Question 444 of 519

Interact with Terraform modules →hardMultiple ChoiceObjective-mapped

Quick Answer

The correct answer is that it will create one flow log per network module instance, using the vpc_id output from each. This is because the resource block uses a Terraform module for_each with a map, specifically iterating over module.networks, which is a map of module instances each exposing their own vpc_id output. The for_each meta-argument dynamically creates one instance of the aws_flow_log resource for each key in that map, and each instance accesses its corresponding module’s vpc_id via each.value.vpc_id. On the HashiCorp Terraform Associate TF-003 exam, this tests your understanding of how for_each works with module outputs versus simple lists—a common trap is assuming the module returns a list of VPC IDs, but a map of module instances preserves individual outputs per key. Remember the memory tip: “Map of modules means map of outputs—each key gets its own resource.”

TF-003 Interact with Terraform modules Practice Question

This TF-003 practice question tests your understanding of interact with terraform modules. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Exhibit

Refer to the exhibit.

```
module "networks" {
  source = "./modules/network"
  for_each = {
    dev  = "10.0.1.0/24"
    prod = "10.0.2.0/24"
  }
  cidr_block = each.value
  name       = each.key
}

resource "aws_flow_log" "example" {
  for_each = module.networks
  vpc_id   = each.value.vpc_id
  ...
}
```

In the configuration, what is the likely result of the resource block 'aws_flow_log'?

Question 1hardmultiple choice

Full question →

Exhibit

Refer to the exhibit.

```
module "networks" {
  source = "./modules/network"
  for_each = {
    dev  = "10.0.1.0/24"
    prod = "10.0.2.0/24"
  }
  cidr_block = each.value
  name       = each.key
}

resource "aws_flow_log" "example" {
  for_each = module.networks
  vpc_id   = each.value.vpc_id
  ...
}
```

A
Terraform will error because for_each cannot be used with module outputs.
Why wrong: for_each can iterate over a map of module outputs; it is a valid usage.
B
The resource will be created only for the last module instance due to overwriting.
Why wrong: for_each creates a resource for each distinct key; no overwriting occurs.
C
It will create one flow log per network module instance, using the vpc_id output from each.
for_each = module.networks iterates over each module instance, allowing access to its outputs via each.value.
D
It will create one flow log for each VPC using a count based on length of module.networks.
Why wrong: count cannot be used directly on a map of modules; for_each is appropriate, and the syntax uses each.value.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It will create one flow log per network module instance, using the vpc_id output from each.

Option B is correct because module.networks is a map of module instances, each with outputs; the resource uses for_each over that map, referencing each.value.vpc_id. Option A is wrong because the module does not produce a list of VPC IDs. Option C is wrong because the resource will have two instances. Option D is wrong because it is fine.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Terraform will error because for_each cannot be used with module outputs.
Why it's wrong here
for_each can iterate over a map of module outputs; it is a valid usage.
✗
The resource will be created only for the last module instance due to overwriting.
Why it's wrong here
for_each creates a resource for each distinct key; no overwriting occurs.
✓
It will create one flow log per network module instance, using the vpc_id output from each.
Why this is correct
for_each = module.networks iterates over each module instance, allowing access to its outputs via each.value.
Related concept
Read the scenario before looking for a memorised answer.
✗
It will create one flow log for each VPC using a count based on length of module.networks.
Why it's wrong here
count cannot be used directly on a map of modules; for_each is appropriate, and the syntax uses each.value.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.

Trap categories for this question

Command / output trap
for_each can iterate over a map of module outputs; it is a valid usage.

Detailed technical explanation

How to think about this question

This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
Use explanations to understand the rule behind the answer.

TExam Day Tips

Underline the problem statement mentally.
Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A practitioner preparing for the TF-003 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.

What to study next

Got this wrong? Here's your next step.

Identify which TF-003 exam domain this question belongs to, then review the specific concept being tested. Practise related questions in that domain and focus on understanding why each wrong answer is tempting — not just why the correct answer is right.

Related TF-003 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Understand IaC concepts practice questions

Practise TF-003 questions linked to Understand IaC concepts.

Understand Terraform basics practice questions

Practise TF-003 questions linked to Understand Terraform basics.

Understand Terraform's purpose practice questions

Practise TF-003 questions linked to Understand Terraform's purpose.

Use Terraform outside the core workflow practice questions

Practise TF-003 questions linked to Use Terraform outside the core workflow.

Interact with Terraform modules practice questions

Practise TF-003 questions linked to Interact with Terraform modules.

Use the core Terraform workflow practice questions

Practise TF-003 questions linked to Use the core Terraform workflow.

Implement and maintain state practice questions

Practise TF-003 questions linked to Implement and maintain state.

Read, generate and modify configuration practice questions

Practise TF-003 questions linked to Read, generate and modify configuration.

TF-003 fundamentals practice questions

Practise TF-003 questions linked to TF-003 fundamentals.

TF-003 scenario practice questions

Practise TF-003 questions linked to TF-003 scenario.

TF-003 troubleshooting practice questions

Practise TF-003 questions linked to TF-003 troubleshooting.

Practice this exam

Start a free TF-003 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

TF-003 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this TF-003 question test?

Interact with Terraform modules — This question tests Interact with Terraform modules — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: It will create one flow log per network module instance, using the vpc_id output from each. — Option B is correct because module.networks is a map of module instances, each with outputs; the resource uses for_each over that map, referencing each.value.vpc_id. Option A is wrong because the module does not produce a list of VPC IDs. Option C is wrong because the resource will have two instances. Option D is wrong because it is fine.

What should I do if I get this TF-003 question wrong?

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on TF-003

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A team has a root module that calls a local module using count to conditionally create an AWS RDS instance based on a boolean variable `rds_enabled`. The root module sets `rds_enabled` to the value of a data source that checks if a tag exists on an S3 bucket. The relevant code is: `count = var.rds_enabled ? 1 : 0`. When they run terraform plan, they receive the error: "Error: Invalid count argument: The count value is not yet known". The S3 bucket already exists. What is the underlying issue?

medium

A.Data sources cannot be used in a count condition.
B.The count in a module block cannot depend on a data source.
✓ C.The count value must be known before planning, but data sources are not evaluated until apply without a refresh.
D.The module does not support count.

Why C: Option C is correct. The count value must be known during planning, but data sources are typically read during the refresh phase of apply (or plan if -refresh-only is used), and if the data source depends on managed resources, it may be unknown. However, in this case, the S3 bucket exists, but Terraform still cannot guarantee the value without refreshing. The root cause is that data sources are not evaluated before planning unless Terraform performs a refresh, which may require existing state. Option A is false because data sources can be used in count. Option B is false because count works with modules. Option D is false because modules do support count.

Last reviewed: Jun 24, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This TF-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-003 exam.