HCTA-004 Study Manual

Focused study guide for HashiCorp Terraform Associate certification.

TERRAFORM ASSOCIATE 004 — FOCUSED REMEDIATION GUIDE

Candidate: Nico Willem Kotze — HCP00235155 — Exam ID: HCTA0-004

Based on TWO official exam attempts + practice quiz data

Goal: Fill every gap and guarantee a pass on the next sitting

OFFICIAL EXAM HISTORY

Attempt 1 — 13 February 2026 — FAIL

Section	Performance
---------	-------------
1. Infrastructure as Code (IaC) with Terraform	🟡 Review Needed
2. Terraform fundamentals	✅ Meets Expectations
3. Core Terraform workflow	✅ Meets Expectations
4. Terraform configuration	🟡 Review Needed
5. Terraform modules	✅ Meets Expectations
6. Terraform state management	🟡 Review Needed
7. Maintain infrastructure with Terraform	🟡 Review Needed
8. HCP Terraform	🟡 Review Needed

Attempt 2 — 15 April 2026 — FAIL

Section	Performance	Trend
---------	-------------	-------
1. Infrastructure as Code (IaC) with Terraform	🟡 Review Needed	➡️ No change
2. Terraform fundamentals	✅ Meets Expectations	➡️ No change
3. Core Terraform workflow	✅ Meets Expectations	➡️ No change
4. Terraform configuration	🟡 Review Needed	➡️ No change
5. Terraform modules	✅ Meets Expectations	➡️ No change
6. Terraform state management	✅ Meets Expectations	⬆️ IMPROVED
7. Maintain infrastructure with Terraform	✅ Meets Expectations	⬆️ IMPROVED
8. HCP Terraform	🔴 Intense Study	⬇️ REGRESSED

DIAGNOSIS — WHY YOU ARE FAILING

You met expectations on 5 of 8 sections in your latest attempt. That means you are CLOSE. But three sections are dragging you below the pass threshold:

🔴 CRITICAL — Section 8: HCP Terraform → INTENSE STUDY (got WORSE)

This regressed from "Review Needed" to "Intense Study" between attempts. This is the single biggest reason you are failing. You need deep, focused work here — not just a review.

🟡 STUCK — Section 1: IaC with Terraform → REVIEW NEEDED (no improvement)

"Review Needed" on both attempts. Your practice quiz scored 94.4%, so you understand the concepts but are getting tripped up by exam-style questions. You need to practise the exact nuances the exam tests.

🟡 STUCK — Section 4: Terraform Configuration → REVIEW NEEDED (no improvement)

"Review Needed" on both attempts. This is a high-weight section covering variables, functions, expressions, count/for_each, and dynamic blocks. Your practice quiz for Domain 3 (overlapping content) showed 88.1% with 8 mistakes on syntax and types.

✅ STRENGTHS — Sections 2, 3, 5, 6, 7

Fundamentals, Workflow, Modules, State, and Maintain Infrastructure all meet expectations. Sections 6 & 7 improved between attempts — your studying worked. Keep these maintained but do NOT over-invest here.

REVISED PRIORITY ORDER (based on real exam results)

1. Section 8 — HCP Terraform 🔴 INTENSE STUDY — your worst section, getting worse
2. Section 4 — Terraform Configuration 🟡 STUCK — high weight, no progress across 2 attempts
3. Section 1 — IaC with Terraform 🟡 STUCK — no progress across 2 attempts
4. Section 5 — Modules (maintenance — meets expectations but practice quiz was weak at 79.6%)
5. Sections 2, 3, 6, 7 (light review only — all meeting expectations)

PART 1 — DOMAIN 5: MODULES (CRITICAL — 10 wrong answers)

Your mistakes clustered around three themes:

Theme A: What Modules ARE

Key Facts to Memorise

A module is a container for multiple resources that are used together, defined by .tf files in a directory.
The root module is simply the working directory where you run terraform plan / terraform apply. Every Terraform project has one.
Module composition means building complex infrastructure from smaller, focused modules assembled in the root module. It is NOT merging files or compiling binaries.

project/                      <-- root module
├── main.tf
├── modules/
│   ├── networking/           <-- child module
│   │   ├── main.tf
│   │   └── variables.tf
│   └── compute/              <-- child module
│       ├── main.tf
│       └── outputs.tf

Mini-drill

Q: What is the root module?

A: The top-level working directory where Terraform commands execute. It is NOT a special module with zero resources.

Q: Can a root module contain resources of its own?

A: Yes. The root module is just like any other module but it's the entry point.

Theme B: How You CALL Modules

Passing Input Variables

You pass values as arguments inside the module block. They are NOT inherited automatically and are NOT set via environment variables.

module "vpc" {
  source      = "./modules/networking"
  cidr_block  = "10.0.0.0/16"        # matches variable "cidr_block" in child module
  environment = var.env               # you can pass parent variables through
}

The child module declares:

# modules/networking/variables.tf
variable "cidr_block" {
  type = string
}

variable "environment" {
  type = string
}

Key Rule: `terraform init` Is REQUIRED After Adding/Changing Module Sources

If you add a new module block or change the source argument and skip terraform init, Terraform will error. It will NOT download modules automatically during plan or apply.

Error: Module not installed
  Module "vpc" is not yet installed. Run "terraform init" to install all modules

`terraform get` vs `terraform init`

Command	Downloads modules?	Downloads providers?	Configures backend?
---------	-------------------	---------------------	-------------------
`terraform get`	✅ Yes	❌ No	❌ No
`terraform init`	✅ Yes	✅ Yes	✅ Yes

terraform get only downloads/updates modules. terraform init does everything including modules.

Theme C: Module Sources

Terraform Registry (Public)

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.0.0"
}

Use version = "x.y.z" to pin registry modules.

Private GitHub Repository

module "internal" {
  source = "git::https://github.com/company/my-module.git"
}

# With a specific branch/tag:
module "internal_v2" {
  source = "git::https://github.com/company/my-module.git?ref=v2.0.0"
}

# SSH:
module "internal_ssh" {
  source = "git::git@github.com:company/my-module.git"
}

Exam trap: source = "github.com/company/my-module" (no git:: prefix and no .git suffix) is a shorthand that Terraform supports for public GitHub repos, but the explicit git::https://... form is the correct, general-purpose answer for private repos.

HCP Terraform Private Registry

module "internal" {
  source  = "app.terraform.io/my-org/my-module/aws"
  version = "1.0.0"
}

The Private Registry is a feature of HCP Terraform that lets organisations share modules privately. It is NOT a local directory, NOT a premium public registry, and NOT just a Git repo.

Domain 5 — Practice Questions (20 questions)

Q1

You add a new module "db" block to your root configuration. What must you run before terraform apply?

A) terraform validate
B) terraform refresh
C) terraform init
D) Nothing — Terraform downloads it automatically

<details><summary>Answer</summary>

C) terraform init

Whenever you add or change a module source, you must run terraform init to download the module code. Skipping this produces "Module not installed" errors.

</details>

Q2

How do you pass a value to a child module's input variable?

A) Export it as an environment variable with TF_VAR_ prefix
B) Set it as an argument in the module block
C) Child modules automatically inherit all parent variables
D) Use a terraform.tfvars file in the child module directory

<details><summary>Answer</summary>

B) Set it as an argument in the module block

Module inputs are explicitly passed as arguments: module "x" { source = "..." my_var = "value" }. They are NOT inherited automatically.

</details>

Q3

What is the root module?

A) The first module published to the registry
B) A module that contains zero resources
C) The working directory where terraform plan/apply is run
D) The module with the most resources

<details><summary>Answer</summary>

C) The working directory where terraform plan/apply is run

The root module is the set of .tf files in the directory where you execute Terraform commands. It can (and usually does) contain resources.

</details>

Q4

What does terraform get do?

A) Fetches the remote state file
B) Downloads and updates modules referenced in the configuration
C) Gets provider documentation
D) Retrieves output values from another workspace

<details><summary>Answer</summary>

B) Downloads and updates modules referenced in the configuration

terraform get downloads modules only. For providers and backend setup, use terraform init.

