TF-004 Understand Terraform's purpose Practice Question
Which THREE are considered Terraform's best practices?
⚠ Common exam trap
A common pitfall in Terraform is assuming that always using the latest module version is a best practice. In reality, for reproducibility and stability, you should pin module versions to specific, tested releases.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use variables to parameterize configurations
A is correct because using variables to parameterize configurations is a core Terraform best practice that enables reusability, flexibility, and separation of concerns. By defining input variables in `variables.tf` and passing values via `terraform.tfvars` or environment variables, you avoid hardcoding values like instance types or region names, making configurations portable across environments (dev, staging, prod). This aligns with Terraform's principle of writing infrastructure as code that is modular and maintainable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use variables to parameterize configurations
Why this is correct
Using variables to parameterize configurations is a fundamental best practice, enabling dynamic values to be passed into modules and resources. This approach promotes reusability by allowing the same core configuration to be deployed across different environments (e.g., development, staging, production) with varying inputs, significantly reducing code duplication and enhancing maintainability. Variables make configurations flexible and adaptable to changing requirements without modifying the underlying HCL code.
- ✗
Use latest version of all modules
Why it's wrong here
Using the latest version of all modules is not a best practice; instead, explicitly pinning module versions is crucial for ensuring consistent and reproducible infrastructure deployments. Relying on "latest" or unpinned versions introduces significant risk, as upstream module updates can introduce breaking changes, unexpected behavior, or security vulnerabilities without warning. Version pinning guarantees that your infrastructure will always be deployed with the exact, tested module code.
- ✓
Store state securely
Why this is correct
Storing Terraform state securely is paramount because state files frequently contain sensitive information, including database credentials, API keys, and network configurations. Best practices dictate using encrypted remote backends, such as AWS S3 with server-side encryption or Azure Blob Storage, to protect this data from unauthorized access. Secure state storage prevents potential data breaches and ensures compliance with security policies, upholding the principle of least privilege.
- ✓
Use remote state locking
Why this is correct
Implementing remote state locking is a critical best practice, especially in collaborative environments, to prevent concurrent modifications and state corruption. This mechanism ensures that only one `terraform apply` or `terraform plan` operation can modify the state file at any given time, preventing race conditions. State locking guarantees the atomicity of operations, maintaining the integrity and consistency of your infrastructure's declared state.
- ✗
Use provisioners for all software installs
Why it's wrong here
Using provisioners for all software installs is generally discouraged and considered an anti-pattern. Terraform provisioners are primarily designed for bootstrapping tasks, such as installing an agent or running initial setup scripts immediately after resource creation, or for cleanup. For comprehensive and ongoing software installation, configuration, and management within provisioned resources, dedicated configuration management tools like Ansible, Chef, or Puppet offer superior idempotency, error handling, and maintainability.
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.