Infrastructure practice

{{ summaryValue }}

{{ summaryLine }}

Exam target:

HashiCorp Certified: Terraform Associate (004) · English · Terraform 1.12

Official information verified 13 September 2026. This is a verification date, not a launch date. Official exam information

Unofficial practice, unaffiliated with and not endorsed by HashiCorp. Terraform and HashiCorp are trademarks of their respective owners.

40 original, curated scenarios cover all eight groups and map to all 37 subobjectives. These are untimed single-answer rounds with uniform sampling and uncalibrated difficulty. The real 60-minute knowledge exam also includes true/false and multiple-answer questions. This bank is not exhaustive, adaptive, blueprint-weighted, an official mock, or a pass prediction.

Basic terminal skills and knowledge of cloud or on-premises architecture are the expected background. Production experience is recommended; no prior certification is stated as mandatory. Official proctored appointments have separate identity, room and computer requirements; the credential is valid for two years. Appointment requirements

Select across the whole bank or focus on one group. A short all-group round may leave some groups unsampled; no official weights are assumed.

Optional. Blank uses terraform-004-practice. Keep the same setup and seed for exact replay; a new seed can repeat items from this finite bank.

{{ examSetupValidation }}

{{ progressPercent }}%
{{ answeredCount }} of {{ questionCount }} answered

{{ currentQuestion.category_label }} · {{ objectiveLabel(currentQuestion.id) }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

Answer recorded. Corrections will appear at the end of the round.

Review this practice round

{{ attemptContext }}

Readiness review

{{ resultLead }}

Unofficial, unaffiliated practice for English Terraform Associate (004) / Terraform 1.12, verified 13 September 2026. This curated, untimed single-answer bank is uniformly sampled, has uncalibrated difficulty, and provides no pass prediction or official scaled score. The real 60-minute exam also uses true/false and multiple-answer formats. A sampled group is not proof of full objective coverage. Practical Terraform skill needs hands-on work beyond this bank.

Review the official objective list and use its documentation and exercises for deeper study.

Missed decisions

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    {{ sourceLabel(item.question_id) }}

Choose the next study step

  • {{ row.label }}

    {{ row.answered_count ? `${row.correct_count} correct · ${row.incorrect_count} missed in this round` : 'Not sampled in this round' }}. {{ studyHint(row.category_id) }}

Domain performance

Which objective groups need another look? Bars count correct and missed answers in this round. Groups with no answers have zero bars and are labelled “Not sampled” above; these are not official weights.

{{ examChartStatus }}

Answer ledger

QuestionAnswersExplanationSourceCopy
{{ row.question_id }}

{{ row.prompt }}

{{ row.category_label }} · {{ objectiveLabel(row.question_id) }}

Your answer: {{ row.selected_answer_label }}

Correct answer: {{ row.correct_answer_label }}

Outcome: {{ row.outcome_label }}		 {{ row.explanation }} {{ row.question_id }}{{ sourceLabel(row.question_id) }}{{ sourceUrl(row.question_id) }}{{ row.source.version }}
Terraform Plan Summary Analyzer Analyze Terraform plan JSON or text before apply, flag destructive changes and drift, and rank resources by review risk without uploading plan data.
Terraform Variable Defaults Checker Review Terraform variable blocks for unsafe defaults and secret-like values, then prioritize type mismatches, version conflicts and fixes.
Cloud-init Network Config Generator Build cloud-init version 2 YAML for a static VM interface, with CIDR and route validation plus warnings for risky boot assumptions.
AWS Cloud Practitioner Exam Prep Practise AWS Cloud Practitioner CLF-C02 concepts with original questions, immediate explanations and focused reviews of missed answers.

A Terraform configuration can pass validation and still propose an unwanted infrastructure change. Validation checks the configuration's structure; a plan shows the proposed effect for a particular set of inputs and existing resources. Preparing for Terraform Associate means understanding that distinction before deciding which command or configuration change fits a situation.

Infrastructure as Code (IaC) replaces a sequence of manual setup instructions with a version-controlled description of the infrastructure that should exist. Terraform uses declarative configuration, commonly written in HashiCorp Configuration Language (HCL), to describe resources and their arguments. A team can review the configuration change alongside its plan, rather than relying on a record of console clicks or assuming yesterday's successful deployment approves today's edit.

Three related records explain much of Terraform's behavior.