</details>

Q5

What is module composition?

A) Compiling multiple modules into a single binary
B) Merging all module files into one directory
C) Building complex infrastructure by assembling smaller, focused modules in the root module
D) Running modules in parallel

<details><summary>Answer</summary>

C) Building complex infrastructure by assembling smaller, focused modules in the root module

Composition = combining VPC module + compute module + database module in the root module. Each module handles one concern.

</details>

Q6

How do you source a module from a private GitHub repository?

A) source = "github.com/company/my-module"
B) source = "git::https://github.com/company/my-module.git"
C) source = "private://github/company/my-module"
D) Private GitHub repos cannot be used as module sources

<details><summary>Answer</summary>

B) source = "git::https://github.com/company/my-module.git"

The git:: prefix with the full HTTPS URL (and .git suffix) is the correct format for Git-based module sources, especially private repos.

</details>

Q7

What is the HCP Terraform Private Registry?

A) A local directory for storing modules
B) A premium version of the public Terraform Registry
C) A feature of HCP Terraform for sharing modules privately within an organisation
D) A Git repository hosted by HashiCorp

<details><summary>Answer</summary>

C) A feature of HCP Terraform for sharing modules privately within an organisation

The Private Registry lets teams publish, version, and share modules with access controls, visible only within the organisation.

</details>

Q8

What is the purpose of module input variables?

A) To store state data
B) To define provider configurations
C) To pass values into a module to customise its behaviour
D) To display output from the module

<details><summary>Answer</summary>

C) To pass values into a module to customise its behaviour

Input variables make modules reusable by accepting different values for each call.

</details>

Q9

What is a Terraform module?

A) A single Terraform provider
B) A single resource definition
C) A container for multiple resources defined by .tf files in a directory
D) A state file

<details><summary>Answer</summary>

C) A container for multiple resources defined by .tf files in a directory

Every set of .tf files in a directory is a module. The root directory is the root module.

</details>

Q10

How do you specify version 3.0.0 of a module from the Terraform Registry?

A) Append ?ref=v3.0.0 to the source path
B) Add version = "3.0.0" in the module block
C) Modules from the registry cannot be versioned
D) Use source = "module@3.0.0"

<details><summary>Answer</summary>

B) Add version = "3.0.0" in the module block

For registry modules, use the version argument. The ?ref= syntax is for Git sources only.

</details>

Q11

You have a module with output "vpc_id" { value = aws_vpc.main.id }. How do you access this output from the root module?

A) output.vpc_id
B) module.my_module.vpc_id
C) var.vpc_id
D) data.my_module.vpc_id

<details><summary>Answer</summary>

B) module.my_module.vpc_id

Module outputs are accessed via module.<MODULE_NAME>.<OUTPUT_NAME>.

</details>

Q12

You want to use the same networking module in dev, staging, and production. What makes this possible?

A) Hardcoding values in the module for each environment
B) Input variables that allow each call to pass different values
C) Creating three separate copies of the module
D) Using terraform workspace inside the module

<details><summary>Answer</summary>

B) Input variables that allow each call to pass different values

Variables make modules reusable: call the same module three times with different CIDR blocks, names, etc.

</details>

Q13

Which command downloads modules WITHOUT downloading providers or configuring the backend?

A) terraform init
B) terraform get
C) terraform plan
D) terraform fetch

<details><summary>Answer</summary>

B) terraform get

terraform get is modules-only. terraform init does modules + providers + backend.

</details>

Q14

Where are downloaded modules stored locally?

A) In the terraform.tfstate file
B) In the .terraform/modules/ directory
C) In the root of the project directory
D) In /usr/local/terraform/modules/

<details><summary>Answer</summary>

B) In the .terraform/modules/ directory

After terraform init or terraform get, module source code is cached in .terraform/modules/.

</details>

Q15

What happens if a child module does NOT declare an output for a resource attribute?

A) The root module can still access it using module.<name>.<resource>.<attribute>
B) The attribute is completely inaccessible from outside the child module
C) Terraform automatically exports all attributes
D) You can use data blocks to read child module resources

<details><summary>Answer</summary>

B) The attribute is completely inaccessible from outside the child module

Modules are encapsulated. Only declared output blocks expose values to the calling module.

</details>

Q16

You want to use a module published at registry.terraform.io/hashicorp/consul/aws. What is the correct source?

A) source = "https://registry.terraform.io/hashicorp/consul/aws"
B) source = "hashicorp/consul/aws"
C) source = "git::https://github.com/hashicorp/consul.git"
D) source = "registry://hashicorp/consul/aws"

<details><summary>Answer</summary>

B) source = "hashicorp/consul/aws"

Public registry modules use the shorthand <NAMESPACE>/<MODULE>/<PROVIDER> format without the full URL.

</details>

Q17

Which is true about module versioning?

A) Local path modules support the version argument
B) Only registry modules support the version argument
C) Git modules use version instead of ?ref=
D) The version argument is deprecated

<details><summary>Answer</summary>

B) Only registry modules support the version argument

The version constraint only works with Terraform Registry sources. Git sources use ?ref=. Local paths have no versioning mechanism.

</details>

Q18

What is the minimum set of files a valid Terraform module must contain?

A) main.tf, variables.tf, and outputs.tf
B) At least one .tf file (even an empty one)
C) A module.json manifest file
D) A README.md and main.tf

<details><summary>Answer</summary>

B) At least one .tf file (even an empty one)

A module is any directory with .tf files. While best practice includes main.tf, variables.tf, and outputs.tf, only one .tf file is technically required.

</details>

Q19

You call a module twice with different names. Do they share state?

module "vpc_dev" {
  source = "./modules/vpc"
  cidr   = "10.0.0.0/16"
}

module "vpc_prod" {
  source = "./modules/vpc"
  cidr   = "10.1.0.0/16"
}

A) Yes, they share the same state and resources
B) No, each module call creates its own independent set of resources
C) Only if they have the same source
D) Only if they are in the same workspace

<details><summary>Answer</summary>

B) No, each module call creates its own independent set of resources

Each module block with a unique name creates a separate instance with its own resources tracked independently in state.

</details>

Q20

What happens when you remove a module block from your configuration but the resources still exist?

A) Nothing — Terraform ignores them
B) Terraform plans to destroy all resources that were managed by that module
C) Resources become orphaned and unmanaged
D) Terraform moves them to the root module

<details><summary>Answer</summary>

B) Terraform plans to destroy all resources that were managed by that module

Removing a module block is the same as removing resource blocks — Terraform plans to destroy anything in state that is no longer in config.

</details>

PART 2 — DOMAIN 8: READ, GENERATE & MODIFY CONFIGURATION (High Weight — NOT STUDIED)

This is one of the two highest-weighted domains. You MUST master it.

Variable Types

# Primitive types
variable "name"        { type = string }
variable "count_num"   { type = number }
variable "enabled"     { type = bool }

# Collection types
variable "cidrs"       { type = list(string) }
variable "unique_ids"  { type = set(string) }
variable "tags"        { type = map(string) }

# Structural types
variable "config" {
  type = object({
    name    = string
    size    = number
    enabled = bool
  })
}

variable "mixed" {
  type = tuple([string, number, bool])
}

Variable Precedence (LOWEST → HIGHEST)

1. Default value in variable block          (lowest)
2. Environment variable  TF_VAR_name
3. terraform.tfvars file
4. *.auto.tfvars files (alphabetical order)
5. -var-file flag
6. -var flag on CLI                          (highest — always wins)

Mnemonic: Default → Env → T.tfvars → Auto.tfvars → -var-File → -var flag

Think: "DETAF-v"

Conditional Expressions

# Ternary syntax — the ONLY conditional form in HCL
instance_type = var.env == "prod" ? "m5.large" : "t3.micro"

There are no if/else blocks or switch statements in HCL.

