TF-004 Read, generate and modify configuration Practice Question
Which TWO statements about Terraform provisioners are correct?
⚠ Common exam trap
HashiCorp often tests the misconception that provisioners are the standard way to configure resources, when in fact they are explicitly documented as a last resort, and candidates may also incorrectly assume that only 'local-exec' and 'remote-exec' exist.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Provisioners should be used as a last resort when no other Terraform resource or data source fits.
Terraform provisioners are considered a last resort for tasks that cannot be accomplished with Terraform's declarative resource model. The official Terraform documentation explicitly states that provisioners should be used sparingly, as they introduce procedural logic and can cause state drift or failures that are hard to debug. This aligns with the principle of keeping configurations idempotent and relying on native resource attributes or data sources first.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Provisioners can only be used with the 'local-exec' and 'remote-exec' provisioners.
Why it's wrong here
This statement is incorrect because Terraform supports several provisioner types beyond just 'local-exec' and 'remote-exec'. For instance, the 'file' provisioner is used to upload files or directories to a remote resource, while the 'chef' provisioner can configure a resource by running a Chef client. These additional provisioners demonstrate that the scope is not limited to only executing commands.
- ✓
Provisioners should be used as a last resort when no other Terraform resource or data source fits.
Why this is correct
This statement is correct and reflects a fundamental best practice in Terraform. Provisioners introduce imperative steps into a declarative infrastructure-as-code workflow, making configurations less idempotent and harder to manage. Terraform's strength lies in its ability to manage resources declaratively through providers, so provisioners should only be employed when no native resource, data source, or external configuration management tool can achieve the desired outcome.
- ✗
Provisioners are the primary way to configure resources after creation.
Why it's wrong here
This statement is incorrect because provisioners are not the primary method for configuring resources after creation. Terraform's declarative model prefers to configure resources directly through resource arguments and provider APIs during the `terraform apply` process. For more complex post-creation configuration, dedicated configuration management tools like Ansible, Chef, or Puppet, or even cloud-init scripts, are generally more robust and idempotent solutions than Terraform provisioners.
- ✗
Provisioners run only once during initial creation by default.
Why it's wrong here
This statement is incorrect; provisioners do not run only once during initial creation by default. By default, provisioners with `when = create` (the implicit default) will execute every time the resource they are attached to is created or re-created, which can happen during updates or changes to the resource's configuration. To control their execution, the `when` argument can be explicitly set to `create`, `destroy`, or `always`, indicating they can run multiple times or under specific conditions.
- ✓
Provisioners can be used with the 'null_resource' to run arbitrary actions.
Why this is correct
This statement is correct. The `null_resource` is a special resource type in Terraform that performs no actions itself but serves as a container for provisioners. It is frequently paired with provisioners to execute arbitrary local or remote commands that do not directly manage a cloud resource, such as triggering external scripts, updating DNS records, or interacting with third-party APIs after infrastructure deployment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.