Configuration
The desired resources, settings, and relationships. It expresses intent rather than the exact sequence of service operations.
State
The recorded connection between resource instances in configuration and the real objects Terraform manages, together with information needed for later operations.
Plan
The proposed actions for a particular run. Planning normally checks managed objects through their providers before comparing their observed settings with configuration.

These records can disagree. An emergency change made directly in a cloud console can leave the remote object different from Terraform's configuration and recorded state. This is drift. Accepting that change into state does not automatically rewrite the configuration, so a later normal plan may still propose changing the object back. Deciding which settings should remain is part of the infrastructure work, not something a successful command decides for the operator.

Providers connect Terraform to each service's application programming interface (API). The write, plan, and apply workflow can span cloud platforms and on-premises systems, but their resource types, credentials, and permissions remain service-specific. A managed resource describes an object Terraform should manage; a data source reads information without taking over the source object's lifecycle. Confusing the two can turn an intended lookup into a proposal to manage a new object.

Reusable modules let teams share configuration while passing different inputs for development and production. Their input and output interfaces matter: a child module does not automatically receive a parent's input merely because both variables have the same name. Collaboration also requires agreement about state access and who may approve or perform changes. HashiCorp Cloud Platform (HCP) Terraform provides workspace-based workflows and governance capabilities, but grouping workspaces does not combine their infrastructure into one state.

HashiCorp Certified: Terraform Associate (004) is an English, 60-minute knowledge exam targeting Terraform 1.12. It includes true/false, single-answer, and multiple-answer questions, and the credential is valid for two years. Basic terminal skills and an understanding of cloud and on-premises architecture are the expected starting point. Professional experience is recommended, but the published prerequisites do not list an earlier certification. Conceptual study should be paired with hands-on work in a disposable environment. Recognizing an answer does not demonstrate the ability to operate production infrastructure safely.

How to Use This Tool:

Choose a broad round to find topics to revisit, or concentrate on one objective group. These are original, unofficial practice questions, unaffiliated with and not endorsed by HashiCorp. Every round is untimed and asks for one answer from four choices.

  1. Choose an Objective group and an offered Question count. The starting setup is All eight objective groups with 16 questions; the other all-group lengths are 8, 24, and 40. Focused groups offer 1 or 3 questions, or the whole group when it contains more than 3.
  2. Choose Feedback timing. After each answer, the default, shows the correction and explanation before you advance. At the end records each answer without revealing whether it was correct until the final review.
  3. Enter an optional Replay seed under Advanced when you want a repeatable round. Blank or space-only input uses terraform-004-practice, and surrounding spaces are ignored. Keep the same bank, objective group, count, feedback timing, and seed to reproduce the questions and choice order.
    The seed has a 128-character limit, with some emoji occupying more than one character position. If the setup message reports a seed-length problem, shorten the seed before starting.
  4. Select Start practice and work through the questions. Selecting an answer immediately records and locks it; there is no separate submission or answer-editing step. Use Next question after each recorded answer. End round and change setup discards the active attempt rather than producing a partial final review.
  5. Select View results after the final answer, then read Missed decisions and the source-linked explanations in the Answer ledger. When there are misses, Retry missed starts a round containing only those questions. Practise this group returns to setup with that group's full question count selected, ready for another round.

Interpreting Results:

During a round, the summary counts answers recorded, not answers correct. The final fraction counts correct answers out of all questions in that round. Readiness review is a study review, not a readiness grade, an official scaled score, or a pass prediction. There is no practice pass mark.

Use the reasoning in Missed decisions to identify the distinction you missed, such as validation versus planning or redaction versus secret persistence. The Answer ledger also explains the questions you answered correctly, including why the other choices do not fit. A correct guess still deserves that review.

Domain performance shows counts of correct and missed answers, not weighted domain scores. Not sampled in this round means there is no evidence about that group, not a zero score or a mastered topic. A short all-group round can omit entire groups, and answering one question from a group does not test all of its subobjectives.

After a round with no misses, explain the choices without seeing the options and practise the corresponding Terraform workflows in a disposable environment. Replay same seed repeats the questions and option order with fresh responses. Try a new seed can still repeat familiar items. Neither replay measures broader skill on its own. If the chart cannot load, the written group counts and answer review remain available; Retry chart attempts to draw it again.