Count vs for_each

Feature	`count`	`for_each`
---------	---------	------------
Input	Integer	Map or Set
Addressing	`resource[0]`, `resource[1]`	`resource["key"]`
Reorder-safe?	❌ No — removing item 0 shifts all indices	✅ Yes — keyed by name
Best for	Simple duplication	Named instances

# count
resource "aws_instance" "web" {
  count         = 3
  ami           = "ami-123"
  instance_type = "t3.micro"
  tags = { Name = "web-${count.index}" }
}
# Access: aws_instance.web[0], aws_instance.web[1], aws_instance.web[2]

# for_each
resource "aws_instance" "web" {
  for_each      = toset(["alpha", "beta", "gamma"])
  ami           = "ami-123"
  instance_type = "t3.micro"
  tags = { Name = "web-${each.key}" }
}
# Access: aws_instance.web["alpha"], aws_instance.web["beta"]

Dynamic Blocks

resource "aws_security_group" "web" {
  name = "web-sg"

  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      from_port   = ingress.value.from
      to_port     = ingress.value.to
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidrs
    }
  }
}

Dynamic blocks generate repeated nested blocks from a collection. The iterator defaults to the block label (e.g. ingress).

Key Functions

Function	Purpose	Example
----------	---------	---------
`join(sep, list)`	Join list to string	`join(", ", ["a","b"])` → `"a, b"`
`split(sep, str)`	Split string to list	`split(",", "a,b")` → `["a","b"]`
`lookup(map, key, default)`	Map lookup	`lookup(var.amis, "us-east-1", "ami-default")`
`file(path)`	Read file as string	`file("script.sh")`
`templatefile(path, vars)`	Render template	`templatefile("init.tpl", { name = "web" })`
`format(spec, vals...)`	Format string	`format("vm-%02d", 1)` → `"vm-01"`
`coalesce(vals...)`	First non-null/empty	`coalesce("", "hello")` → `"hello"`
`try(expr, fallback)`	Safe evaluation	`try(var.obj.key, "default")`
`can(expr)`	Returns bool	`can(regex("^ami-", var.id))` → `true/false`
`cidrsubnet(prefix, newbits, netnum)`	Subnet calc	`cidrsubnet("10.0.0.0/16", 8, 1)` → `"10.0.1.0/24"`
`upper(str)` / `lower(str)`	Case change	`upper("hello")` → `"HELLO"`
`length(collection)`	Count elements	`length(["a","b","c"])` → `3`
`flatten(list)`	Flatten nested lists	`flatten([["a"],["b","c"]])` → `["a","b","c"]`
`merge(maps...)`	Merge maps	`merge({a=1}, {b=2})` → `{a=1, b=2}`
`toset(list)`	List → Set	`toset(["a","b","a"])` → removes dupes

For Expressions

# List comprehension — produces a list
upper_names = [for n in var.names : upper(n)]

# Filtered list
adults = [for p in var.people : p.name if p.age >= 18]

# Map comprehension — produces a map (use { } not [ ])
name_to_role = { for u in var.users : u.name => u.role }

Splat Expression

# Collects one attribute from all instances
all_ids = aws_instance.web[*].id
# Equivalent to: [for i in aws_instance.web : i.id]

`moved` Block (004-specific)

moved {
  from = aws_instance.old_name
  to   = aws_instance.new_name
}

Declares a refactoring. Terraform migrates state automatically — no manual terraform state mv needed. The moved block is checked, reproducible, and safe for team workflows.

`depends_on`

resource "aws_instance" "app" {
  # ... config ...
  depends_on = [aws_iam_role_policy.app_policy]
}

Use depends_on only when Terraform cannot automatically infer the dependency. Overuse is an anti-pattern.

Outputs

output "instance_ip" {
  value       = aws_instance.web.public_ip
  description = "Public IP of the web server"
  sensitive   = true   # hides value in CLI output
}

Environment Variables for Input Variables

Prefix with TF_VAR_:

export TF_VAR_region="eu-west-1"
export TF_VAR_instance_type="t3.small"

`terraform.workspace`

resource "aws_instance" "web" {
  tags = {
    Environment = terraform.workspace   # "default", "dev", "prod", etc.
  }
}

Domain 8 — Practice Questions (20 questions)

Q1

What is the variable precedence order from lowest to highest?

A) CLI flag → tfvars → env → default
B) Default → env → terraform.tfvars → *.auto.tfvars → -var-file → -var flag
C) All sources have equal precedence
D) terraform.tfvars always wins

<details><summary>Answer</summary>

B) Default → env → terraform.tfvars → *.auto.tfvars → -var-file → -var flag

The -var flag on the CLI always has the highest precedence.

</details>

Q2

Which expression syntax does Terraform use for conditionals?

A) if/else blocks
B) switch statements
C) condition ? true_value : false_value
D) match expressions

<details><summary>Answer</summary>

C) condition ? true_value : false_value

HCL uses only the ternary conditional expression. There are no if/else or switch constructs.

</details>

Q3

You have count = 4 on an aws_instance resource named web. How do you reference the third instance's ID?

A) aws_instance.web[3].id
B) aws_instance.web[2].id
C) aws_instance.web.2.id
D) aws_instance.web(2).id

<details><summary>Answer</summary>

B) aws_instance.web[2].id

Terraform uses zero-based indexing. Third instance = index 2.

</details>

Q4

What is the key advantage of for_each over count?

A) for_each supports higher numbers
B) for_each uses meaningful keys, so removing an item doesn't shift other resources
C) for_each is faster
D) count is deprecated

<details><summary>Answer</summary>

B) for_each uses meaningful keys, so removing an item doesn't shift other resources

With count, deleting index 0 shifts all subsequent indices, potentially destroying and recreating resources. for_each keys are stable.

</details>

Q5

What does a dynamic block do?

A) Creates resources at runtime
B) Generates repeated nested blocks within a resource from a collection
C) Dynamically selects providers
D) Runs shell commands

<details><summary>Answer</summary>

B) Generates repeated nested blocks within a resource from a collection

Dynamic blocks avoid writing repetitive nested blocks like multiple ingress rules.

</details>

Q6

How do you set a Terraform input variable via an environment variable?

A) TERRAFORM_region=eu-west-1
B) TF_VAR_region=eu-west-1
C) VAR_region=eu-west-1
D) ENV_region=eu-west-1

<details><summary>Answer</summary>

B) TF_VAR_region=eu-west-1

The prefix must be exactly TF_VAR_ followed by the variable name.

</details>

Q7

What does the moved block do?

A) Moves cloud resources between regions
B) Moves files on the local filesystem
C) Declares a resource/module rename so Terraform migrates state automatically
D) Moves providers to a different registry

<details><summary>Answer</summary>

C) Declares a resource/module rename so Terraform migrates state automatically

The moved block is a safe, reproducible way to refactor resource names without manual terraform state mv commands.

</details>

Q8

What function reads a file and returns its contents as a string?

A) read("file.txt")
B) file("file.txt")
C) load("file.txt")
D) open("file.txt")

<details><summary>Answer</summary>

B) file("file.txt")

The file() function reads a file from disk and returns its contents as a string.

</details>

Q9

What does can(expression) return?

A) The result of the expression
B) true if the expression succeeds, false if it errors
C) An error message
D) The expression type

<details><summary>Answer</summary>

B) true if the expression succeeds, false if it errors

can() is commonly used in validation blocks: condition = can(regex("^ami-", var.id)).

</details>

Q10

What does the splat expression aws_instance.web[*].id return?

A) The first instance's ID
B) A list of IDs from all instances
C) A map of IDs
D) An error

<details><summary>Answer</summary>

B) A list of IDs from all instances

The splat [*] collects the specified attribute from every instance into a list.

</details>

Q11

How do you mark an output as sensitive?

A) encrypted = true
B) sensitive = true
C) hidden = true
D) secret = true

<details><summary>Answer</summary>

B) sensitive = true

Setting sensitive = true on an output prevents its value from being displayed in CLI output.

</details>

Q12

Which for expression produces a MAP?

A) [for s in var.list : upper(s)]
B) {for s in var.list : s => upper(s)}
C) (for s in var.list : upper(s))
D) <for s in var.list : upper(s)>

<details><summary>Answer</summary>

B) {for s in var.list : s => upper(s)}

Curly braces {} produce a map. Square brackets [] produce a list.

</details>

Q13

What is the difference between map and object types?

