Terraform 004 · HashiCorp · Terraform state management · Bank updated 2026-11-03
Terraform 004 practice questions: Terraform state management
5 free questions from 44 on this area · answer and explanation for each · no sign-up
These 5 questions come from the Terraform state management section of our Terraform 004 bank (44 questions on this area, which carries 12.5% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.
Free: 6 questions in study mode, no card. All 44 Terraform state management questions and the full Terraform 004 bank: $15 one-time.
1/5 · Terraform state management
A platform team is moving a configuration that runs on Terraform 1.12 to the S3 backend and reviews how state locking will work before the first terraform init. Which description of locking in the S3 backend is accurate?
AOn by default; the lock lives in the table named by dynamodb_table
BOff until enabled; dynamodb_table must name a table to hold the lock
COn by default; the lock lives in a .tflock object in the S3 bucket
DOff until enabled; use_lockfile = true keeps the lock in the bucket
Answer: D. The S3 backend page, State Storage > State Locking, states: 'State locking is an opt-in feature of the S3 backend.' It adds that locking can be enabled via S3 or DynamoDB, but 'DynamoDB-based locking is deprecated and will be removed in a future minor version.' Under Enabling S3 State Locking it lists use_lockfile, 'Whether to use a lockfile for locking the state file', which defaults to false.
Source: HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
2/5 · Terraform state management
Three teams consume a networking team's VPC and subnet IDs through terraform_remote_state against an S3 backend. A security review objects that every consumer can read the networking team's entire state snapshot, although only the IDs are needed. The networking team wants consumers to receive only the IDs. Which change fits the documented guidance?
AMark each root output as sensitive, so consumers receive redacted values instead of the snapshot
BPublish the IDs to a separate store, such as an SSM parameter, and read them via a data source
CAdd the defaults argument to each consumer's data source, so the snapshot is no longer fetched
DHave each consumer run terraform state pull and extract the IDs from the output with jq
Answer: B. Although terraform_remote_state exposes only output values, its user must have access to the entire state snapshot, which often includes sensitive information. When possible, HashiCorp recommends explicitly publishing data for external consumption to a separate location, using pairs of a managed resource type and a data source such as aws_ssm_parameter, so that different access controls can be applied to shared information and to state snapshots. Source: https://developer.hashicorp.com/terraform/language/state/remote-state-data
Source: HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
3/5 · Terraform state management
A resource block is deleted from a configuration, and the next apply must remove the matching remote object. With the block gone, what does Terraform rely on to put that destruction in a valid order?
AThe built-in ordering of resource types, such as servers before subnets
BThe cached attribute values stored for each resource in the state
CThe copy of the most recent set of dependencies saved in the state
DThe pointer to the provider configuration last used with the resource
Answer: C. Terraform typically uses the configuration to determine dependency order. When a resource is deleted from the configuration, that order cannot be determined from the configuration alone, so Terraform retains a copy of the most recent set of dependencies within the state and can still determine the correct destruction order from it. Source: https://developer.hashicorp.com/terraform/language/state/purpose
Source: HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
4/5 · Terraform state management · hard
A team already runs HashiCorp Consul and prefers it to terraform_remote_state for passing settings between configurations. One configuration must publish values and another must read them. Which pairing do the docs describe?
Aconsul_keys to write the values and consul_key_prefix to read them
Bterraform_remote_state on both sides, with Consul as the backend
Cconsul_key_prefix to write the values and consul_keys to read them
Doutput blocks in the producer and consul_keys in the consumer
5/5 · Terraform state management
A colleague changed a tag on a managed virtual machine in the cloud console. Later, an engineer runs terraform apply on the configuration with default settings. Before Terraform works out which changes to make, what does it do?
Arebuilds the state from the configuration alone, ignoring the recorded bindings
Basks the backend for the previous plan and replays its decisions
Cupdates the recorded state to reflect the real infrastructure
Dimports every remote object that has no binding in the state
Answer: C. The State section says that prior to any operation, Terraform does a refresh to update the state with the real infrastructure. The change made in the console is therefore picked up before changes are determined. Importing objects is a separate, explicit step.
Source: tf-language-state, https://developer.hashicorp.com/terraform/language/state, State, p. 1
Source: HashiCorp Terraform Associate (004) exam objectives and Terraform documentation
Other Terraform 004 areas
The same kind of free sample for every other section of the Terraform 004 bank:
Practise Terraform 004 with instant feedback
6 free questions in study mode · no card · full Terraform 004 bank with area filters and the error log: $15 one-time · no dumps, no ads.
Start Terraform 004 free →
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by HashiCorp. Terraform 004 and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official HashiCorp materials (as of October 2026); always confirm current details with the vendor before booking.