Free Terraform Associate Practice Exam 2026 — The Questions That Tripped Me Up

IaC's core value is consistency and reproducibility. Code can be version-controlled (Git), peer-reviewed, tested, and reused. It's not always faster (first-time setup can be slower), doesn't eliminate bugs, and you still need cloud accounts.

terraform init is always the first command you run. It downloads provider plugins, initializes the backend (where state is stored), and downloads modules. You must run it before plan or apply. Validate checks syntax but doesn't download anything.

This is a classic gotcha. Terraform tracks resources by their address in state (e.g., aws_instance.web). If you rename it to aws_instance.server, Terraform sees "web" as deleted and "server" as new — so it plans to destroy and recreate. Use terraform state mv or the moved block (Terraform 1.1+) to avoid downtime.

When no backend is configured, Terraform stores state locally in a file called terraform.tfstate. This is fine for personal projects but terrible for teams — no locking, no sharing, no encryption. Production should always use a remote backend like S3+DynamoDB or HCP Terraform.

terraform state list shows all resources currently tracked in state. terraform show displays the full state details (also read-only). terraform plan compares config to state (read-only but queries providers). terraform output shows output values only. Both state list and show work, but state list gives the cleanest resource overview.

Modules are containers for multiple resources that are used together. Think of them like functions in programming — they let you package, reuse, and share infrastructure patterns. A VPC module might contain subnets, route tables, and gateways as one reusable unit.

Terraform uses "list" not "array." Valid types are: string, number, bool, list, set, map, object, tuple, and any. If you come from a JavaScript/Python background, this trips you up because "array" feels natural — but HCL uses "list."

The .terraform.lock.hcl file (dependency lock file) records exact provider versions and their hashes. It's generated by terraform init and should be committed to version control. This ensures everyone on the team uses identical provider versions. providers.tf and versions.tf contain version constraints, but the lock file pins the exact version.

terraform plan compares your configuration to the current state and shows what would change — resources to add, modify, or destroy. It does NOT make any changes. Think of it as a dry run. Always run plan before apply to review changes.

Workspaces let you maintain separate state files for the same configuration. Each workspace (staging, production) has its own state, so the same code provisions isolated environments. Use terraform.workspace to customize per-environment values. Note: in practice, many teams prefer separate directories or modules over workspaces, but for the exam, workspaces is the answer.

Setting sensitive = true in the variable definition tells Terraform to redact the value from plan and apply output. The value still exists in state (state should be encrypted!), but it won't appear in logs. Neither underscores, tfvars files, nor env vars automatically suppress output.

terraform import maps an existing resource to a Terraform resource address. You need to write the resource block in your config first, then import. In Terraform 1.5+, you can also use import blocks declaratively. But the CLI command is terraform import RESOURCE_ADDRESS RESOURCE_ID.