A) They are identical
B) map has uniform value types; object has named attributes of potentially different types
C) object cannot have string values
D) map supports nested structures; object does not

<details><summary>Answer</summary>

B) map has uniform value types; object has named attributes of potentially different types

map(string) = all values are strings. object({ name = string, count = number }) = mixed types per attribute.

</details>

Q14

What does depends_on do?

A) Defines variable dependencies
B) Explicitly declares a dependency that Terraform cannot automatically detect
C) Orders output values
D) Specifies provider order

<details><summary>Answer</summary>

B) Explicitly declares a dependency that Terraform cannot automatically detect

Use sparingly. Terraform usually infers dependencies from resource references.

</details>

Q15

How do you reference the current workspace name in HCL?

A) var.workspace
B) terraform.workspace
C) env.workspace
D) workspace.current

<details><summary>Answer</summary>

B) terraform.workspace

Returns the name of the currently selected workspace (e.g., "default", "dev", "prod").

</details>

Q16

What does lookup(var.amis, "eu-west-1", "ami-default") return if var.amis has no key "eu-west-1"?

A) null
B) An error
C) "ami-default"
D) An empty string

<details><summary>Answer</summary>

C) "ami-default"

The third argument to lookup() is the default value returned when the key is not found.

</details>

Q17

Which variable type allows elements of different types at specific positions?

A) list
B) set
C) tuple
D) map

<details><summary>Answer</summary>

C) tuple

tuple([string, number, bool]) allows mixed types. list requires all elements of the same type.

</details>

Q18

What is variable validation in Terraform?

A) Checking the state file for errors
B) Custom rules on input variables using condition and error_message
C) Validating provider credentials
D) Syntax checking with terraform validate

<details><summary>Answer</summary>

B) Custom rules on input variables using condition and error_message

variable "env" {
  validation {
    condition     = contains(["dev", "prod"], var.env)
    error_message = "Must be dev or prod."
  }
}

</details>

Q19

What is a null_resource (now terraform_data) used for?

A) Creating empty cloud resources
B) A resource with no provider-specific behaviour, often used as a trigger for provisioners
C) Deleting resources
D) Representing an error state

<details><summary>Answer</summary>

B) A resource with no provider-specific behaviour, often used as a trigger for provisioners

It implements the standard lifecycle but has no real infrastructure. Useful for running local-exec provisioners.

</details>

Q20

What does coalesce("", null, "hello", "world") return?

A) ""
B) null
C) "hello"
D) "world"

<details><summary>Answer</summary>

C) "hello"

coalesce() returns the first argument that is not null and not an empty string.

</details>

PART 3 — DOMAIN 7: IMPLEMENT & MAINTAIN STATE (High Weight — NOT STUDIED)

Core Concepts

What Is the State File?

terraform.tfstate is a JSON file that:

Maps real-world resources to your configuration
Tracks metadata (dependencies, provider versions)
Caches attribute values for performance
Contains sensitive data in PLAINTEXT — never commit to Git

State Storage Backends

# S3 Backend (AWS)
terraform {
  backend "s3" {
    bucket         = "my-state-bucket"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"   # REQUIRED for locking
    encrypt        = true
  }
}

# Azure Blob Backend
terraform {
  backend "azurerm" {
    resource_group_name  = "tfstate-rg"
    storage_account_name = "tfstatestorage"
    container_name       = "tfstate"
    key                  = "prod.terraform.tfstate"
  }
}

# HCP Terraform (cloud block — NOT a backend block)
terraform {
  cloud {
    organization = "my-org"
    workspaces { name = "prod" }
  }
}

Exam trap: The cloud block and backend block cannot be used together.

State Locking

Backend	Locking Mechanism
---------	-------------------
S3	DynamoDB table (must be configured separately)
Azure Blob	Native blob leasing
GCS	Native object locking
HCP Terraform	Automatic
Local	No locking

State Commands

Command	Purpose
---------	---------
`terraform state list`	List all resources in state
`terraform state show <address>`	Show attributes of one resource
`terraform state mv <from> <to>`	Rename/move a resource in state
`terraform state rm <address>`	Remove a resource from state (does NOT destroy it)
`terraform state pull`	Download remote state to stdout
`terraform state push`	Upload local state to remote backend
`terraform force-unlock <ID>`	Release a stuck state lock

Migrating State

1. Update the backend block in your config
2. Run terraform init
3. Terraform detects the change and prompts: "Do you want to migrate?"
4. Confirm to copy state to the new backend

`terraform_remote_state` Data Source

data "terraform_remote_state" "network" {
  backend = "s3"
  config = {
    bucket = "network-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

# Access outputs from the remote state
resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.network.outputs.subnet_id
}

Sensitive Data in State

State stores all attribute values including passwords, keys, and secrets in plaintext
Always encrypt state at rest (S3 SSE, Azure encryption, HCP Terraform encrypts by default)
Restrict access with IAM/RBAC policies
NEVER commit terraform.tfstate to Git

Workspaces and State

Each workspace has its own separate state file. This allows:

Running dev and prod from the same config
Complete resource isolation between workspaces
State stored in separate paths (e.g., env:/dev/terraform.tfstate)

Domain 7 — Practice Questions (20 questions)

Q1

Why should you NOT store the Terraform state file in Git?

A) Git does not support JSON files
B) State may contain sensitive data in plaintext and concurrent edits can corrupt it
C) State files are too large for Git
D) There is no reason not to

<details><summary>Answer</summary>

B) State may contain sensitive data in plaintext and concurrent edits can corrupt it

State files can contain passwords, keys, and connection strings in plaintext. Git does not provide locking to prevent concurrent modifications.

</details>

Q2

How do you enable state locking with an S3 backend?

A) Locking is automatic with S3
B) Configure a DynamoDB table alongside S3
C) Use a separate lock file on disk
D) Locking is not supported with S3

<details><summary>Answer</summary>

B) Configure a DynamoDB table alongside S3

Add dynamodb_table = "terraform-locks" to your S3 backend configuration to enable state locking.

</details>

Q3

What command lists all resources in the current Terraform state?

A) terraform resources
B) terraform state list
C) terraform list
D) terraform show resources

<details><summary>Answer</summary>

B) terraform state list

This outputs all resource addresses managed in the current state file.

</details>

Q4

What does terraform state rm aws_instance.web do?

A) Destroys the AWS instance
B) Removes the resource from state WITHOUT destroying the real infrastructure
C) Removes the resource from the configuration file
D) Backs up the state file

<details><summary>Answer</summary>

B) Removes the resource from state WITHOUT destroying the real infrastructure

The instance continues running in AWS, but Terraform no longer tracks or manages it.

</details>

Q5

How do you migrate state from a local backend to S3?

A) Copy terraform.tfstate to S3 manually
B) Update the backend block to S3 and run terraform init — Terraform prompts to migrate
C) Run terraform state push
D) Delete local state and reimport all resources

<details><summary>Answer</summary>

B) Update the backend block to S3 and run terraform init — Terraform prompts to migrate

Terraform detects the backend change during init and offers to copy the existing state to the new backend.

</details>

Q6

What is the terraform_remote_state data source used for?

A) Storing state remotely
B) Reading output values from another Terraform configuration's state
C) Migrating state between backends
D) Encrypting the state file

<details><summary>Answer</summary>

B) Reading output values from another Terraform configuration's state

It enables cross-project resource sharing — e.g., the compute project reads subnet IDs from the networking project's state.

</details>

Q7

What does terraform force-unlock <LOCK_ID> do?

A) Forces terraform apply without approval
B) Manually releases a stuck state lock
C) Unlocks provider plugins
D) Forces a state file migration

<details><summary>Answer</summary>

B) Manually releases a stuck state lock

Use only when a lock was not properly released (e.g., a crashed process). Use with extreme caution.

</details>

Q8

What happens if the state file is lost?

A) Nothing — Terraform recreates it automatically
B) Terraform loses track of managed resources and may try to recreate or fail
C) Resources are automatically destroyed
D) Terraform continues working normally

<details><summary>Answer</summary>

B) Terraform loses track of managed resources and may try to recreate or fail

Without state, Terraform thinks no resources exist and will attempt to create everything from scratch, causing duplicates or conflicts.