Technical Details:

Terraform derives operation order from dependencies between resources, not their alphabetical names or position in a file. A reference to another resource's attribute supplies both a value and a dependency. Providers carry out the service operations, while state preserves resource bindings for subsequent runs. Command choice determines whether the task checks configuration, proposes changes, or executes them.

What Terraform commands check, preview and change

The following distinctions apply to the Terraform 1.12 study target. A command that checks or previews something is not approval to modify infrastructure.

Command What it does Important limit
terraform init -backend=false Initializes the dependencies needed for configuration validation without initializing the configured backend. It is not a deployment or a check of live provider credentials.
terraform fmt -check -recursive Checks canonical formatting in the current directory and its subdirectories without rewriting files. Formatting does not establish configuration validity or infrastructure safety.
terraform validate Checks syntax and internal consistency in an initialized configuration. It does not verify remote services or replace a plan for the intended workspace and input values.
terraform plan -out=review.plan Proposes operations and saves a plan that can be supplied to a later apply. Saved plans can contain sensitive values. Copied terminal text is not a saved executable plan.
terraform apply review.plan Executes the supplied valid saved plan without an additional interactive approval prompt. Supplying the plan counts as approval; an invalid or stale plan can still be rejected.
terraform plan -destroy Previews destruction of managed infrastructure. It does not execute the destruction. A destroy operation is a separate, consequential action.
terraform plan -refresh-only Proposes updating state and root outputs to reflect changes already made to remote objects. It does not propose changing infrastructure or rewrite the desired configuration.

A plain terraform apply creates a new plan and normally asks for approval. Applying a saved plan instead executes the already selected operations. Disabling refresh is another distinct choice: -refresh=false skips checking remote changes and can produce an incomplete plan; it is not an alternative spelling of refresh-only mode.

Provider selection and module interfaces

Provider version constraints describe acceptable versions. The dependency lock file, .terraform.lock.hcl, records the selected provider versions and checksums. Ordinary initialization reuses a compatible recorded version; requesting an upgrade changes that selection behavior. In Terraform 1.12, this file does not lock remote module versions.

A provider alias selects a configured instance of a provider, such as a different account or region. In native HCL, provider = aws.audit references the provider configuration with the alias audit. Declaring an alias and assigning a resource to that alias are different operations.

A relative local module source uses a path such as source = "./modules/service". Registry module calls support a version constraint, whereas Git sources select a revision through ref. Module inputs have their own scope and defaults. The caller passes values explicitly, and a single child-module call exposes declared outputs through expressions such as module.network.subnet_id, not arbitrary access to the child's internal resources.

Dependencies, validation, and protection limits

Resource references usually express dependencies directly. Use depends_on for a genuine dependency that cannot be inferred from an argument reference, and document the reason. Moving a block earlier in a file does not establish that dependency. Input variable validation can reject a known invalid value and stop an operation; a failed check assertion produces a warning rather than the same blocking behavior.

Lifecycle protection also has a defined scope. prevent_destroy rejects destructive plans while the rule is present in configuration. Removing the entire resource block removes that protection; it is not a permanent deletion lock in the remote service.

Marking a value sensitive = true controls its display, not encryption or omission from state and plan files. Terraform 1.12 supports ephemeral values, which are not persisted in those files, but restricts where they can be used. An ephemeral input can flow to a write-only resource argument only when the provider supports that argument. Sensitive marking can additionally hide its display. Root-module outputs cannot be ephemeral, and an ordinary persisted resource argument is not a valid destination for an ephemeral value.

State and team operations

A backend determines where state is stored. The local backend stores state locally, uses system-based locking, and runs operations locally. Remote state storage does not make all backends identical: locking support depends on the backend. When a lock cannot be acquired, check whether another run still owns it. Force-unlock is for your own abandoned lock after automatic unlocking fails, not for bypassing another person's active operation.

Importing an existing object binds it to a resource address. For the terraform import command, the destination resource must already be declared; the command does not write its full configuration for you. A subsequent plan reveals differences that need reconciliation. Each remote object should be bound to only one resource instance.

HCP Terraform workspaces maintain separate configurations, states, and run settings. Projects organize those workspaces and their access without merging state. With remote execution selected, initiating a run from the command-line interface (CLI) does not mean the operations execute on that local computer. Workspace policy sets can evaluate proposed changes using frameworks such as Sentinel or Open Policy Agent (OPA); availability, enforcement, and override permissions depend on the organization's setup.

