HashiCorp · Free Practice Questions · Last reviewed May 2026
36real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You have a team-based collaboration project. Where should you store sensitive credentials like AWS secret keys so they are not hardcoded in your Terraform files?
In environment variables marked as 'sensitive'
Sensitive workspace variables are encrypted at rest and masked in logs.
In a .tfvars file
In a version-controlled .env file
In the state file
You are using HCP Terraform agents. Why would you choose to use an agent instead of the public HCP Terraform execution environment?
To increase execution speed
To access resources in a private network
Private network access is the primary use case for agents.
To bypass OPA policies
To avoid paying for HCP Terraform
You are writing an OPA (Open Policy Agent) policy to restrict resource creation. You want to deny any EC2 instance that does not include the 'CostCenter' tag. How do you access the resource attributes in the policy?
terraform.tags
input.resource_changes
input.resource_changes contains the details of planned modifications.
state.output
var.tags
When migrating from local state to HCP Terraform, which command is used to initialize the migration?
terraform login
terraform push
terraform init
Running init with a new cloud backend configuration prompts migration.
terraform migrate
Your team is using HCP Terraform. You need to isolate development, staging, and production environments using the same set of configuration files. Which feature should you implement?
Modules
Sentinel Policies
Workspaces
Workspaces allow distinct state and variables for different environments.
Run Triggers
In HCP Terraform, you want to allow team members to see runs but prevent them from approving plans. Which team permission set should you assign?
Write
Admin
Read
Read only allows viewing information.
Cost Estimation
Want more Collaborative Workflows practice?
Practice this domainWhich directory structure is considered standard for a Terraform module?
A directory containing main.tf, variables.tf, and outputs.tf.
This is the established convention for module organization.
One single file named 'all.tf'.
A binary executable file that compiles the infrastructure.
A separate folder for every single resource.
What is the primary benefit of using a module registry compared to a local file path for module distribution?
It allows you to run Terraform commands faster.
It removes the need for input variables.
It automatically converts your code to a higher-level language.
It enables version control and easier sharing across the organization.
Registries facilitate versioned releases and standardized consumption patterns.
When refactoring a large infrastructure configuration, you move a resource into a child module. How do you handle the existing state to prevent Terraform from destroying and recreating the resource?
Run 'terraform refresh' to automatically detect the move.
Use the 'terraform state mv' command to move the resource address.
This command updates the state file to reflect the new hierarchy without destroying infrastructure.
Rename the resource in the configuration to match the old state.
Delete the state file and run 'terraform apply'.
You have a nested module structure. How can you pass a variable from the root module through an intermediate module to a leaf module?
Define the variable only in the leaf module and refer to root by index.
You must define the variable in the intermediate module and pass it to the leaf module.
Explicit declaration and assignment are required at every level of the hierarchy.
You can use the 'global_vars' block in the root.
The intermediate module automatically inherits all root variables.
You are designing a module that should conditionally create resources based on a boolean input. What feature should you use?
Define multiple resources and use 'depends_on' to link them.
Use the 'count' meta-argument with a ternary expression.
Setting 'count = var.enabled ? 1 : 0' is the standard pattern for conditional resource creation.
Use an 'if' block around the resource definition.
Use the 'module' meta-argument inside the resource.
You need to output a complex object from a child module to be used by the root module. What is the best practice for defining the output?
Assign the output to a global variable in the root module.
Use a data source to read the child module's internal state.
Define an output block in the child module and reference it in the root module using the module prefix.
This is the standard pattern for passing information from a module back to its caller.
Write the output to a local file inside the module and read it in the root.
Want more Terraform Modules practice?
Practice this domainWhen using Cost Estimation in HCP Terraform, which of the following is true?
It calculates costs based on real-time AWS billing API calls.
It applies to all resources, including custom providers.
It requires the Terraform provider to support the cost estimation feature.
Only providers with specific cost metadata support this feature.
It only works for paid HCP Terraform tiers.
You are configuring RBAC in HCP Terraform. A user needs to trigger runs and view plan logs but should not be allowed to modify workspace variables. Which permission set is appropriate?
Grant Admin access.
Grant 'Read' and 'Queue Plan' permissions.
Queue Plan allows triggering runs, while Read allows viewing logs without changing variables.
Grant 'Manage Variables' permission.
Grant 'Write' permission to the workspace.
Which of the following is a primary benefit of using a Private Module Registry?
It encrypts all Terraform state files.
It allows central management and version control of reusable modules.
This is the core value proposition of the Private Module Registry.
It forces all workspaces to use the same module versions.
It automatically generates cost estimates for all modules.
A Sentinel policy is failing on a cost estimation result. What is the most likely cause if the cost estimation feature is enabled but the policy still fails?
The cost estimation provider is not configured for AWS.
The workspace does not have Sentinel enabled.
The API key for AWS is invalid.
The policy attempts to access cost data before the estimation has completed.
Policies run after the plan; if cost estimation hasn't finalized, the policy might throw an error.
When configuring team permissions, what does the 'Workspace: Settings' permission allow?
Viewing plan and apply logs only.
Triggering runs manually.
Modifying workspace settings like variable sets and execution modes.
Settings permission specifically grants access to configure the workspace environment.
Deleting the workspace.
You want to enforce a policy that prevents creating AWS EC2 instances larger than 't3.medium'. Where do you configure this?
