Terraform 004 · HashiCorp · Updated October 2026
Terraform 004 practice questions
Original & expert-reviewed · explanation for every option · no dumps
Practise Terraform 004 with original, expert-reviewed questions — each with an explanation for every option, linked to the source, across the full exam blueprint. No dumps, no ads, 6 free to start.
Free: 6 questions in study mode, no card. Full Terraform 004 bank with mock exams and the error log: $15 one-time, or every exam with All-Access for $19/mo or $119/yr.
Not published
On the real exam
What makes these different from dumps
📚 An explanation for every option
Not just the right answer — why each wrong option is wrong, linked to the source. Wrong answers teach the most.
⏱️ Timed mocks at the real pace
Sit timed runs at the real Terraform 004 pace (57 questions in 60 minutes on the real exam) on all 30 questions in the bank today, and get a readiness report by area.
↻ Spaced-repetition error log
Every miss comes back on a 1 → 3 → 7 → 16-day schedule, so the fixes actually stick.
🔖 Original & reviewed
Every question is written to test the concepts and reviewed before it ships — never copied or leaked “dumps”.
Try 10 real Terraform 004 questions — free, no sign-up
A representative slice of the bank: all exam objectives, mixed difficulty (hard ones included). Answers are one tap away — no email wall.
1/10 · Infrastructure as Code (IaC) with Terraform
A company runs the Terraform CLI from its own CI system. Its security team has written a Sentinel policy that rejects any run creating resources outside two approved regions, and wants it applied automatically before any infrastructure change is made. Where can that policy be enforced?
AIn a newer Terraform CLI release, with the policy stored beside the root module
BIn the existing CI job, with the policy passed to terraform plan as a flag
CIn HCP Terraform or Terraform Enterprise, with the policy in a policy set
DIn Vault Enterprise, with the policy tied to the CI job's Vault token
Show answer & explanation
C is correct. The Policy Compliance and Management section of the Terraform Use Cases page describes Sentinel as a policy-as-code framework that automatically enforces compliance and governance policies before Terraform makes infrastructure changes. It states that Sentinel policies are available in Terraform Enterprise and HCP Terraform, so a pipeline that runs only the standalone CLI has to move its runs there to get that enforcement.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
2/10 · Terraform fundamentals
A root module requires hashicorp/aws with version = ">= 5.0, < 6.0", and its committed .terraform.lock.hcl records aws 5.40.0. Since that commit, aws 5.41.0 has been published, and a developer has added hashicorp/random with version = ">= 3.6, < 4.0", which the lock file does not mention yet. The developer runs terraform init with no extra options. What happens?
Aaws stays on 5.40.0; random gets the newest release its constraint allows
Baws moves to 5.41.0; random gets the newest release its constraint allows
Caws stays on 5.40.0; init fails until random is in the lock file
Daws moves to 5.41.0; init fails until random is in the lock file
Show answer & explanation
A is correct. The Dependency Installation Behavior section of the Dependency Lock File page says that if a provider already has a selection recorded in the lock file, Terraform will always re-select that version, even if a newer version has become available. A provider with no recorded selection gets the newest version that matches its constraint, and init updates the lock file to include it. Picking up aws 5.41.0 requires terraform init -upgrade.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
3/10 · Core Terraform workflow
A reviewer is checking an onboarding slide titled "The core Terraform workflow". The slide must list the workflow's three steps exactly as HashiCorp names them. Which list is correct?
AInit, Plan, Apply
BWrite, Plan, Apply
CWrite, Validate, Apply
DInit, Validate, Apply
Show answer & explanation
B is correct. The Core Terraform Workflow Overview page opens by stating that the core Terraform workflow has three steps: Write, to author infrastructure as code; Plan, to preview changes before applying; and Apply, to provision reproducible infrastructure. The command terraform init appears in the page's individual-practitioner example inside the Write step, not as a step of its own.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
4/10 · Terraform configuration
An engineer changes the image of a production virtual machine. The provider cannot update that argument in place, so the plan proposes to replace the machine. No resource in the configuration has a lifecycle block. In what order does Terraform carry out the replacement during apply?
AIt creates the new machine first, then destroys the old one
BIt destroys the old machine first, then creates the new machine
CThe provider picks the order that suits this resource type
DIt runs the create and the destroy together, in parallel
Show answer & explanation
B is correct. The lifecycle reference, Usage > create_before_destroy, states: 'By default, when Terraform must change a resource argument that cannot be updated in-place due to remote API limitations, Terraform destroys the existing object and then creates a new replacement object with the new configured arguments.' Creating the replacement first is opt-in through create_before_destroy, because many remote object types have unique name requirements or other constraints that must be accommodated for both objects to exist concurrently.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
5/10 · Terraform modules
In the root directory of a working configuration, an engineer creates a subdirectory named network and adds network/main.tf with three subnet resources. Running terraform plan from the root directory shows the existing resources but none of the subnets. What makes the subnets part of this configuration?