The cloud block belongs inside terraform and supplies HCP connection settings. Authentication and initialization are separate requirements, and existing state may need deliberate migration. A root configuration cannot use both a cloud block and a backend block.

Curated coverage and selection

The practice bank contains 40 original scenarios whose objective labels span all 37 subobjectives across the eight published 004 groups. A label identifies the intended topic; it does not show that every skill within that subobjective has been tested. The distribution below describes this authored bank, not official exam weights.

Objective group Questions Representative concepts
1 · Infrastructure as Code (IaC) with Terraform 3 Desired state, reviewable changes, and workflows spanning services.
2 · Terraform fundamentals 4 Provider versions, provider responsibilities, aliases, and state bindings.
3 · Core Terraform workflow 7 Initialization, validation, plans, applying, destruction previews, and formatting.
4 · Terraform configuration 11 Data sources, references, types, expressions, conditions, lifecycle rules, and secrets.
5 · Terraform modules 4 Local sources, input scope, outputs, and source-specific version selection.
6 · Terraform state management 4 Local and remote backends, locking, and drift reconciliation.
7 · Maintain infrastructure with Terraform 3 Import, state inspection, and diagnostic logging.
8 · HCP Terraform 4 Remote runs, policies, projects, workspaces, and connection settings.

Questions are selected uniformly without replacement from the chosen pool, so an item does not repeat within a round. Selection is not balanced to guarantee a question from each group. The questions are chosen at the start rather than adapting to your answers. A 40-question all-group round necessarily uses the whole bank, including its unequal numbers of questions per group. Changing a seed cannot expand that finite coverage.

The exam-information snapshot recorded with the practice is dated 13 September 2026. That is a verification date, not the exam's launch date. The bank is not exhaustive, difficulty-calibrated, or an official mock exam. Official appointments have separate identity, computer, and testing-room requirements. Check the current provider requirements before booking; completing practice does not register you for an exam or award a credential.

Calculating practice accuracy and completion

Each correct answer earns one point and each incorrect answer earns zero, with no partial credit or negative marking. Let N be the number of questions in the round, A the number answered, and C the number correct. The point total is C out of N; raw accuracy is the corresponding percentage.

P = 100 × CN

P is raw accuracy in percent, not a probability of passing. The main result displays the exact correct-count fraction. The denominator remains the full round even before completion; unanswered questions do not earn points, but they are not counted as incorrect answers.

The progress bar measures how much of the round has been answered and rounds to the nearest whole percent, with nonnegative half-percent ties rounding up.

G = round ( 100 × AN )

G is the displayed progress percentage. Completion requires every question to be answered, so 100% progress does not imply a perfect score. For a three-question round with one answer recorded correctly, progress is 33%, there are no misses yet, and the remaining two questions are unanswered. At completion, group counts sum to the round's correct and missed totals. No cutoffs convert those counts into passing, failing, or certification readiness.

Privacy Notes:

Answers are checked in your browser, but the attempt is also encoded in the page URL so a compatible saved link can restore its setup, responses, and position. Encoding is not encryption. Anyone receiving that link can reopen the responses; the URL can remain in browser history and be sent to the site when opened or reloaded. Use a generic replay seed rather than personal information or credentials.

Browser scoring does not mean the page makes no network requests. Page resources, chart and document features, and opened references can use the network. Exported answer ledgers contain the selected responses, so treat them as study records when sharing.

A damaged link or an attempt from an incompatible bank displays Saved attempt unavailable and cannot be resumed. Start a new round with the current bank. If the page reports that the round could not be saved in the URL, keep that page open to finish; do not rely on the link to preserve the attempt.

Worked Examples:

A focused retry changes the denominator

Complete the default 16-question all-group round with 13 correct answers and 3 misses. The final summary shows 13/16, and Missed decisions contains those 3 questions. Selecting Retry missed creates a three-question round. Answering all three correctly produces 3/3, not a revised 16/16. That result records correction of the selected mistakes after review; it is not a new broad assessment or evidence that unsampled topics are understood.

A child module still uses its own default

In the module-scope scenario, the root input is "staging", the child declares a default of "dev", and the module call passes no value for that input. Selecting the answer that the child uses "dev" is correct. The explanation identifies separate module scope as the reason. To pass the root value in a real configuration, the caller would explicitly set environment = var.environment in the module call. The practice records the conceptual choice; it does not execute or validate that Terraform configuration.

References: