HashiCorp 004: Terraform modules Practice Questions

Correct: By Terraform convention, outputs.tf is the standard file for declaring all output blocks within a module, improving readability and discoverability. Incorrect: main.tf is the conventional location for resource and data source definitions, not outputs. Incorrect: variables.tf is the conventional location for input variable declarations, not outputs. Incorrect: terraform.tf (or versions.tf) is typically used for the terraform block containing required_providers and version constraints, not outputs.

Correct: The 'Verified' badge on the Terraform Registry indicates that the module is maintained by HashiCorp itself or by an official technology partner (e.g., AWS, Google, Azure) that HashiCorp has reviewed and approved. It is a mark of organizational trust, not automated testing. Incorrect: HashiCorp does not perform automated security vulnerability scanning of module code as the basis for the Verified badge. Incorrect: Download counts do not factor into the Verified badge; a module could have millions of downloads and remain a community module. Incorrect: There is no mandatory CI integration test pipeline run by the Registry that gates the Verified status; the badge is based on the identity and vetting of the publishing organization.

Correct: Accessing a nested attribute of a module output via module.<LABEL>.<OUTPUT>.<ATTRIBUTE> is fully supported when the output value is an object/map; Terraform resolves the traversal correctly. Correct: When a value originates from a sensitive output, Terraform propagates the sensitivity to any resource argument that uses it, redacting it in terraform plan and terraform apply output with '(sensitive value)'. Incorrect: Sensitive outputs can absolutely be referenced and used downstream; sensitive = true only controls display redaction, not usage restrictions. Incorrect: Terraform does not throw an error for attribute traversal on sensitive object outputs; the traversal is valid. Incorrect: The sensitive flag does affect downstream resource arguments by marking their values as sensitive too — it is not solely a display concern limited to the output itself.

Correct: Module outputs are referenced with the syntax module.<MODULE_LABEL>.<OUTPUT_NAME>, where the label matches the name given in the module block — in this case app_server. Incorrect: There is no .outputs. segment in the reference path; Terraform does not use that intermediate keyword. Incorrect: module.compute would reference a module labeled compute, but the module block is labeled app_server — the label, not the source directory name, is used. Incorrect: app_server.module.public_ip reverses the syntax and is not valid HCL.

Correct: For Git-based module sources, Terraform supports a ref query parameter to specify a branch, tag, or commit SHA. The format git::https://<REPO>.git?ref=<SHA> correctly pins to a specific commit. Incorrect: The // double-slash separator is used to specify a subdirectory within a repository, and ?commit= is not a recognized query parameter — the correct parameter is ?ref=. Incorrect: The version argument in a module block is only valid for Terraform Registry sources, not for Git sources; mixing a Git source URL with a separate version argument is invalid. Incorrect: Downloading a ZIP archive via HTTPS is a valid source type, but it references the GitHub auto-generated archive URL — while it could work, it does not use the Git ref mechanism and would not be considered a standard way to pin by commit SHA.