</details>

Q9

What is a partial backend configuration?

A) A misconfigured backend
B) Omitting some backend settings from config and supplying them at init time via -backend-config
C) Using half a state file
D) A backend that only supports read operations

<details><summary>Answer</summary>

B) Omitting some backend settings from config and supplying them at init time via -backend-config

This keeps sensitive values (like access keys) out of committed configuration files.

</details>

Q10

How does HCP Terraform handle state?

A) It stores state locally
B) It stores state remotely with automatic encryption, versioning, locking, and access controls
C) It does not use state files
D) It requires manual state management

<details><summary>Answer</summary>

B) It stores state remotely with automatic encryption, versioning, locking, and access controls

HCP Terraform manages all state concerns automatically without requiring external backends.

</details>

Q11

What is the serial number in the state file?

A) A product serial number
B) A monotonically increasing counter for version tracking and conflict detection
C) A random identifier
D) The Terraform CLI version

<details><summary>Answer</summary>

B) A monotonically increasing counter for version tracking and conflict detection

It increments with each state modification, helping backends detect conflicts when two operations try to write simultaneously.

</details>

Q12

Two engineers run terraform apply at the same time. What prevents conflicts?

A) Nothing — both succeed
B) State locking blocks the second operation until the first completes
C) Terraform merges the changes
D) Both operations are queued

<details><summary>Answer</summary>

B) State locking blocks the second operation until the first completes

The first apply acquires the lock. The second apply fails or waits until the lock is released.

</details>

Q13

What is the difference between the cloud block and the backend block?

A) They are identical and interchangeable
B) cloud configures HCP Terraform; backend configures other state storage. They cannot coexist.
C) cloud is deprecated in favour of backend
D) backend works with HCP Terraform

<details><summary>Answer</summary>

B) cloud configures HCP Terraform; backend configures other state storage. They cannot coexist.

Use one or the other, never both.

</details>

Q14

What happens to sensitive values (passwords, API keys) in the state file?

A) They are automatically encrypted
B) They are stored in plaintext
C) They are excluded from state
D) They are hashed

<details><summary>Answer</summary>

B) They are stored in plaintext

This is why state files must be protected with encryption at rest and strict access controls.

</details>

Q15

What does terraform state show aws_instance.web display?

A) The configuration code for the resource
B) All attributes of the resource as stored in the state file
C) The resource in the cloud console
D) The plan for the resource

<details><summary>Answer</summary>

B) All attributes of the resource as stored in the state file

This includes ID, ARN, IP address, and all other attributes tracked in state.

</details>

Q16

What command detects drift between the state and real infrastructure?

A) terraform validate
B) terraform plan -refresh-only
C) terraform state list
D) terraform fmt

<details><summary>Answer</summary>

B) terraform plan -refresh-only

This refreshes the state from real infrastructure and shows any differences (drift) without proposing configuration changes.

</details>

Q17

With workspaces, how is state handled?

A) All workspaces share one state file
B) Each workspace has its own separate state file
C) Only the default workspace has state
D) State is stored in memory

<details><summary>Answer</summary>

B) Each workspace has its own separate state file

This enables managing dev, staging, and prod from the same config with isolated state.

</details>

Q18

What does terraform state mv aws_instance.old aws_instance.new do?

A) Renames the cloud resource
B) Moves the resource in state from one address to another (refactoring)
C) Copies the resource
D) Destroys and recreates the resource

<details><summary>Answer</summary>

B) Moves the resource in state from one address to another (refactoring)

The real infrastructure is unchanged. Only the state mapping is updated.

</details>

Q19

Why is state file versioning (e.g., S3 bucket versioning) important?

A) It is not useful
B) It keeps historical state versions for recovery from corruption or accidental changes
C) It versions the Terraform binary
D) It tracks configuration file versions

<details><summary>Answer</summary>

B) It keeps historical state versions for recovery from corruption or accidental changes

If the current state is corrupted, you can restore a previous version.

</details>

Q20

What does -lock=false do?

A) Enables state locking
B) Disables state locking for that operation (extremely dangerous in team environments)
C) Locks the configuration files
D) Prevents resource deletion

<details><summary>Answer</summary>

B) Disables state locking for that operation (extremely dangerous in team environments)

Only use this as a last resort when a lock is genuinely stuck and force-unlock has failed.

</details>

PART 4 — DOMAIN 6: CORE TERRAFORM WORKFLOW (NOT STUDIED)

The Three Phases

┌──────────┐    ┌──────────┐    ┌──────────┐
│  WRITE   │───▶│   PLAN   │───▶│  APPLY   │
│ (author) │    │ (preview)│    │(execute) │
└──────────┘    └──────────┘    └──────────┘

Command Order

terraform init       # 1. Download providers, modules, configure backend
terraform validate   # 2. Check syntax and config errors (optional but recommended)
terraform plan       # 3. Preview what will change
terraform apply      # 4. Execute the changes

Plan Output Symbols

Symbol	Meaning
--------	---------
`+`	Resource will be created
`~`	Resource will be updated in-place
`-`	Resource will be destroyed
`-/+`	Resource will be destroyed and recreated (replacement)
`<=`	Data source will be read

Key Concepts

terraform apply -auto-approve — Skips confirmation. Only appropriate in CI/CD pipelines where the plan was already reviewed.
terraform plan -out=plan.tfplan — Saves the plan to a file. terraform apply plan.tfplan executes exactly that plan, preventing drift between plan and apply.
terraform destroy — Plans the destruction of all resources, asks for confirmation, then executes.
terraform destroy -target=aws_instance.web — Destroys only a specific resource.
terraform validate — Catches syntax/config errors without needing credentials or state access.
Speculative plan — An HCP Terraform plan triggered by a pull request that cannot be applied (review-only).
Sentinel — Policy-as-code framework that runs after plan but before apply in HCP Terraform.

What Triggers a Re-run of `terraform init`?

Adding/removing/updating providers
Adding/changing module sources
Changing backend configuration
Cloning the project to a new machine

Domain 6 — Practice Questions (15 questions)

Q1

What is the correct command order for new infrastructure?

A) plan → init → apply
B) init → plan → apply
C) apply → init → plan
D) plan → apply → init

<details><summary>Answer</summary>

B) init → plan → apply

Init must always come first to download providers and modules.

</details>

Q2

What does the + symbol mean in terraform plan output?

A) Resource will be destroyed
B) Resource will be created
C) Resource will be modified
D) Resource will be imported

<details><summary>Answer</summary>

B) Resource will be created

</details>

Q3

What does -/+ mean in plan output?

A) Resource will be updated in-place
B) Resource must be destroyed and recreated (replacement)
C) Resource will be imported
D) Resource is unchanged

<details><summary>Answer</summary>

B) Resource must be destroyed and recreated (replacement)

This happens when a change forces a new resource (e.g., changing an EC2 AMI).

</details>

Q4

Why save a plan with -out?

A) To create a backup
B) To ensure the exact reviewed plan is applied, preventing drift between plan and apply
C) To share with other teams
D) To save disk space

<details><summary>Answer</summary>

B) To ensure the exact reviewed plan is applied, preventing drift between plan and apply

Between running plan and apply, infrastructure could change. A saved plan locks in exactly what was reviewed.

</details>

Q5

When is terraform apply -auto-approve appropriate?

A) Always
B) Only in CI/CD pipelines where the plan was already reviewed
C) When you're in a hurry
D) For production deployments

<details><summary>Answer</summary>

B) Only in CI/CD pipelines where the plan was already reviewed

Never skip confirmation for manual runs in production.

</details>

Q6

What does terraform validate check?

A) Cloud credentials
B) Syntax errors and configuration mistakes without needing provider access
C) Resource existence in the cloud
D) State file integrity

<details><summary>Answer</summary>

B) Syntax errors and configuration mistakes without needing provider access

It's a fast, offline check that catches errors early.

</details>

Q7

What does "No changes" mean after terraform plan?