By modifying the Terraform provider source.
Inside an HCP Terraform Policy Set.
Policy Sets are the containers for Sentinel policies applied to workspaces.
In the Private Module Registry settings.
Within the workspace's variables.
Want more HCP Terraform Governance practice?
Practice this domainYou need to ensure that an AWS Auto Scaling Group maintains capacity during a configuration change that requires a new launch template. Which lifecycle meta-argument should you use?
replace_triggered_by
ignore_changes
create_before_destroy = true
This enables the desired behavior for zero-downtime updates.
prevent_destroy
When using 'create_before_destroy', what is a common side effect that may cause the plan to fail?
Resource naming collisions.
The new resource cannot be created if the name is already taken by the existing one.
Terraform will delete the state file.
Provider credentials will expire.
All other resources will be destroyed.
You are managing a production database instance. You want to ensure that if a developer accidentally removes the resource block from the Terraform configuration, Terraform will refuse to destroy the database. How do you implement this?
Set prevent_destroy = true in the lifecycle block.
This is the correct configuration for preventing accidental deletion.
Set create_before_destroy = false.
Use the ignore_changes meta-argument for the lifecycle block.
Configure a provider-level block to disable deletions.
Which command is used to move a resource from one state file to another, commonly used when refactoring modules?
terraform migrate
terraform plan -refactor
terraform refresh
terraform state mv
This is the correct command for moving resources.
You have an AWS Lambda function that should be replaced whenever the source code S3 object changes. How do you trigger this replacement specifically based on the S3 object key change?
Use lifecycle { force_replace = true }
Use replace_triggered_by = [aws_s3_object.lambda_code.key]
This correctly references the attribute change to trigger replacement.
Use create_before_destroy.
Use ignore_changes = [source_code_hash]
A resource has an attribute 'tags' that is managed by an external script. You want Terraform to ignore any changes made to 'tags' after the initial creation. How should you configure the 'lifecycle' block?
ignore_changes = [tags]
This correctly targets the tags attribute for exclusion.
lifecycle { tags = ignore }
prevent_destroy = [tags]
ignore_changes = [all]
Want more Resource Lifecycle Management practice?
Practice this domainYou are using a dynamic block to define multiple 'tag' blocks inside an AWS resource. The dynamic block is failing because it expects a set of objects but receives a flat list. Which function best prepares your data?
keys()
distinct()
compact()
toset()
toset converts a list to a set, which is the preferred input for for_each to maintain stable resource indices.
You are attempting to use a conditional expression to set a variable, but the types returned by the true and false results differ. What happens?
The result is coerced to a string
A type mismatch error is returned
Terraform demands that both expressions return the same type.
It defaults to the true result type
Terraform automatically casts to the most flexible type
You have a list of objects representing AWS tags. You need to transform this list into a map for use with a for_each argument. Which function should you use?
tolist()
flatten()
merge()
for expression
The for expression is the standard HCL construct for transforming lists into maps for resource iteration.
In a dynamic block, you need to access the current iteration item. What is the default label assigned to the iterator object?
count.index
The name of the block
The iterator automatically takes the name of the dynamic block defined.
each.value
item
When using for_each on a resource, how do you access the value of the current iteration inside the resource configuration?
each.value
each.value provides the current element from the map or set.
each.key
item.value
count.index
Which function is most useful when you have a nested list of objects and want to create a single flat list to iterate over with for_each?
concat()
flatten()
flatten simplifies nested list structures into a single list.
lookup()
merge()
Want more Dynamic HCL Configuration practice?
Practice this domainWhat is the purpose of the 'terraform providers lock' command?
To secure the provider versions and checksums.
It ensures consistent provider versions across environments via checksums.
To encrypt the state file.
To prevent others from running init.
To download all providers.
You are creating a custom provider. What is the standard language used to write Terraform providers?
Python
Ruby
HCL
Go
Terraform providers are built using Go.
You need to manage resources in two different AWS regions using the same provider configuration. How do you achieve this?
Define the region twice in a single provider block.
Define two separate aws providers in the same file without aliases.
Create two separate Terraform projects.
Use an alias in the provider block and reference it in the resource using the provider meta-argument.
The provider meta-argument links a resource to a specific aliased provider instance.
If you want to use a provider that is not published in the Terraform Registry, how do you install it?
Use a filesystem mirror in the .terraformrc file.
Filesystem mirrors allow local development or air-gapped installation.
You cannot use private providers.
Rename the file to provider.tf.
Copy it to the root of the project.
A team wants to ensure their Terraform configuration uses a specific major version of the AWS provider to prevent breaking changes. Which block should they use?
terraform { required_providers { aws = { source = "hashicorp/aws", version = "~> 4.0" } } }
This is the correct syntax for pinning provider versions.
provider "aws" { version = "~> 4.0" }
terraform { version = "~> 4.0" }
provider_version = "4.0"
Where are providers physically stored by default when running 'terraform init'?
The root module directory
~/.terraformrc
.terraform/providers/
This is the default local cache directory.
/usr/local/bin/terraform
Want more Provider Management practice?
Practice this domainThe AWS provider exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 6 domains: Collaborative Workflows, Terraform Modules, HCP Terraform Governance, Resource Lifecycle Management, Dynamic HCL Configuration, Provider Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official HashiCorp AWS provider exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.