HashiCorp Certified: Terraform Authoring and Operations Professional practice questions

Question 1

An engineer is debugging a for_each iteration in a SaaS multi-tenant module where someone passed a list of strings directly and Terraform rejected it, and the engineer must decide how to coerce the input correctly. Per the Terraform language documentation on the for_each meta-argument, which option matches?

Accepted Answer

It accepts maps where each key becomes the instance identifier, and sets of strings created using toset() since for_each does not implicitly convert lists or tuples to sets.

Answer

The for_each meta-argument implicitly converts lists and tuples to sets, so a bare list of strings is always a valid input value for resource and module blocks.

Answer

The for_each meta-argument accepts only objects whose top-level attributes are strings, and never accepts maps or sets as the iteration value for resource or module blocks.

Answer

The for_each meta-argument accepts only the result of the range() built-in function and rejects any value created via toset() at plan time as an unsupported iteration value.

Question 2

A developer is hitting a wall because a creation-time provisioner on an aws_instance keeps failing, and after each failed run Terraform forces that resource to be replaced on the next apply. Per the Terraform language documentation on provisioners, why does Terraform replace the resource?

Accepted Answer

Terraform marks the resource as tainted because a failed creation-time provisioner can leave it half-built

Answer

The provider flags the instance as drifted, so Terraform recreates it to reconcile the state file again

Answer

Terraform applies create_before_destroy automatically whenever a provisioner block returns any error

Answer

Terraform records the failure in the lock file and schedules a rebuild during the next refresh-only plan run

Question 3

A team has decided to rename a resource inside a published module from aws_instance.a to aws_instance.b and must ensure existing consumers do not destroy and recreate the running instance on the next apply. Per the Terraform documentation on refactoring modules, what will a correctly recorded change cause Terraform to do?

Accepted Answer

Terraform renames the existing object from aws_instance.a to aws_instance.b in state, so no destroy occurs during apply.

Answer

Terraform plans an in-place update of aws_instance.a and leaves the old address in state until a manual terraform state rm runs.

Answer

Terraform forces replacement of the instance because a changed resource address is treated as a brand-new resource needing create.

Answer

Terraform refuses to plan and reports an error until the consumer manually imports aws_instance.b with terraform import first.

Question 4

An organization is tasked with updating providers and modules to the latest acceptable versions while still honoring documented constraints in a healthcare hybrid-cloud workspace. Per the Terraform language documentation, which CLI invocation matches?

Accepted Answer

The terraform init -upgrade command updates providers and modules to the latest acceptable versions while respecting constraints.

Answer

The terraform refresh -upgrade command updates providers and modules to the latest acceptable versions while respecting constraints.

Answer

The terraform plan -upgrade command updates providers and modules to the latest acceptable versions while respecting constraints.

Answer

The terraform apply -upgrade command updates providers and modules to the latest acceptable versions while respecting constraints.

Question 5

An organization is rolling out Sentinel policy-as-code for a public sector compliance program such that some checks block runs hard, others can be overridden by authorized personnel, and others only warn. Per the HCP Terraform documentation on policy as code, which TWO options match the documented enforcement levels?

Accepted Answer

Policy enforcement operates at three levels: advisory policies generate warnings without blocking, soft-mandatory policies must pass unless an override is specified by authorized personnel, and hard-mandatory policies must always pass and immediately fail runs on violation.

Accepted Answer

Sentinel policies written in HashiCorp Sentinel language enforce rules such as requiring specific tags, restricting instance types, or mandating encryption.

Answer

HCP Terraform supports only one enforcement level — hard-mandatory — for both Sentinel and OPA policies, with no advisory or soft-mandatory mode supported in current HCP Terraform versions.

Answer

HCP Terraform supports two enforcement levels: pre-plan-block and post-apply-block, replacing the legacy advisory, soft-mandatory, and hard-mandatory taxonomy for governance frameworks at HCP Terraform organizations.

Question 6

A company is standardizing how it consumes Terraform providers, and the architect must brief leadership on how providers relate to Terraform itself. Which TWO statements are accurate? (Choose two.)

Accepted Answer

Each provider adds a set of resource types and/or data sources that Terraform itself can manage

Accepted Answer

Providers are distributed separately from Terraform, each with its own release cadence and version

Answer

Providers ship bundled inside the Terraform CLI binary and are versioned together with each CLI release

Answer

Every provider must configure a remote cloud platform and cannot offer purely local utilities

Question 7

A developer is using for_each with both a map and a set in the same module and must correctly reference the each object across the two instances. Per the Terraform language documentation on for_each, which TWO statements are correct?

Accepted Answer

each.key is the map key or the set member that corresponds to the current instance of the resource.

Accepted Answer

When for_each receives a set rather than a map, each.value is the same as each.key for that instance.

Answer

each.index supplies a zero-based integer that gives the ordinal position of the current instance value.

Answer

Terraform identifies these instances by their integer position rather than by map key or set member.

Question 8

A sysadmin is tasked with bringing an existing security group under Terraform management using the terraform import CLI command, and the engineer asks what must already be in place before the command runs. Per the Terraform CLI documentation on importing existing resources, which statement matches?