A) An error occurred
B) Current infrastructure matches the desired configuration
C) Terraform is broken
D) The state file is missing

<details><summary>Answer</summary>

B) Current infrastructure matches the desired configuration

No actions are required — everything is already in the desired state.

</details>

Q8

What is a speculative plan in HCP Terraform?

A) A plan that is automatically applied
B) A plan triggered by a pull request that shows changes but cannot be applied
C) A plan that destroys resources
D) A plan that ignores state

<details><summary>Answer</summary>

B) A plan triggered by a pull request that shows changes but cannot be applied

It's for review purposes only, helping teams evaluate proposed changes before merging.

</details>

Q9

What happens if you cancel terraform apply mid-execution?

A) All changes are rolled back
B) Some resources may already be created; Terraform tracks what completed in state
C) Nothing happens
D) The state file is deleted

<details><summary>Answer</summary>

B) Some resources may already be created; Terraform tracks what completed in state

Terraform does not support rollback. Partial applies are recorded in state.

</details>

Q10

What triggers a Terraform run in a VCS-driven HCP Terraform workflow?

A) Manual CLI commands
B) A push or merge to a connected branch
C) Cron jobs
D) Email notifications

<details><summary>Answer</summary>

B) A push or merge to a connected branch

VCS integration automatically triggers plan runs on commits/PRs.

</details>

Q11

Where does Sentinel policy check run in the workflow?

A) Before terraform plan
B) After plan but before apply
C) After apply
D) During init

<details><summary>Answer</summary>

B) After plan but before apply

Sentinel evaluates the planned changes against governance policies before any infrastructure is modified.

</details>

Q12

What does terraform show display?

A) The configuration files
B) A human-readable view of the current state showing all resources and attributes
C) Provider documentation
D) The plan output only

<details><summary>Answer</summary>

B) A human-readable view of the current state showing all resources and attributes

</details>

Q13

How do you destroy only a single resource?

A) terraform destroy (it asks which one)
B) terraform destroy -target=aws_instance.web
C) terraform remove aws_instance.web
D) You cannot destroy individual resources

<details><summary>Answer</summary>

B) terraform destroy -target=aws_instance.web

The -target flag limits the operation to a specific resource.

</details>

Q14

What does terraform apply do when run without a saved plan file?

A) It fails with an error
B) It generates a new plan, displays it, and prompts for confirmation
C) It applies immediately without a plan
D) It only shows the plan

<details><summary>Answer</summary>

B) It generates a new plan, displays it, and prompts for confirmation

Running apply without a saved plan is equivalent to running plan + prompting + executing.

</details>

Q15

When should you re-run terraform init?

A) Only once, ever
B) After adding/changing providers, modules, or backend configuration
C) Before every terraform plan
D) After every terraform apply

<details><summary>Answer</summary>

B) After adding/changing providers, modules, or backend configuration

Also when cloning a project to a new machine or after upgrading Terraform versions.

</details>

PART 5 — DOMAIN 9: HCP TERRAFORM CAPABILITIES (NOT STUDIED)

Key Concepts

What Is HCP Terraform?

A managed service (SaaS) by HashiCorp providing:

Remote state management (encrypted, versioned, locked)
Remote plan/apply execution
VCS integration (GitHub, GitLab, Bitbucket, Azure DevOps)
Team collaboration with RBAC
Policy enforcement (Sentinel, OPA)
Cost estimation
Private module registry
Drift detection

Execution Modes

Mode	Where Plan/Apply Runs	State Location
------	----------------------	----------------
Remote (default)	HCP Terraform infrastructure	HCP Terraform
Local	Your machine	HCP Terraform
Agent	Self-hosted agent	HCP Terraform

Workspaces in HCP Terraform

An HCP Terraform workspace contains:

Configuration code (from VCS or uploaded)
State file
Variables (Terraform and environment)
Run history
Access controls (team permissions)

Workspace Variables

Terraform variables — Injected as var.name into runs
Environment variables — Set as TF_VAR_name or other env vars (e.g., AWS_ACCESS_KEY_ID)
Variables can be marked sensitive (encrypted, write-only, masked in logs)

Variable Sets

Reusable groups of variables applied to multiple workspaces (e.g., shared cloud credentials).

Sentinel Policy Enforcement Levels

Level	Behaviour
-------	-----------
Advisory	Warns but does not block
Soft-mandatory	Blocks by default but can be overridden by authorised users
Hard-mandatory	Cannot be overridden — always blocks

Workflow Types

Workflow	Trigger	Use Case
----------	---------	----------
VCS-driven	Push/merge to connected branch	Standard team workflow
CLI-driven	`terraform plan`/`apply` from local CLI (execution on HCP)	Developers who prefer CLI
API-driven	REST API calls	CI/CD integration, automation

Other Features

Run triggers — Changes in workspace A trigger a run in workspace B
Cost estimation — Estimates monthly cost impact of planned changes
Drift detection — Periodic health checks for infrastructure drift
No-code provisioning — Non-technical users deploy from pre-built module templates via UI
Notifications — Slack, Teams, email, webhooks for run status
terraform login — Browser-based auth that stores an API token for CLI access

HCP Terraform vs Terraform Enterprise

Feature	HCP Terraform	Terraform Enterprise
---------	---------------	---------------------
Hosting	SaaS (HashiCorp)	Self-hosted
Free tier	Yes (500 resources)	No
Air-gapped	No	Yes
SAML SSO	Paid plans	Yes
Audit logging	Paid plans	Yes

Domain 9 — Practice Questions (15 questions)

Q1

What execution modes does HCP Terraform support?

A) Only remote execution
B) Remote, local, and agent execution
C) Only local execution
D) Only agent execution

<details><summary>Answer</summary>

B) Remote, local, and agent execution

Remote runs on HCP infrastructure; local runs on your machine with remote state; agent runs on self-hosted agents.

</details>

Q2

What is Sentinel?

A) A security scanner
B) A policy-as-code framework that enforces governance rules on Terraform runs
C) A monitoring tool
D) A state management tool

<details><summary>Answer</summary>

B) A policy-as-code framework that enforces governance rules on Terraform runs

Sentinel checks run after plan, before apply, in HCP Terraform and Terraform Enterprise.

</details>

Q3

What are the three Sentinel enforcement levels?

A) Low, medium, high
B) Advisory, soft-mandatory, hard-mandatory
C) Warning, error, fatal
D) Optional, required, critical

<details><summary>Answer</summary>

B) Advisory, soft-mandatory, hard-mandatory

Advisory = warn. Soft-mandatory = block but overridable. Hard-mandatory = always blocks.

</details>

Q4

How does HCP Terraform handle state locking?

A) It requires DynamoDB
B) Automatically — no external locking mechanism needed
C) It does not support locking
D) Manual locking via the UI

<details><summary>Answer</summary>

B) Automatically — no external locking mechanism needed

HCP Terraform manages state locking internally during every run.

</details>

Q5

How do you authenticate the Terraform CLI with HCP Terraform?

A) Username and password
B) terraform login — generates and stores an API token
C) SSH keys
D) Certificate-based auth

<details><summary>Answer</summary>

B) terraform login — generates and stores an API token

It opens a browser for authentication and saves the resulting token locally.

</details>

Q6

What is a run trigger?

A) A button to start a run
B) A connection where changes in one workspace trigger a run in another
C) A scheduled run
D) A webhook

<details><summary>Answer</summary>

B) A connection where changes in one workspace trigger a run in another

Enables dependency chains: networking workspace changes → compute workspace auto-runs.

</details>

Q7

What is the CLI-driven workflow?

A) Running Terraform entirely locally
B) Using local CLI commands while execution happens remotely on HCP Terraform
C) A deprecated workflow
D) Only available in Enterprise

<details><summary>Answer</summary>

B) Using local CLI commands while execution happens remotely on HCP Terraform

You type terraform plan locally, but the actual execution runs on HCP Terraform's infrastructure.

</details>

Q8

How does HCP Terraform handle sensitive variables?

A) Stored in plaintext
B) Encrypted at rest, write-only, masked in logs and UI
C) Must be stored in Git
D) Not supported

<details><summary>Answer</summary>

B) Encrypted at rest, write-only, masked in logs and UI

Once a sensitive variable is written, it can never be read back — only overwritten or deleted.