AA module block in the root with source = "./network"
BRunning terraform init again after adding the new folder
CRunning terraform -chdir=network plan from the root directory
DA root resource that refers to one of the subnets by address
Show answer & explanation
A is correct. The 'Directories and Modules' section of 'Files and configuration structure' states: 'A Terraform module only consists of the top-level configuration files in a directory; nested directories are treated as completely separate modules, and are not automatically included in the configuration.' It adds that a module 'can use module calls to explicitly include other modules into the configuration', from local directories or from external sources.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
6/10 · Terraform state management
Two engineers share a build server and the same Terraform working directory. The configuration has no backend block, so state is kept in terraform.tfstate in that directory. Both start terraform apply within a few seconds of each other, using default options. What happens to the run that starts second?
AIt stops right away with a lock error and makes no changes
BIt offers to force-unlock the first run's lock, then proceeds
CIt skips locking for local state, and the last writer wins
DIt waits for the lock to be released and then continues
Show answer & explanation
A is correct. The local backend page states: 'The local backend stores state on the local filesystem, locks that state using system APIs, and performs operations locally.' The State Locking page adds that, if supported by your backend, Terraform locks state for all operations that could write state, and that 'If state locking fails, Terraform does not continue.' Retrying for a period of time is what the -lock-timeout option of terraform apply adds, and force-unlock is a separate manual command meant for unlocking your own lock after automatic unlocking failed.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
7/10 · Maintain infrastructure with Terraform
A root configuration calls a child module named vpc, and the module's outputs.tf declares output "vpc_id" with value = aws_vpc.this.id. After a successful apply, running terraform output in the root directory does not show vpc_id. How can the team make terraform output display it?
ARun terraform output module.vpc.vpc_id from the root module's directory
BPass -json to terraform output and read the vpc_id entry under module.vpc
CAdd a root output whose value is module.vpc.vpc_id and apply again
DCopy the module's vpc_id output block into the root's outputs.tf and apply again
Show answer & explanation
C is correct. The terraform output reference (Examples) states that the command only displays outputs defined in the root module, and that to display outputs from child modules you define an output block in the root module using the value of an output from a child module. A parent module refers to that value as module.<MODULE-NAME>.<OUTPUT-NAME>, and the -json and -raw flags only change how root outputs are formatted.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
8/10 · HCP Terraform
A new team member installs Terraform on a laptop and runs terraform login to connect it to HCP Terraform. Where does Terraform keep the API token it obtains?
AIn the operating system's credential store for the current user
BIn a credentials block added to the .terraformrc file
CIn a CLI configuration file named credentials.tfrc.json
DAs a TF_TOKEN_app_terraform_io variable in the shell profile
Show answer & explanation
C is correct. The terraform login reference (Credentials Storage) states that by default Terraform obtains an API token and saves it in plain text in a local CLI configuration file called credentials.tfrc.json, and that terraform login explains where it intends to save the token before doing so. If you do not want the token stored there, you can configure a credentials helper program that stores and retrieves it from another system, such as an existing secrets management system.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
9/10 · Core Terraform workflow · hard
A configuration has pending changes to aws_instance.app, to the aws_subnet and aws_security_group that the instance's arguments refer to, and to an aws_route53_record whose records argument refers to the instance's public IP. An operator runs terraform plan -target=aws_instance.app. Which pending changes does the plan include?
AThe instance alone, leaving the other three changes for later
BThe instance together with its subnet and its security group
CThe instance together with the DNS record pointing at it
DThe instance, its subnet and security group, and the DNS record
Show answer & explanation
B is correct. Under Planning Options, the Resource Targeting section of the terraform plan command page says that once Terraform has selected the directly targeted resource instances, it extends the selection to include all other objects that those selections depend on, either directly or indirectly. The same section describes targeting as a capability for exceptional circumstances, such as recovering from mistakes, and not for routine operations.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
10/10 · Terraform fundamentals · hard
A platform team publishes an internal network module that forty root configurations call. The module works with AWS provider 5.20 and later, and the team already knows that release 6.0 breaks one of its resources. Following the best practices in the Terraform documentation, what belongs in the module's required_providers entry for aws?
