Terraform Associate · 13% of the exam

Infrastructure as Code (IaC) with Terraform: free practice questions

5 sample questions from our 38-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real HashiCorp exam.

1. A Terraform configuration creates an Azure Virtual Network. An engineer runs `terraform apply` and the network is created successfully. Two days later, another engineer manually resizes the address space via the Azure portal. When the first engineer runs `terraform apply` again without changing any configuration files, what is the MOST likely outcome?

  • A. Terraform will skip the resource because it was already created and takes no action.
  • B. Terraform will detect the drift between the desired state in the configuration and the actual state in Azure, and will modify the Virtual Network to match the configuration.✓ Correct
  • C. Terraform will destroy the entire resource group and recreate it from scratch.
  • D. Terraform will prompt the engineer to manually resolve the conflict in the Azure portal before proceeding.
Explanation

Option B is correct: this is Terraform's idempotency in action. On the second `apply`, Terraform refreshes state, detects that the live resource differs from the desired configuration, and generates a plan to reconcile the drift by updating the address space back to the configured value. Option A is wrong; Terraform does not simply skip existing resources — it compares current state to desired state on every apply. Option C is incorrect; Terraform does not destroy and recreate an entire resource group for a single attribute change unless the specific attribute forces replacement. Option D is false; Terraform handles drift reconciliation automatically and does not redirect users to the console.

2. A DevOps team currently provisions AWS resources by manually clicking through the AWS Management Console. A senior engineer argues they should migrate to Terraform. Which TWO benefits of Infrastructure as Code directly address the risks of manual console-based provisioning?

  • A. Configurations can be stored in version control, providing a full history of every infrastructure change.✓ Correct
  • B. Terraform automatically selects the cheapest cloud region for each resource.
  • C. Infrastructure changes are consistent and repeatable, eliminating configuration drift caused by human error.✓ Correct
  • D. Terraform natively compresses and encrypts all state files stored in S3.
  • E. Terraform can generate compliance audit reports in PDF format.
Explanation

Correct (A, C): Version control (A) solves the auditability problem — every change is tracked, attributed, and reversible, which is impossible with manual console clicks. Consistency and repeatability (C) solve configuration drift — the same Terraform configuration always produces the same infrastructure, whereas humans clicking through a console make mistakes and produce subtly different environments. (B) is wrong — Terraform does not analyze or select cloud regions based on cost; that is outside its scope. (D) is wrong — Terraform does not natively compress or encrypt S3 state files; encryption must be configured at the S3 bucket level or via a KMS key in the backend config. (E) is wrong — Terraform produces no compliance PDF reports; that is the domain of separate audit/compliance tools.

3. Which THREE of the following are characteristics that distinguish Terraform Enterprise from HCP Terraform? (Select THREE)

  • A. Terraform Enterprise is deployed in the customer's own environment (on-premises or private cloud), giving the organization full control over the infrastructure.✓ Correct
  • B. Terraform Enterprise supports a private module registry, whereas HCP Terraform does not offer any module registry.
  • C. Terraform Enterprise is designed for enterprises with requirements such as air-gapped deployments, custom SAML SSO integration, and audit logging beyond what is available on HCP Terraform's free and standard tiers.✓ Correct
  • D. Terraform Enterprise allows organizations to define their own data residency and retention policies, which is critical for regulatory compliance in certain industries.
  • E. Terraform Enterprise includes the Terraform CLI binary, which is not available with HCP Terraform.
  • F. Terraform Enterprise provides a self-hosted option, meaning the organization is responsible for installation, upgrades, and operational maintenance of the platform.✓ Correct
Explanation

Options A, C, and F are correct. Terraform Enterprise (TFE) is self-hosted (A), supports advanced enterprise requirements like air-gapped deployments and extended audit capabilities (C), and places the operational burden of installation and maintenance on the customer's team (F). Option B is false; HCP Terraform also provides a private module registry. Option D is partially true in practice but is not a distinguishing feature listed in HashiCorp's official differentiation — data residency is primarily addressed by self-hosting (already covered by A), and HCP Terraform Business also offers some data handling controls. Option E is false; the Terraform CLI is a separate open-source binary available to all users regardless of whether they use Cloud or Enterprise.

4. A team runs `terraform apply` on Monday and successfully creates an S3 bucket. On Wednesday, a developer manually deletes the bucket via the AWS CLI. On Thursday, the team runs `terraform apply` again with the exact same configuration file and no code changes. What will Terraform do?

  • A. Terraform will detect no changes because the configuration has not been modified, and it will exit without making any changes.
  • B. Terraform will fail with an error because the resource no longer exists in the state file.
  • C. Terraform will detect that the bucket is missing compared to the desired state and will recreate it to match the configuration.✓ Correct
  • D. Terraform will prompt the user to manually re-create the bucket before proceeding.
Explanation

Correct (C): This scenario demonstrates Terraform's idempotency. On the second `terraform apply`, Terraform runs a refresh (comparing the real infrastructure to the state file), detects that the S3 bucket no longer exists, and creates it again to reconcile the real world with the desired state. The configuration has not changed, but the actual infrastructure has drifted. (A) is wrong — Terraform does not compare configuration-to-configuration; it compares desired state to actual state, so it *will* detect the drift. (B) is wrong — a missing resource does not cause an error during plan/apply; Terraform treats it as a resource that needs to be created. (D) is wrong — Terraform does not require manual user intervention for missing resources; it handles recreation automatically.

5. An engineer is evaluating Terraform against Ansible for a new project that requires both provisioning cloud VMs and configuring the software stack (web server, database) on those VMs after they are created. Which statement MOST accurately describes the recommended approach?

  • A. Ansible should handle all tasks because it is a cloud-agnostic provisioning and configuration tool with first-class Terraform support built in.
  • B. Terraform should handle all tasks because it includes built-in package management modules for Linux distributions.
  • C. Terraform is best suited for provisioning the cloud infrastructure (VMs, networking, storage), while Ansible excels at configuration management (installing software, managing services) on existing machines; using both together is a common and recommended pattern.✓ Correct
  • D. Terraform and Ansible are functionally identical for this use case because both use a declarative, desired-state model.
Explanation

Option C is correct: Terraform is optimized for provisioning and lifecycle management of cloud resources, while Ansible is purpose-built for configuration management on existing machines. Combining them is a widely recommended pattern. Option A is false; Ansible does not have first-class Terraform support built in, and while it has some cloud modules, it is not the strongest tool for full cloud provisioning lifecycle management. Option B is false; Terraform does not include built-in package management — that is the domain of configuration management tools like Ansible, Chef, or Puppet. Option D is false; Ansible is largely imperative (procedural playbooks) rather than purely declarative like Terraform.

33 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free