devopsbymuh_

003 practice questions and answers

All 15 questions from Practice Test 1 for HashiCorp Certified: Terraform Associate, with the correct answer and a full explanation for each — including why the other options are wrong. Free to read, no signup.

Take this as a timed test →003 exam guide

What this set covers

Questions are weighted to match the official 003 exam guide. The real exam is 57 questions in 60 minutes with a pass mark of 70%.

  • Understand IaC Concepts1 q · 12%
  • Understand the Purpose of Terraform vs Other IaC1 q · 12%
  • Understand Terraform Basics3 q · 20%
  • Use Terraform Outside of Core Workflow2 q · 10%
  • Interact with Terraform Modules1 q · 12%
  • Use the Core Terraform Workflow2 q · 16%
  • Implement and Maintain State3 q · 10%
  • Read, Generate, and Modify Configuration2 q · 8%
Question 1Use the Core Terraform Workflow

Which command downloads provider plugins and prepares the backend for a Terraform working directory?

  • Aterraform plan
  • Bterraform init✓
  • Cterraform validate
  • Dterraform refresh

Correct answer: B — terraform init

`terraform init` initializes the directory: it downloads providers and modules and configures the backend. `plan` shows proposed changes, `validate` checks syntax and types, and `refresh` updates state from real infrastructure.

terraform init
Question 2Implement and Maintain State

Why is a remote backend such as Amazon S3 with state locking recommended for a team?

  • AIt makes plans run faster.
  • BIt shares state between team members and prevents two applies from running at the same time.✓
  • CIt removes the need for a provider block.
  • DIt encrypts the Terraform configuration files.

Correct answer: B — It shares state between team members and prevents two applies from running at the same time.

A remote backend keeps a single copy of state that everyone uses, and locking stops concurrent applies from corrupting it. It does not change plan speed, remove providers, or encrypt your .tf files (it can encrypt the state itself).

Terraform backends
Question 3Understand Terraform Basics

What does the `terraform.lock.hcl` file do?

  • ALocks the state file while an apply runs.
  • BRecords the exact provider versions selected, so other runs use the same ones.✓
  • CStores sensitive variable values.
  • DPrevents resources from being destroyed.

Correct answer: B — Records the exact provider versions selected, so other runs use the same ones.

The dependency lock file pins provider versions and their checksums so every run and every teammate gets the same providers. State locking is handled by the backend, secrets belong in a secret store, and destroy protection comes from `prevent_destroy`.

Dependency lock file
Question 4Use Terraform Outside of Core Workflow

An EC2 instance was created manually in the console. You want Terraform to manage it going forward, using a resource block you have already written. Which command brings it under management?

  • Aterraform import aws_instance.web i-0abc123✓
  • Bterraform apply -replace=aws_instance.web
  • Cterraform state rm aws_instance.web
  • Dterraform refresh -target=aws_instance.web

Correct answer: A — terraform import aws_instance.web i-0abc123

`terraform import` writes an existing real object into state and binds it to a resource address. `-replace` forces recreation, `state rm` removes tracking, and `refresh` only re-reads objects Terraform already knows about.

terraform import
Question 5Interact with Terraform Modules

Which statement about Terraform modules is correct?

  • AA module can only be used from the public Terraform Registry.
  • BEvery Terraform configuration has a root module, and it can call child modules.✓
  • CModules must be written in JSON.
  • DVariables cannot be passed into modules.

Correct answer: B — Every Terraform configuration has a root module, and it can call child modules.

The directory you run Terraform in is the root module, and it can call child modules from local paths, Git, or a registry. Modules are normally written in HCL and take input variables.

Modules overview
Question 6Read, Generate, and Modify Configuration

Look at the configuration below. What does the `depends_on` argument do here?

resource "aws_s3_bucket" "logs" {
  bucket = "app-logs-bucket"
}

resource "aws_instance" "app" {
  ami           = var.ami_id
  instance_type = "t3.micro"
  depends_on    = [aws_s3_bucket.logs]
}
  • AIt copies the bucket's attributes into the instance.
  • BIt tells Terraform to create the bucket before the instance, even though no attribute reference links them.✓
  • CIt destroys the bucket when the instance is destroyed.
  • DIt has no effect because both resources are in the same file.

Correct answer: B — It tells Terraform to create the bucket before the instance, even though no attribute reference links them.

Terraform normally works out ordering from references between resources. `depends_on` adds an explicit ordering edge for hidden dependencies where no attribute is referenced.

The depends_on meta-argument
Question 7Understand Terraform Basics

Which block type is used to look up information about infrastructure that Terraform does not manage?

  • Aresource
  • Bdata✓
  • Clocals
  • Doutput

Correct answer: B — data

A `data` block reads existing objects, such as the latest AMI or an existing VPC, without creating or managing them. `resource` creates and manages, `locals` names expressions, and `output` exposes values.

Data sources
Question 8Use the Core Terraform Workflow

What is the correct order of the core Terraform workflow?

