Terraform Associate · 13% of the exam

Terraform fundamentals: free practice questions

5 sample questions from our 60-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real HashiCorp exam.

1. A team uses Terraform to manage an AWS VPC. A network engineer manually added a subnet directly in the AWS console (outside of Terraform). The engineer then runs `terraform plan`. What will Terraform report about this manually created subnet?

  • A. Terraform will detect the new subnet and automatically import it into state, then show it as a managed resource.
  • B. Terraform will show no changes because it does not track resources it did not create.
  • C. Terraform will show no changes for the manually created subnet because it is not in the Terraform state; it only reports on resources it is tracking.✓ Correct
  • D. Terraform will show the subnet as a resource to be destroyed, because any resource not defined in the configuration will be removed.
Explanation

Correct: C. Terraform only plans changes for resources that are tracked in its state file. A manually created resource that was never imported or created by Terraform does not exist in state, so `terraform plan` will not reference it at all — it will not show it as something to create, destroy, or update. A is wrong — Terraform does NOT auto-import resources; import must be done explicitly via `terraform import` (or an `import` block in Terraform 1.5+). B is wrong — C is a more precise answer; Terraform doesn't 'track resources it did not create' isn't fully accurate since it could track imported resources it didn't create. D is wrong — Terraform only destroys resources that are in its state file. Because the manually created subnet is not in state, Terraform has no awareness of it and will not plan to destroy it.

2. A senior engineer reviews a Terraform configuration and finds that a `data` source block is referencing an attribute of a `resource` block in the same configuration, creating a dependency. The engineer is concerned about the plan/apply behavior. Which of the following statements MOST accurately describes how Terraform handles this scenario?

  • A. Terraform always reads all data sources during the `plan` phase, before any resources are created or modified, so a data source cannot reference a resource attribute that does not yet exist.
  • B. Terraform's dependency graph causes the data source to be deferred: if the referenced resource attribute is not yet known (e.g., the resource does not exist yet), the data source read is deferred to the `apply` phase, after the resource is created.✓ Correct
  • C. Referencing a resource attribute from a data source is invalid HCL and will cause `terraform validate` to return an error.
  • D. Terraform will create a circular dependency error during `terraform plan` whenever a data source and a resource block reference each other.
Explanation

Correct: B. Terraform builds a dependency graph and understands that if a `data` source depends on an attribute of a `resource` that doesn't exist yet, it cannot read the data source during the plan phase. In this case, Terraform defers the data source read to the apply phase — after the resource is created and its attributes are known. This is sometimes called a 'deferred read' and means the data source will show as '(known after apply)' in the plan. A is wrong — it is not true that ALL data sources are read during plan; data sources that have dependencies on not-yet-created resources are deferred to apply. C is wrong — referencing a resource attribute from a data source is perfectly valid HCL and passes `terraform validate`. D is wrong — this is not a circular dependency scenario; the data source depends on the resource, forming a one-directional dependency. A circular dependency would require the resource to also depend on the data source.

3. A platform engineer needs to update provider versions in an existing project. The `.terraform.lock.hcl` file currently pins the AWS provider to version `4.67.0`. The engineer wants Terraform to re-evaluate the version constraints in `required_providers` and potentially select a newer version. Which command accomplishes this?

  • A. `terraform init`
  • B. `terraform init -upgrade`✓ Correct
  • C. `terraform providers lock`
  • D. `terraform apply -refresh-only`
Explanation

**Correct: B.** `terraform init -upgrade` instructs Terraform to ignore the currently recorded versions in `.terraform.lock.hcl` and re-resolve all provider and module version constraints, potentially selecting newer versions and updating the lock file. **A is wrong:** Running `terraform init` without `-upgrade` respects the existing `.terraform.lock.hcl` and will not upgrade already-installed providers. **C is wrong:** `terraform providers lock` updates the lock file's cryptographic hashes for additional platforms but does not upgrade provider versions. **D is wrong:** `terraform apply -refresh-only` reconciles state with actual infrastructure; it has no effect on provider versions or the lock file.

4. A `terraform plan` output shows the following symbol next to an `aws_security_group` resource: `-/+`. What does this symbol indicate?

  • A. The resource will be updated in-place; no replacement is required.
  • B. The resource will be destroyed and then recreated because at least one argument requires replacement.✓ Correct
  • C. The resource will be imported into state from the live infrastructure.
  • D. The resource will be removed from the Terraform state file but left intact in the cloud provider.
Explanation

Option B is correct: `-/+` (destroy-then-create, or 'replace') means Terraform will destroy the existing resource and create a new one because one or more changed attributes are marked `ForceNew` in the provider schema. Option A is wrong — an in-place update is shown with `~`. Option C is wrong — import is a separate operation and has its own workflow; it does not appear as a plan symbol. Option D is wrong — removing a resource from state without destroying it in the provider is done with `terraform state rm`, not reflected by this plan symbol.

5. An engineer runs `terraform show` after a successful apply. Which of the following BEST describes what this command outputs by default?

  • A. A diff of what changed during the last `terraform apply`, equivalent to re-running `terraform plan`
  • B. A human-readable representation of the current Terraform state file, showing all tracked resource attributes✓ Correct
  • C. The raw JSON content of the `terraform.tfstate` file without any formatting
  • D. A summary of all output values defined in the configuration
Explanation

**Correct: B.** `terraform show` (without arguments) reads the current state file and renders a human-readable summary of all resources tracked in state, including their attributes. **A is wrong:** `terraform show` does not compare configuration to state; that is `terraform plan`. **C is wrong:** The default output is human-readable text, not raw JSON. To get JSON you must use `terraform show -json`. **D is wrong:** To display output values specifically, you use `terraform output`; `terraform show` includes outputs as part of the full state view but its primary purpose is showing the complete resource state.

55 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free