TF-004 Read, generate and modify configuration Practice Question
Exhibit
variable "subnet_ids" {
type = list(string)
default = ["subnet-1", "subnet-2"]
}
resource "aws_instance" "app" {
count = length(var.subnet_ids)
subnet_id = var.subnet_ids[count.index]
ami = "ami-xyz"
instance_type = "t2.micro"
}Refer to the exhibit. You need to add a security group to each instance. You have a local value defined as 'security_group_map = { "subnet-1" = "sg-1", "subnet-2" = "sg-2" }'. Which expression should be used to reference the security group ID in the resource block?
⚠ Common exam trap
The Terraform exam often tests the distinction between accessing local values (requiring `local.` prefix) vs. variables or resources, and the misuse of `lookup` when direct indexing is appropriate, leading candidates to omit the `local.` prefix or use unnecessary functions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vpc_security_group_ids = [local.security_group_map[var.subnet_ids[count.index]]]
It properly references the local value `security_group_map` using the `local.` prefix, which is required in Terraform to access local values. It then uses the subnet ID from `var.subnet_ids[count.index]` as the key to look up the corresponding security group ID. This ensures each instance gets the correct security group based on its subnet index.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
vpc_security_group_ids = [local.security_group_map[var.subnet_ids[count.index]]]
Why this is correct
This option correctly references a local value named `security_group_map` using the `local.` prefix, which is mandatory for accessing local variables. It then uses map indexing `[...]` to retrieve a security group ID. The key for this lookup is dynamically determined by `var.subnet_ids[count.index]`, which fetches a specific subnet ID from a list variable based on the current `count` iteration, ensuring the correct security group is associated with each resource instance.
- ✗
vpc_security_group_ids = [lookup(security_group_map, var.subnet_ids[count.index])]
Why it's wrong here
This option is incorrect because it attempts to use the `lookup` function without specifying the `local.` prefix for `security_group_map`. Terraform requires explicit referencing of local values with `local.<name>` to distinguish them from other types of variables or resource attributes. While `lookup` is a valid function for retrieving map values, its first argument, the map itself, is not correctly identified in the current scope.
- ✗
vpc_security_group_ids = [security_group_map[var.subnet_ids[count.index]]]
Why it's wrong here
This option is incorrect because it directly references `security_group_map` without the necessary `local.` prefix. Terraform cannot resolve `security_group_map` as a local value when it's not explicitly prefixed. Although the map indexing syntax `[...]` is correct for accessing elements, the interpreter will fail to find a variable or attribute named `security_group_map` in the current context, leading to an error.
- ✗
vpc_security_group_ids = [lookup(local.security_group_map, var.subnet_ids[count.index])]
Why it's wrong here
While syntactically valid, this option is generally not considered the most idiomatic or preferred solution when the key is guaranteed to exist, as implied by the problem context. The `lookup` function is typically used when a default value needs to be provided in case the specified key is not found in the map, which is not demonstrated here. Direct map indexing, as shown in the correct answer, is more concise and commonly used when the presence of the key is expected and no default fallback is required.
Visual reference
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.