Accepted Answer

terraform import requires a resource block written beforehand and can only import the existing object into the Terraform state.

Answer

terraform import generates the matching resource configuration automatically as soon as the remote object identifier is supplied to it.

Answer

terraform import binds a single remote object to several resource addresses at once so the workspace can track redundancy cleanly.

Answer

terraform import both writes the resource configuration and provisions a fresh replacement object for the operator during the run.

Question 9

A production team is evaluating the side effects of running terraform test against a module that provisions real cloud resources, before adopting it in CI. Per the Terraform documentation on the test command, which two statements are correct? (Choose two.)

Accepted Answer

Each test file keeps its state in memory, separate from the configuration's existing state, so live infra is untouched.

Accepted Answer

The test command creates real infrastructure and attempts to destroy it after each file, reporting anything it cannot remove.

Answer

Test runs are plan-only by default, so no provider APIs are invoked and no real cloud resources get created during a run.

Answer

Terraform commits the test state to the configured remote backend so the results can be audited and replayed by the whole CI pipeline.

Question 10

An organization is designing dev, staging, and production environments with identical infrastructure patterns inside a single Terraform configuration for a public sector compliance program. Per the Terraform language documentation on workspaces, which option matches?

Accepted Answer

Workspaces share the same backend configuration and code, making them suitable for parallel environments like dev, staging, and production with identical infrastructure patterns.

Answer

Workspaces require separate backend configurations per environment and are therefore unsuitable for parallel environments like dev, staging, and production within a single configuration directory.

Answer

Workspaces are limited to a single environment per configuration directory and Terraform forbids more than one workspace existing simultaneously in any directory tree.

Answer

Workspaces have been removed in current Terraform and the documented replacement is forking the configuration directory once per environment for any deployment pattern.

Question 11

An administrator is onboarding a new team into HCP Terraform and wants to grant it permissions for a specific group of resources, but no workspace has been created yet. Per the documentation, why must a workspace be created first?

Accepted Answer

Workspaces are required and are a major component of role-based access, so resources cannot be managed without one.

Answer

Workspaces are optional, but the private registry cannot publish the team's modules until at least one workspace exists.

Answer

Workspaces only isolate CLI state files within a working directory and play no part in HCP Terraform access control.

Answer

Workspaces exist purely to hold provider credentials and are entirely unrelated to granting user permissions.

Question 12

An architect is designing how to read existing infrastructure attributes into a Terraform configuration at a healthcare hybrid-cloud operator without taking ownership of those objects, so downstream resources can compose against them. Per the Terraform language documentation on provider data sources, which option matches?

Accepted Answer

Data sources allow Terraform to use information defined outside of the current configuration or computed by external systems.

Answer

Data sources allow Terraform to create new infrastructure under management without executing a plan and apply cycle, instead writing the result directly to the local state file at the time the data block is parsed.

Answer

Data sources allow Terraform to write to provider APIs and persist results to state for downstream reads, equivalent to a resource block but with implicit deletion on destroy.

Answer

Data sources allow Terraform to define provider plugins inline within a configuration without using the required_providers block in the terraform settings.

Question 13

A platform team is factoring a long cloud-init configuration out of an inline string into a separate file rendered with templatefile, and must supply per-host values for interpolation. Per the Terraform language documentation on the templatefile function, which statement is correct?

Accepted Answer

templatefile takes (path, vars), where vars must be an object whose keys become variables available for interpolation in the file.

Answer

templatefile accepts a list of positional values as its second argument and binds each of them to template variables strictly by index.

Answer

templatefile inlines a child module's outputs automatically, so the vars argument becomes optional whenever such a module exists nearby.

Answer

templatefile evaluates %{ ... } directives only, so any ${ ... } interpolation sequences are silently ignored inside the rendered file.

Question 14

An administrator is tasked with writing a precise resource address to target a single instance inside a nested module during a terraform state mv, and needs to know how an address is structured. Per the Terraform CLI documentation, which option matches the documented address format?

Accepted Answer

Two parts written as [module path][resource spec], optionally with an index for a multi-instance one

Answer

A single string formed as [resource spec][module path], with the spec placed ahead of the module path

Answer

A region prefix followed by the provider name, which together uniquely identify the remote object here

Answer

The provider source address joined to the workspace name to scope the instance to one backend state

Question 15

A department is splitting a large monolithic configuration into modules and must decide how to group resources owned by different teams. Per the Terraform recommended module creation pattern, which principle should guide where module boundaries fall?

Accepted Answer

Keep each module within a privilege boundary so one module does not span responsibilities and violate segregation of duties.

Answer

Encapsulate every resource the whole organization owns into one large module so consumers deploy the entire estate from one block.

Answer

Group resources strictly by cloud region so each module maps to exactly one availability zone in the target environment.

Answer

Split modules by file type, placing all variables in one module and all outputs in a separate downstream module entirely.

HashiCorp Certified: Terraform Authoring and Operations Professional

Sample questions

Sources

Similar exams