  • AWrite → Plan → Apply✓
  • BPlan → Write → Apply
  • CWrite → Apply → Plan
  • DInit → Destroy → Apply

Correct answer: A — Write → Plan → Apply

HashiCorp describes the core workflow as write the configuration, run a plan to preview changes, then apply to make them real. `init` comes first in a new directory but is not part of the three-step cycle.

The core Terraform workflow
Question 9Implement and Maintain State

A team member deleted a resource by hand in the cloud console. What will `terraform plan` show on the next run?

  • ANothing — Terraform only looks at the configuration files.
  • BIt will detect the drift and propose creating the resource again.✓
  • CIt will fail with a state corruption error.
  • DIt will remove the resource from the configuration.

Correct answer: B — It will detect the drift and propose creating the resource again.

Terraform refreshes the real state of tracked objects during a plan. Because the object is gone but is still in the configuration, the plan proposes to create it again. Terraform never edits your .tf files for you.

terraform plan
Question 10Understand IaC Concepts

Which statement describes an advantage of infrastructure as code over clicking in a cloud console?

  • AIt removes the need to understand the cloud provider's services.
  • BEnvironments become repeatable, reviewable in version control, and consistent between dev and production.✓
  • CIt guarantees infrastructure will never fail.
  • DIt makes cloud resources free.

Correct answer: B — Environments become repeatable, reviewable in version control, and consistent between dev and production.

IaC turns infrastructure into files you can review, version, and reuse, so environments are consistent and changes have a history. It does not replace product knowledge, prevent failures, or change pricing.

What is infrastructure as code?
Question 11Read, Generate, and Modify Configuration

Which meta-argument creates several similar resources from a map or set, giving each one a stable key instead of a numeric index?

  • Acount
  • Bfor_each✓
  • Clifecycle
  • Ddynamic

Correct answer: B — for_each

`for_each` builds one instance per key in a map or set, so adding or removing an entry does not shift the others. `count` uses numeric indexes, which can cause resources to be recreated when the list order changes. `lifecycle` controls create/destroy behaviour, and `dynamic` generates repeated nested blocks.

The for_each meta-argument
Question 12Understand Terraform Basics

In which order does Terraform resolve a variable when the same variable is set in several places?

  • AEnvironment variable wins over -var on the command line.
  • Bterraform.tfvars wins over -var on the command line.
  • C-var and -var-file on the command line win over terraform.tfvars, which wins over TF_VAR_ environment variables.✓
  • DThe default value in the variable block always wins.

Correct answer: C — -var and -var-file on the command line win over terraform.tfvars, which wins over TF_VAR_ environment variables.

Terraform loads values in increasing order of precedence: environment variables, then terraform.tfvars, then *.auto.tfvars, then -var and -var-file flags, which win. Defaults are used only when nothing else sets the variable.

Variable definition precedence
Question 13Understand the Purpose of Terraform vs Other IaCSelect 2

Which two statements about Terraform's approach are true? (Select TWO.)

  • ATerraform is declarative: you describe the desired end state.✓
  • BTerraform works with many providers, so one tool can manage several clouds and SaaS platforms.✓
  • CTerraform is a configuration management tool designed to install packages on running servers.
  • DTerraform requires an agent to be installed on every managed machine.
  • ETerraform can only manage AWS resources.

Correct answer: A, B — Terraform is declarative: you describe the desired end state. · Terraform works with many providers, so one tool can manage several clouds and SaaS platforms.

Terraform is declarative and provider-based, so the same workflow provisions AWS, Azure, Google Cloud, Kubernetes and many SaaS APIs. Installing packages inside servers is the job of configuration management tools such as Ansible, and Terraform is agentless.

Terraform vs other software
Question 14Use Terraform Outside of Core Workflow

Which command shows the values that are currently recorded in Terraform state for a single resource?

  • Aterraform show
  • Bterraform state show aws_instance.web✓
  • Cterraform output aws_instance.web
  • Dterraform graph

Correct answer: B — terraform state show aws_instance.web

`terraform state show <address>` prints the attributes stored for one resource. `terraform show` prints the whole state or a saved plan, `output` prints declared outputs only, and `graph` renders the dependency graph.

terraform state show
Question 15Implement and Maintain State

Which statement about sensitive data in Terraform state is correct?

  • AMarking a variable as sensitive removes its value from the state file.
  • BState can contain secrets in plain text, so it must be stored in an encrypted backend with restricted access.✓
  • CTerraform never writes passwords to state.
  • DState files are encrypted automatically wherever they are stored.

Correct answer: B — State can contain secrets in plain text, so it must be stored in an encrypted backend with restricted access.

`sensitive = true` only hides a value in CLI output — the value is still written to state. That is why state belongs in a backend with encryption at rest and tight access control, and never in Git.

Sensitive data in state

Ready to try it under exam conditions?

Reading answers is not the same as recalling them with a clock running. Take the same 15 questions as a timed mock exam — 25 minutes, no feedback until you submit, then a score broken down by exam domain so you know what to study.

Start the timed 003 test →