TF-004 Understand Terraform's purpose Practice Question
Which TWO statements accurately describe key purposes of Terraform?
⚠ Common exam trap
TF-004 often tests the misconception that Terraform includes built-in security scanning or CI/CD pipeline automation, when those are separate concerns handled by other tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Terraform enables declarative infrastructure provisioning.
Option A is correct because Terraform uses a declarative HashiCorp Configuration Language (HCL) model where you define the desired end state of infrastructure and Terraform computes the create/update/delete actions needed to reach it, rather than scripting imperative steps. Option D is correct because Terraform's provider plugin architecture (e.g., aws, azurerm, google, kubernetes) lets a single configuration and workflow target multiple clouds and services simultaneously, which is a core design purpose. Option B is wrong because Terraform itself has no built-in security scanning; that requires separate tools such as tfsec, Checkov, or Sentinel policies. Option C is wrong because Terraform is an infrastructure provisioning tool, not a CI/CD pipeline engine; it is typically invoked by pipelines (Jenkins, GitHub Actions, GitLab CI) rather than replacing them. Option E is wrong because Terraform's model is fundamentally immutable/declarative resource replacement, and while it can manage mutable resources via providers, 'manages both mutable and immutable infrastructure' is not a stated key purpose in the same way as A and D.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Terraform enables declarative infrastructure provisioning.
Why this is correct
Terraform's core design principle is declarative infrastructure provisioning. Users define the desired end state of their infrastructure using HashiCorp Configuration Language (HCL) or JSON, rather than specifying a sequence of steps to reach that state. Terraform then computes the necessary actions (create, update, delete) to transition the current infrastructure to the desired configuration, ensuring idempotence and consistency. This approach simplifies management and reduces human error.
- ✗
Terraform provides built-in security scanning.
Why it's wrong here
Terraform is an infrastructure as code tool focused on provisioning and managing resources, not on intrinsic security analysis. It does not include built-in features for scanning infrastructure configurations for security vulnerabilities, compliance violations, or misconfigurations. While security can be enforced through policies (e.g., Sentinel) or integrated with external tools like Checkov or Bridgecrew, these are separate layers, not native Terraform capabilities.
- ✗
Terraform automates continuous delivery pipelines.
Why it's wrong here
Terraform's primary function is to provision and manage infrastructure resources, not to orchestrate or automate continuous delivery pipelines themselves. While Terraform commands (like `plan` and `apply`) are frequently integrated *into* CI/CD pipelines as a critical step for infrastructure deployment, Terraform itself does not manage the entire pipeline workflow, code compilation, testing, or application deployment stages. It serves as a tool within a larger CI/CD ecosystem.
- ✓
Terraform supports multi-cloud and multi-provider environments.
Why this is correct
Terraform is designed with a pluggable provider architecture that enables it to interact with a vast array of cloud platforms, SaaS providers, and on-premises solutions. This allows users to define and manage infrastructure components from different providers (e.g., AWS, Azure, Google Cloud, Kubernetes, GitHub) within a single configuration. This multi-cloud capability is a significant advantage, preventing vendor lock-in and enabling hybrid cloud strategies.
- ✗
Terraform manages both mutable and immutable infrastructure.
Why it's wrong here
Terraform is fundamentally geared towards managing immutable infrastructure, where resources are replaced rather than modified in place after deployment. While it can update existing resources, its best practices and design encourage defining a desired state that, when changed, often leads to the destruction and recreation of resources to ensure consistency. It does not track or manage ad-hoc, manual changes to running infrastructure, which is characteristic of mutable infrastructure paradigms.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 434 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.