TF-004 Interact with Terraform modules Practice Question
A team is using a module from the Terraform Registry. They want to ensure that changes to the module's source version are tested in a non-production environment before being applied to production. Which approach best supports this workflow?
⚠ Common exam trap
HashiCorp often tests the misconception that pinning to an exact version (Option B) is the safest approach for controlled testing, but the question specifically asks for a workflow that supports testing changes *before* production, which the pessimistic constraint enables automatically without manual version bumps.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a version constraint like ~> 1.0 in the module configuration and test the module in a non-production workspace before promoting to production.
Using a version constraint like `~> 1.0` allows Terraform to automatically select the latest compatible patch version within the specified minor version range. This enables safe, incremental updates that can be tested in a non-production workspace first, and then promoted to production by simply applying the same configuration. The constraint ensures that breaking changes (major version bumps) are not automatically pulled in, giving the team control over when to adopt them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fork the module repository and manage the module internally as a private module.
Why it's wrong here
Forking a module from the Terraform Registry introduces significant maintenance overhead, as the team becomes solely responsible for integrating upstream updates, security patches, and bug fixes. This approach negates the primary benefit of using a community module, which is shared maintenance and leveraging collective expertise, turning consumption into an unnecessary, resource-intensive maintenance burden.
- ✗
Pin the module to an exact version (e.g., version = "1.2.3") and update it manually after testing in isolation.
Why it's wrong here
Pinning a module to an exact version, such as `version = "1.2.3"`, provides strict stability but completely prevents any automatic updates, including critical security fixes or performance improvements. This rigid approach requires constant manual monitoring for new versions and deliberate, time-consuming updates, failing to leverage Terraform's capabilities for controlled, incremental version adoption.
- ✗
Configure the module source to reference the latest commit from the default branch of the repository.
Why it's wrong here
Configuring a module source to reference the latest commit from a repository's default branch (e.g., `ref=main`) is highly unstable and unpredictable. Each `terraform init` operation could pull in arbitrary, untested changes, including breaking changes or incomplete features, leading to irreproducible infrastructure states and significant operational risk. This method completely bypasses the benefits of semantic versioning for module stability.
- ✓
Use a version constraint like ~> 1.0 in the module configuration and test the module in a non-production workspace before promoting to production.
Why this is correct
Using a pessimistic version constraint like `~> 1.0` allows for automatic updates to minor and patch versions (e.g., `1.1.x`, `1.2.x`) while preventing potentially breaking major version upgrades. This strategy, combined with thorough testing in a dedicated non-production workspace, ensures controlled adoption of module improvements and bug fixes before safely promoting changes to critical production environments. It effectively balances stability with the ability to receive necessary updates.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.