Aversion = ">= 5.20, < 6.0", with the 6.0 issue documented
Bversion = ">= 5.20", with the 6.0 issue documented
Cversion = "5.20.0", with the 6.0 issue documented
DNo version argument, with the 5.20 and 6.0 issues documented
Show answer & explanation
B is correct. Under Version Constraints, the Best Practices for Provider Versions subsection says each module should at least declare its minimum provider version with >=, while a module used as the root of a configuration should also set a maximum. It then says not to use ~> or other maximum-version constraints for modules you intend to reuse across many configurations, even if you know the module is not compatible with certain newer versions. Instead, specify a minimum version, document known incompatibilities and let the root module manage the maximum version.
↗ HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
Covering all exam objectives
The bank spans the whole Terraform 004 blueprint, spread evenly across the objectives (HashiCorp publishes no weighting):
Start practising Terraform 004 free
6 free questions in study mode · no card · full Terraform 004 bank: $15 one-time · no dumps, no ads.
Start Terraform 004 free →
Terraform 004 practice — FAQ
What changed between Terraform Associate 003 and Terraform 004?
Version 004 replaced 003 on January 8, 2026. It tests Terraform 1.12 (003 tested Terraform 1.3), regroups the syllabus into eight objectives instead of nine, and HashiCorp lists four new topics: depends_on and create_before_destroy lifecycle rules (4f), custom conditions (4g), ephemeral values and write-only arguments (4h), and organising HCP Terraform workspaces and projects (8c). Practice material written for 003 will not cover these.
Do I need AWS, Azure or Google Cloud experience for Terraform 004?
No. HashiCorp's exam content list says the tutorials may use specific cloud providers to introduce the objectives, but provider-specific knowledge is not necessary for the exam. HashiCorp's own platform is a different matter: HCP Terraform is one of the eight objectives, covering workspaces and projects, collaboration and governance features, and the CLI integration.
How does the online Terraform 004 exam work on the day?
You test on your own computer with a live proctor through Certiverse, after signing in to the HashiCorp Certification Exam Portal with the same GitHub account every time. You need a physical, unexpired government-issued photo ID whose names exactly match your portal account, a private and quiet room, and a single monitor with a webcam. The exam lasts one hour, but HashiCorp advises setting aside at least 90 minutes, and you see pass or fail as soon as you finish.
How many questions is the Terraform 004 exam and how long is it?
One hour of exam time, with no published question count (HashiCorp's exam page lists none), taken online with a live proctor through the Certiverse platform and in English only.
What is the passing score for Terraform 004?
HashiCorp does not publish a numeric cut score — results are pass/fail with per-area performance indicators. Aim for a consistent 80–85% on realistic mocks before booking.
What is the Terraform 004 pass rate?
HashiCorp does not publish official pass rates, so any exact percentage quoted online is unverified. The readiness signal that actually predicts passing: consistently holding 80–85% on realistic, full-length practice exams before you book.
What are the Terraform 004 eligibility requirements?
No prior certification or training course is required - you register through the HashiCorp Certification Exam Portal, which uses your GitHub account and sends you to Certiverse to book and pay. HashiCorp lists skills rather than credentials as prerequisites: basic terminal skills and an understanding of on-premises and cloud architecture; professional experience is recommended, but practising the exam objectives in a personal demo setup can prepare you. The target candidate is a cloud engineer with foundational Terraform knowledge who can identify Terraform Enterprise features and distinguish them from the Community edition. On exam day you need a physical, unexpired government-issued photo ID whose names exactly match your exam portal account.
How much does Terraform 004 cost?
The exam costs $70.50 USD per appointment, plus locally applicable taxes and fees, paid in Certiverse when you book. A free retake is not included, so every attempt is a new purchase. Cancel or reschedule at least 24 hours ahead: later cancellations and no-shows without documentation may forfeit the fee. Renewal also means passing a paid exam - HashiCorp has no continuing-education route.
How long should I study for Terraform 004?
For most candidates, 4-8 weeks of part-time study (commonly reported; HashiCorp publishes no official figure). What matters most is practising questions and analysing why each option is right or wrong — not just reading.
Does the Terraform 004 certification need recertification?
valid for 2 years and renewable only by passing an exam (there is no continuing-education route): from 6 months before expiry you can pass the 004 Associate exam again, or at any time before expiry pass the AWS or Azure version of Terraform Authoring and Operations Advanced, which extends the Associate credential; HashiCorp emails reminders 6, 3 and 1 month before expiry.
Are ExamDeck's Terraform 004 questions exam dumps?
No — every question is original, written to test the concepts and reviewed before it ships, with an explanation linked to the source for every option. Dumps are stale, often wrong, and against HashiCorp's policies.
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by HashiCorp. Terraform 004 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official HashiCorp materials (as of October 2026); always confirm current details with the vendor before booking.