</details>

Q9

What are variable sets?

A) Variable type definitions
B) Reusable groups of variables that can be applied to multiple workspaces
C) Sets of Terraform functions
D) State file groups

<details><summary>Answer</summary>

B) Reusable groups of variables that can be applied to multiple workspaces

Ideal for shared credentials or common tags across workspaces.

</details>

Q10

What is no-code provisioning?

A) Writing Terraform automatically
B) Allowing non-technical users to deploy from pre-built module templates via a UI
C) Running infrastructure without code
D) Deprecated feature

<details><summary>Answer</summary>

B) Allowing non-technical users to deploy from pre-built module templates via a UI

Users select a module, fill in parameters, and deploy — no HCL knowledge required.

</details>

Q11

What is the free tier of HCP Terraform?

A) There is no free tier
B) Up to 500 managed resources with remote state, VCS integration, and basic features
C) Only CLI access
D) Unlimited resources for 30 days

<details><summary>Answer</summary>

B) Up to 500 managed resources with remote state, VCS integration, and basic features

</details>

Q12

How does cost estimation work in HCP Terraform?

A) It requires a separate tool
B) It estimates monthly cost changes for resources in the plan before apply
C) It only works with AWS
D) It is not available

<details><summary>Answer</summary>

B) It estimates monthly cost changes for resources in the plan before apply

Cost estimates are shown alongside the plan output before you approve.

</details>

Q13

What is the difference between HCP Terraform and Terraform Enterprise?

A) They are identical
B) HCP Terraform is SaaS; Enterprise is self-hosted with additional features like air-gapped support
C) Enterprise is free
D) HCP Terraform has more features

<details><summary>Answer</summary>

B) HCP Terraform is SaaS; Enterprise is self-hosted with additional features like air-gapped support

Enterprise adds SAML SSO, audit logging, and air-gapped installation options.

</details>

Q14

What is a 'configuration version' in HCP Terraform?

A) The Terraform CLI version
B) A snapshot of configuration code uploaded for a specific run
C) The module version
D) The provider version

<details><summary>Answer</summary>

B) A snapshot of configuration code uploaded for a specific run

Each run is associated with a specific configuration version, creating an audit trail.

</details>

Q15

What does HCP Terraform drift detection do?

A) Monitors network latency
B) Periodically checks for differences between state and actual infrastructure
C) Detects configuration file changes
D) Monitors provider updates

<details><summary>Answer</summary>

B) Periodically checks for differences between state and actual infrastructure

Health assessments run automatically and alert you when infrastructure has drifted from the Terraform state.

</details>

PART 6 — DOMAIN 3: TARGETED FIXES (8 wrong answers)

Your mistakes in Domain 3 fell into clear patterns. Here are the exact concepts you got wrong:

Fix 1: Resource Block Definition

A resource block defines a single infrastructure object to be managed.

resource "aws_instance" "web" {    # "aws_instance" = type, "web" = local name
  ami           = "ami-abc123"
  instance_type = "t3.micro"
}

Syntax: resource "<TYPE>" "<NAME>" { ... }

It is NOT a provider configuration, NOT a variable declaration, NOT a comment.

Fix 2: `required_providers` Block

Specifies which providers are needed and their version constraints:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = ">= 3.0, < 4.0"
    }
  }
}

It is NOT for configuring state backends, NOT for declaring outputs, NOT for defining resources.

Fix 3: Resource Syntax

# CORRECT
resource "aws_instance" "web" { ... }

# WRONG: resource = aws_instance.web {}
# WRONG: create aws_instance web { ... }
# WRONG: new resource aws_instance.web { ... }

Always: resource "TYPE" "NAME" { ... } with quotes and curly braces.

Fix 4: `terraform init` in an Empty Directory

Running terraform init in a directory with no .tf files succeeds with no providers to install. It does NOT crash and does NOT create sample files.

Fix 5: Map Variables

# CORRECT — must specify element type
variable "tags" {
  type    = map(string)
  default = { Name = "web", Env = "prod" }
}

# WRONG: type = map (without element type — technically valid but less precise)
# WRONG: type = dictionary

Access values: var.tags["Name"] or var.tags.Name

Fix 6: Resource References

# Direct reference (outside a string):
aws_instance.web.id

# Inside a string (interpolation):
"The ID is ${aws_instance.web.id}"

# BOTH are valid depending on context
# WRONG: resource.aws_instance.web.id (no "resource." prefix needed)

Fix 7: Local Values

locals {
  common_tags = {
    Project = "terraform-exam"
    Owner   = "team-a"
  }
  full_name = "${var.prefix}-${var.name}"
}

# Reference with local. prefix:
resource "aws_instance" "web" {
  tags = local.common_tags
}

A local value is a named expression within a module to avoid repetition. It is NOT an environment variable, NOT a cloud resource.

Fix 8: Removing Resources from Configuration

If you remove a resource block from your .tf files but the resource exists in state, Terraform plans to destroy it on the next apply.

Want to stop managing without destroying? → Use terraform state rm first
Want to destroy? → Just remove the block and apply

Domain 3 — Quick-Fire Drill (10 questions)

Q1

What is the correct syntax for a resource block?

A) resource = aws_instance.web {}
B) resource "aws_instance" "web" { ... }
C) create aws_instance web { ... }
D) new resource aws_instance.web { ... }

<details><summary>Answer</summary>

B) resource "aws_instance" "web" { ... }

</details>

Q2

What does the required_providers block specify?

A) Output variables
B) State backend configuration
C) Which providers are required and their version constraints
D) Resource definitions

<details><summary>Answer</summary>

C) Which providers are required and their version constraints

</details>

Q3

What happens when you run terraform init in a directory with no .tf files?

A) It crashes
B) It succeeds with no providers to install
C) It creates sample configuration
D) It downloads all available providers

<details><summary>Answer</summary>

B) It succeeds with no providers to install

</details>

Q4

How do you correctly declare a map variable?

A) type = dictionary
B) type = map(string) with values like { Name = "web" }
C) type = map (no element type)
D) type = hashmap

<details><summary>Answer</summary>

B) type = map(string) with values like { Name = "web" }

</details>

Q5

What is a local value?

A) An environment variable
B) A cloud resource
C) A named expression within a module to avoid repetition
D) A variable set from the CLI

<details><summary>Answer</summary>

C) A named expression within a module to avoid repetition

</details>

Q6

You remove resource "aws_instance" "web" from your config. It still exists in state. What happens on next terraform plan?

A) Nothing
B) Terraform plans to destroy it
C) Terraform creates a new one
D) Terraform moves it to a backup

<details><summary>Answer</summary>

B) Terraform plans to destroy it

</details>

Q7

Which reference is WRONG?

A) aws_instance.web.id
B) "${aws_instance.web.id}"
C) resource.aws_instance.web.id
D) Both A and B are valid

<details><summary>Answer</summary>

C) resource.aws_instance.web.id

There is no resource. prefix. Use aws_instance.web.id directly.

</details>

Q8

What is a resource block?

A) A provider configuration
B) A block that defines a single infrastructure object to be managed by Terraform
C) A variable declaration
D) A code comment

<details><summary>Answer</summary>

B) A block that defines a single infrastructure object to be managed by Terraform

</details>

Q9

How do you access the value of a local named full_name?

A) var.full_name
B) local.full_name
C) locals.full_name
D) output.full_name

<details><summary>Answer</summary>

B) local.full_name

Use local. (singular) to reference, even though you define in a locals (plural) block.

</details>

Q10

What does required_providers go inside?

A) The provider block
B) The terraform block
C) The resource block
D) A separate file called providers.tf

<details><summary>Answer</summary>

B) The terraform block

terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

</details>

PART 7 — FULL MOCK EXAM (57 Questions — All 9 Domains)

Instructions: Simulate exam conditions. Set a 60-minute timer. Score yourself honestly. You need 70%+ (40/57) to pass.

Mock Q1 — Domain 1

What does 'idempotency' mean in IaC?

