backend for the module
    3. CA provider block, which configures the connection to the cloud platform used by the module
    4. DAn output block, which exposes a value from the module to the calling configuration
    Show answer and explanation
    Correct answer: D

    An output block exposes a value to the caller. Variable blocks accept inputs, provider blocks configure connections, and terraform blocks set version and backend requirements.

  4. Question 19

    Which approach lets one resource block create several similar resources, each with a different name taken from a map?

    1. AA lifecycle block with ignore_changes set to every attribute of the resource
    2. BA moved block that renames the resource once for each entry in the map
    3. CA depends_on list that names every resource that the block should create
    4. DA for_each meta-argument, iterating over the keys of the map
    Show answer and explanation
    Correct answer: D

    for_each creates one instance per map key, each with its own name. lifecycle, depends_on and moved blocks do not create multiple instances from a map.

  5. Question 20

    Which two practices make a Terraform module easier to reuse safely? (Choose two.)

    1. AExpose inputs with types, descriptions and validation rules
    2. BHard-code the environment name and region inside every resource in the module
    3. CDocument the outputs and the required providers in the module's README
    4. DRead every variable from a global environment file that the caller must also edit
    5. EAvoid versioning, so that every caller always gets the newest module behaviour immediately
    Show answer and explanation
    Correct answer: A, C

    Typed, validated and documented inputs and documented outputs and providers make modules reusable and safe. Hard-coded environments, hidden global files and unversioned modules each make reuse risky.

Providers and Configuration (5 questions)

  1. Question 21

    A configuration uses two instances of the same AWS provider in different regions. Which feature selects between them?

    1. AProvider aliases, referenced in resources with the provider meta-argument
    2. BTwo separate provider blocks with the same name and no alias set
    3. CA variable named region, which the provider reads automatically from the environment
    4. DA data block that looks up the region and switches the provider at plan time
    Show answer and explanation
    Correct answer: A

    Provider aliases define multiple configurations of the same provider, which resources select with the provider argument. Duplicate unaliased blocks are an error, and variables or data blocks do not select a provider instance.

  2. Question 22

    Where should provider versions be constrained so that a provider upgrade cannot change behaviour unexpectedly?

    1. AIn the state file, which records the provider version used for the last successful apply
    2. BIn the operating system's environment variables, set separately on each engineer's workstation
    3. CIn a required_providers block with a version constraint, committed with the configuration
    4. DIn a comment at the top of the main file, which the team agrees to follow when upgrading
    Show answer and explanation
    Correct answer: C

    A required_providers block with a version constraint, committed to version control, pins the provider for everyone. Environment variables, state and comments do not enforce a provider version.

  3. Question 23

    A value in a configuration must be computed from another resource's attribute and reused in several places. Which construct is appropriate?

    1. AA provisioner block, which runs a local command during the apply for every resource
    2. BAn output block, which exposes the value only to the callers of the module, not within the module
    3. CA variable with no default value, which must be typed in by hand for every run
    4. DA locals block, which names an expression so it can be reused within the configuration
    Show answer and explanation
    Correct answer: D

    A locals block names an expression for reuse inside the configuration. Outputs expose values externally, variables take inputs, and provisioners run commands rather than define values.

  4. Question 24

    Which two statements about Terraform variables are correct? (Choose two.)

    1. AA variable with a default value can be overridden by the caller or by a variable file
    2. BVariables with no default must be supplied by the caller, or the plan fails for missing input
    3. CVariable values are always written to the configuration files as a side effect of each run
    4. DSensitive variables are displayed in full in every plan output by default
    5. EVariables can be defined in a module and read by its parent without an output block
    Show answer and explanation
    Correct answer: A, B

    Defaults can be overridden, and variables without defaults must be supplied. Values are not written into configuration files, sensitive variables are redacted in output, and a parent reads only through outputs.

  5. Question 25

    Which Terraform feature lets a provider read existing resources without managing them?

    1. AA data source block, which reads existing objects and exposes their attributes
    2. BA resource block with the lifecycle ignore_changes set to every attribute of the object
    3. CA provisioner block, which runs commands on the object during the apply for the team
    4. DAn import block without a matching resource, which adds the object to state only
    Show answer and explanation
    Correct answer: A

    A data source reads existing objects without managing them. The other options either manage the object or do not read it safely.

Terraform Cloud and Collaboration (5 questions)

  1. Question 26

    A team wants a pull request to show the planned changes to infrastructure before anyone approves an apply. Which workflow provides this?

    1. ACommit the plan file to the repository and merge it without any review of its contents
    2. BApply directly from each developer's laptop once the code has been reviewed by one colleague
    3. CRun plan automatically on each pull request, and require approval before apply runs on the merged code
    4. DSkip plan entirely, since the apply output shows the same changes after the infrastructure is changed
    Show answer and explanation
    Correct answer: C

    Running plan on pull requests shows the changes for review, and gating apply on approval keeps humans in control. Laptop applies, merged plan files and skipping plan remove the review point.

  2. Question 27

    Which feature of HCP Terraform or Terraform Enterprise limits who can apply changes to a workspace?

    1. AA shared login used by every team member, so that changes are recorded under one identity
    2. BTeam-based access controls on each workspace, with separate permissions to plan and to apply
    3. CPublic access to the workspace, so that any authenticated user on the internet can apply changes
    4. DTurning off run history, so that changes are not visible to other members of the organisation
    Show answer and explanation
    Correct answer: B

    Team-based access controls with separate plan and apply permissions limit who can change a workspace. Shared logins remove accountability, public access and disabled history each weaken control.

  3. Question 28

    A variable value must be shared by many workspaces without being stored in each configuration. Which HCP Terraform feature fits?

    1. AA value committed to the configuration files in each repository, which is then read by each team
    2. BA copy of the value written into every workspace by hand, which the team checks each quarter
    3. CA variable set, applied to the workspaces that need it, so the value is defined once
    4. DA value passed as a command-line argument on each run by whoever starts the apply
    Show answer and explanation
    Correct answer: C

    Variable sets define values once and apply them to many workspaces. Manual copies, committed values and command-line arguments each duplicate or expose the value.

  4. Question 29

    A team wants production applies to require approval from a second person before they run. Which HCP Terraform setting provides this?

    1. AApply requires manual confirmation, with a governance setting that needs a reviewer
    2. BA run task that approves every run automatically without any human review
    3. CA variable marked sensitive, which blocks the apply until the value is entered by someone
    4. DA notification sent to the team channel, which reports each run after it has been applied
    Show answer and explanation
    Correct answer: A

    Manual apply confirmation with reviewer governance enforces the second-person approval. Automatic approval, sensitive variables and notifications do not require approval.

  5. Question 30

    Which VCS-driven workflow starts a run automatically when code is merged to the main branch?

    1. AA nightly scheduled job that applies the configuration whether or not any code has changed
    2. BA local CLI run started by the engineer at the terminal after the merge, by hand
    3. CA manual upload of the configuration files through the web console each time code changes
    4. DA VCS-connected workspace, which triggers runs from repository events such as a merge
    Show answer and explanation
    Correct answer: D

    A VCS-connected workspace triggers runs from repository events, including merges. Manual CLI runs, uploads and unrelated schedules do not follow the merge event.