Terraform Associate · 12% of the exam

Terraform modules: free practice questions

5 sample questions from our 30-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real HashiCorp exam.

1. A platform team maintains a Terraform module for deploying an application load balancer. The module's `variables.tf` includes the following declaration: ```hcl variable "allowed_ports" { type = list(number) description = "List of ports the ALB listener should accept" validation { condition = length(var.allowed_ports) > 0 && alltrue([for p in var.allowed_ports : p >= 1 && p <= 65535]) error_message = "allowed_ports must contain at least one valid port number between 1 and 65535." } } ``` A developer calls this module in their root configuration but does NOT pass a value for `allowed_ports`. What is the result?

  • A. Terraform applies successfully, using an empty list `[]` as the default value since no `default` is defined.
  • B. Terraform throws a validation error because the list length is zero, which fails the `condition` expression.
  • C. Terraform throws an error during the `plan` phase because no `default` is defined and no value was passed, making the variable required.✓ Correct
  • D. Terraform ignores the missing variable and omits the ALB listener from the resulting plan.
Explanation

**Correct: C.** In Terraform, a `variable` block with no `default` argument is a *required* variable. When the calling module does not supply a value for a required variable, Terraform immediately errors during `terraform plan` (or `terraform apply`) with a message indicating the variable must be set — the validation block is never even evaluated because the absence of a value is caught first. **A is wrong** because Terraform does not infer a default of `[]` for `list(number)` types. Only an explicit `default = []` in the variable block would provide that behavior; without it the variable is required. **B is wrong** because the validation block's `condition` is only evaluated after a value has been supplied. Since no value is provided at all, Terraform never reaches the validation logic — the error occurs earlier, at variable resolution time. **D is wrong** because Terraform does not silently skip or ignore required inputs. Missing required variables are always a hard error that stops execution.

2. A module block in a root configuration does NOT include a `version` argument, and the source points to a public Terraform Registry module. What is the consequence of omitting the `version` argument?

  • A. Terraform will refuse to initialize and throw an error requiring a version constraint.
  • B. Terraform will default to version 1.0.0 of the module if no version is specified.
  • C. Terraform will download the latest available version of the module on each `terraform init`, which can lead to unintended upgrades.✓ Correct
  • D. Terraform will pin the module to the version already recorded in the `.terraform.lock.hcl` file and never upgrade automatically.
Explanation

Option C is correct: without a `version` constraint, Terraform fetches the latest available version from the Registry on each `terraform init`, which can introduce breaking changes unexpectedly. Option A is wrong because Terraform does not error on a missing version for Registry modules — it is allowed but not recommended. Option B is wrong; Terraform has no default of '1.0.0'. Option D is partially misleading: the lock file records module versions only for providers, not for modules, so there is no module-level lock file protection against upgrades.

3. A root module calls a child module and needs to pass a complex object as an input. The child module's `variables.tf` declares the following: ```hcl variable "tags" { type = map(string) default = {} } ``` Which module call correctly passes a tags map to this variable?

  • A. module "app" { source = "./modules/app" tags = ["env=prod", "team=platform"] }
  • B. module "app" { source = "./modules/app" tags = { env = "prod" team = "platform" } }✓ Correct
  • C. module "app" { source = "./modules/app" var.tags = { env = "prod" team = "platform" } }
  • D. module "app" { source = "./modules/app" tags = "env=prod,team=platform" }
Explanation

Option B is correct: a `map(string)` variable is assigned using HCL object literal syntax with key-value pairs inside curly braces. Option A is wrong because it passes a list of strings (using square brackets), which does not match the `map(string)` type and will cause a type mismatch error. Option C is wrong because module input arguments are specified by the variable name alone (without the `var.` prefix); `var.tags = ...` is not valid syntax in a module block. Option D is wrong because passing a single comma-delimited string does not match the `map(string)` type constraint.

4. A root module calls a child module named `database`. The child module exposes an output called `connection_string`. How does the root module correctly reference this output to pass it as an input to another module called `app`?

  • A. var.database.connection_string
  • B. module.database.outputs.connection_string
  • C. module.database.connection_string✓ Correct
  • D. output.database.connection_string
Explanation

Option C is correct: child module outputs are referenced using the syntax `module.<MODULE_NAME>.<OUTPUT_NAME>`. Option A is wrong because `var.` references input variables, not module outputs. Option B is wrong because the `.outputs.` segment is not part of the reference syntax — Terraform does not use that intermediate key. Option D is wrong because `output.` is not a valid reference prefix for accessing another module's outputs from the root module.

5. A team has the following module composition in their root configuration: ```hcl module "network" { source = "./modules/network" } module "compute" { source = "./modules/compute" subnet_id = module.network.public_subnet_id } ``` The `network` module does not declare an output named `public_subnet_id`. What will happen when the team runs `terraform plan`?

  • A. Terraform will create the resources in both modules and silently ignore the undefined output reference.
  • B. Terraform will succeed at plan time but fail during apply when the output cannot be resolved.
  • C. Terraform will return an error during `terraform plan` stating that the module does not have an output named `public_subnet_id`.✓ Correct
  • D. Terraform will automatically create an implicit output in the `network` module to satisfy the reference.
Explanation

Option C is correct: Terraform validates all module output references during the plan phase. If the referenced output (`public_subnet_id`) does not exist in the `network` module's `outputs.tf`, Terraform reports an error at plan time — it does not defer this to apply. Option A is wrong because Terraform does not silently ignore missing outputs; it fails. Option B is wrong because the failure occurs at plan, not apply — Terraform's graph evaluation catches undefined references early. Option D is wrong because Terraform has no mechanism to auto-generate implicit outputs; all outputs must be explicitly declared.

25 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free