A) Each run creates duplicate resources
B) Applying the same configuration multiple times produces the same result
C) Infrastructure changes randomly
D) Code can only run once

<details><summary>Answer</summary>B</details>

Mock Q2 — Domain 1

A developer makes a manual change to a Terraform-managed resource. What happens on next terraform plan?

A) Terraform ignores it
B) Terraform detects the drift and proposes changes to bring it back to the defined state
C) Terraform crashes
D) The manual change is saved to config

<details><summary>Answer</summary>B — Terraform refreshes real state and compares to config, detecting the drift.</details>

Mock Q3 — Domain 2

How does Terraform determine resource creation order?

A) Alphabetical
B) By building a dependency graph
C) Random
D) Manual ordering

<details><summary>Answer</summary>B</details>

Mock Q4 — Domain 2

What is the Terraform Registry?

A) A Docker registry
B) A public repository of providers, modules, and policies
C) A Python package manager
D) A version control system

<details><summary>Answer</summary>B</details>

Mock Q5 — Domain 3

Which block specifies required providers and version constraints?

A) provider block
B) resource block
C) required_providers inside the terraform block
D) variables block

<details><summary>Answer</summary>C</details>

Mock Q6 — Domain 3

terraform init creates a sample main.tf. True or False?

A) True
B) False

<details><summary>Answer</summary>B — terraform init only initialises. You must create config files yourself.</details>

Mock Q7 — Domain 3

How do you reference a local value named env_prefix?

A) var.env_prefix
B) local.env_prefix
C) locals.env_prefix
D) data.env_prefix

<details><summary>Answer</summary>B</details>

Mock Q8 — Domain 4

What command lists all Terraform workspaces?

A) terraform workspaces
B) terraform workspace list
C) terraform list workspaces
D) terraform workspace show

<details><summary>Answer</summary>B — Note: terraform workspace show shows the *current* workspace.</details>

Mock Q9 — Domain 4

What does terraform workspace select dev do?

A) Creates the dev workspace
B) Switches to the dev workspace
C) Deletes the dev workspace
D) Shows the dev workspace state

<details><summary>Answer</summary>B</details>

Mock Q10 — Domain 5

What is the root module?

A) The first module in the registry
B) A module with zero resources
C) The working directory where Terraform commands run
D) The module with the most resources

<details><summary>Answer</summary>C</details>

Mock Q11 — Domain 5

You add a new module source. What must you run?

A) terraform validate
B) terraform init
C) terraform refresh
D) Nothing

<details><summary>Answer</summary>B</details>

Mock Q12 — Domain 5

How do you pass a value to a child module's input variable?

A) Export TF_VAR_ environment variable
B) Set it as an argument in the module block
C) Variables are inherited automatically
D) Use terraform.tfvars in the module directory

<details><summary>Answer</summary>B</details>

Mock Q13 — Domain 5

How do you pin a registry module to version 2.1.0?

A) ?ref=v2.1.0
B) version = "2.1.0" in the module block
C) You cannot version registry modules
D) Append @2.1.0 to the source

<details><summary>Answer</summary>B</details>

Mock Q14 — Domain 6

What does the ~ symbol mean in plan output?

A) Created
B) Updated in-place
C) Destroyed
D) Replaced

<details><summary>Answer</summary>B</details>

Mock Q15 — Domain 6

When should you re-run terraform init?

A) Only once ever
B) After changing providers, modules, or backend
C) Before every plan
D) After every apply

<details><summary>Answer</summary>B</details>

Mock Q16 — Domain 6

What does terraform validate do?

A) Checks cloud credentials
B) Catches syntax/config errors without needing credentials
C) Deploys resources
D) Updates state

<details><summary>Answer</summary>B</details>

Mock Q17 — Domain 6

What is a speculative plan?

A) A plan that auto-applies
B) A PR-triggered plan in HCP Terraform that cannot be applied
C) A plan that destroys resources
D) A plan that ignores state

<details><summary>Answer</summary>B</details>

Mock Q18 — Domain 7

Why must you protect the state file?

A) It is too large
B) It contains sensitive data in plaintext
C) Git doesn't support JSON
D) It is immutable

<details><summary>Answer</summary>B</details>

Mock Q19 — Domain 7

How do you migrate from local state to S3?

A) Manually copy the file
B) Update backend block and run terraform init
C) Run terraform state push
D) Delete local state and reimport

<details><summary>Answer</summary>B</details>

Mock Q20 — Domain 7

What does terraform state rm do?

A) Destroys the resource
B) Removes resource from state without destroying the real infrastructure
C) Removes from config
D) Backs up state

<details><summary>Answer</summary>B</details>

Mock Q21 — Domain 7

How does S3 backend implement state locking?

A) File locks
B) DynamoDB table
C) S3 versioning
D) Not supported

<details><summary>Answer</summary>B</details>

Mock Q22 — Domain 7

Can the cloud and backend blocks coexist?

A) Yes
B) No
C) Only in Enterprise
D) Only with remote execution

<details><summary>Answer</summary>B</details>

Mock Q23 — Domain 8

What is the variable precedence order? (lowest → highest)

A) CLI → tfvars → env → default
B) Default → env → terraform.tfvars → *.auto.tfvars → -var-file → -var
C) All equal
D) tfvars always wins

<details><summary>Answer</summary>B</details>

Mock Q24 — Domain 8

Which type allows mixed types per position?

A) list
B) map
C) tuple
D) set

<details><summary>Answer</summary>C</details>

Mock Q25 — Domain 8

What does for_each iterate over?

A) Numbers only
B) A map or set
C) A list of numbers
D) A string

<details><summary>Answer</summary>B</details>

Mock Q26 — Domain 8

What does can(regex("^ami-", var.id)) return?

A) The regex match
B) true if the regex matches, false if it errors
C) The variable value
D) An error

<details><summary>Answer</summary>B</details>

Mock Q27 — Domain 8

How do you reference the current workspace in config?

A) var.workspace
B) terraform.workspace
C) env.workspace
D) workspace.name

<details><summary>Answer</summary>B</details>

Mock Q28 — Domain 8

What does a moved block do?

A) Moves cloud resources
B) Declares a rename so Terraform migrates state automatically
C) Moves files on disk
D) Moves providers

<details><summary>Answer</summary>B</details>

Mock Q29 — Domain 8

Splat expression aws_instance.web[*].id returns what?

A) First instance's ID
B) A list of all instance IDs
C) A map
D) An error

<details><summary>Answer</summary>B</details>

Mock Q30 — Domain 8

What does depends_on do?

A) Defines variable dependencies
B) Explicitly declares a dependency Terraform can't auto-detect
C) Orders output values
D) Specifies provider order

<details><summary>Answer</summary>B</details>

Mock Q31 — Domain 9

What execution modes does HCP Terraform support?

A) Only remote
B) Remote, local, and agent
C) Only local
D) Only agent

<details><summary>Answer</summary>B</details>

Mock Q32 — Domain 9

What are the Sentinel enforcement levels?

A) Low, medium, high
B) Advisory, soft-mandatory, hard-mandatory
C) Warning, error, fatal
D) 1, 2, 3

<details><summary>Answer</summary>B</details>

Mock Q33 — Domain 9

How do you authenticate CLI with HCP Terraform?

A) Username/password
B) terraform login
C) SSH keys
D) Certificates

<details><summary>Answer</summary>B</details>

Mock Q34 — Domain 9

What are variable sets in HCP Terraform?

A) Variable type definitions
B) Reusable variable groups applied to multiple workspaces
C) Function sets
D) State file groups

<details><summary>Answer</summary>B</details>

Mock Q35 — Domain 9

What is drift detection in HCP Terraform?

A) Network monitoring
B) Periodic checks for differences between state and actual infrastructure
C) Config file monitoring
D) Provider update checks

<details><summary>Answer</summary>B</details>

Mock Q36 — Domain 1

IaC eliminates ALL infrastructure errors. True or False?

A) True
B) False

<details><summary>Answer</summary>B — IaC reduces errors significantly but cannot eliminate bugs, logic errors, or misconfigurations in code.</details>

Mock Q37 — Domain 2

Terraform is written in Go. Do you need Go installed to run it?

A) