Terraform Associate · 12% of the exam

Terraform Modules: free practice questions

5 sample questions from our 30-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real HashiCorp exam.

1. A platform team wants to allow application teams to use approved, internally curated Terraform modules without exposing them to the public internet. Which Terraform feature is best suited for this requirement?

  • A. Publishing modules to the public Terraform Registry with a private flag enabled
  • B. Using a private module registry in Terraform Cloud or Terraform Enterprise✓ Correct
  • C. Storing modules in a shared S3 bucket and referencing them with an `s3::` source prefix
  • D. Placing all modules in a single Git monorepo and sharing credentials with all teams
Explanation

Correct: Terraform Cloud and Terraform Enterprise both offer a private module registry that allows organizations to publish, version, and share modules internally, with access controls, without exposing them publicly. Incorrect: The public Terraform Registry does not support a 'private flag'; modules published there are publicly accessible by anyone. Incorrect: Terraform does not support an `s3::` source prefix; S3 is not a natively supported module source type (though HTTP archives and Git are). Incorrect: A Git monorepo is a workable but informal solution that lacks the versioning, search, and access-control features of a proper private registry; it is not the purpose-built Terraform feature for this need.

2. A platform engineer publishes a module to Terraform Cloud's private module registry. Which TWO statements accurately describe capabilities of the private module registry compared to the public Terraform Registry?

  • A. Private registry modules can only be sourced using local file paths, not module addresses.
  • B. Private registry modules support version constraints using the same syntax as public Registry modules.✓ Correct
  • C. Private registry modules are accessible only to workspaces within the same Terraform Cloud organization (subject to sharing configuration).✓ Correct
  • D. Private registry modules require the module source to begin with `private://` instead of the organization hostname.
  • E. Private registry modules do not support semantic versioning and must use commit SHAs instead.
Explanation

Options B and C are correct. B is correct because Terraform Cloud's private registry supports the same `version` argument and semantic version constraint syntax as the public Registry. C is correct because private registry modules are scoped to a Terraform Cloud organization by default, though cross-organization sharing can be configured. Option A is wrong — private registry modules use a structured source address (e.g., `<HOSTNAME>/<ORGANIZATION>/<MODULE>/<PROVIDER>`) not local file paths. Option D is wrong — there is no `private://` scheme; the source address uses the Terraform Cloud hostname. Option E is wrong — the private registry fully supports semantic versioning via Git tags, just like the public Registry.

3. A root module needs to pass the `vpc_id` output from a `networking` module as an input to a `security_groups` module. Given the configuration snippet below, which expression correctly fills in the blank? ```hcl module "networking" { source = "./modules/networking" } module "security_groups" { source = "./modules/security_groups" vpc_id = _______________ } ```

  • A. `networking.vpc_id`
  • B. `module.networking.outputs["vpc_id"]`
  • C. `var.networking.vpc_id`
  • D. `module.networking.vpc_id`✓ Correct
Explanation

Correct: Module outputs are accessed via `module.<MODULE_LABEL>.<OUTPUT_NAME>`. Here the module label is `networking` and the output name is `vpc_id`, so the correct expression is `module.networking.vpc_id`. Incorrect: `networking.vpc_id` omits the required `module.` prefix and would be interpreted as an attribute of a resource or data source named `networking`. Incorrect: `module.networking.outputs["vpc_id"]` uses bracket/map notation that is not valid for referencing module outputs in Terraform. Incorrect: `var.networking.vpc_id` would attempt to read from an input variable named `networking`, not from a module output.

4. A team has the following variable declaration in a child module's `variables.tf`. After calling the module, the plan fails with a validation error. What input value would cause this failure? ```hcl variable "instance_count" { type = number default = 2 description = "Number of instances to create" validation { condition = var.instance_count >= 1 && var.instance_count <= 10 error_message = "instance_count must be between 1 and 10 inclusive." } } ```

  • A. instance_count = 1
  • B. instance_count = 10
  • C. instance_count = 0✓ Correct
  • D. instance_count = 5
Explanation

Option C is correct: a value of `0` fails the validation condition `var.instance_count >= 1 && var.instance_count <= 10` because 0 is not >= 1. Options A, B, and D all satisfy the condition (1, 10, and 5 are all within the inclusive range of 1–10) and would pass validation without error.

5. An engineer wants to use a Terraform module from the public Registry and ensure that only patch-level updates are automatically accepted, while minor or major version changes are blocked. Which version constraint achieves this?

  • A. version = ">= 2.0.0"
  • B. version = "~> 2.4"
  • C. version = "~> 2.4.0"✓ Correct
  • D. version = "= 2.4.0"
Explanation

Option C is correct: `~> 2.4.0` uses the pessimistic constraint operator, which allows only the rightmost version component to increment — in this case, only the patch number. It is equivalent to `>= 2.4.0, < 2.5.0`. Option A (`>= 2.0.0`) allows any version 2.0.0 or higher, including major changes within major version 2 and beyond, which is too permissive. Option B (`~> 2.4`) allows the minor version to increment (i.e., `>= 2.4, < 3.0`), accepting minor-version changes which the engineer wants to block. Option D (`= 2.4.0`) pins to an exact version, blocking even patch updates — more restrictive than what was asked.

25 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free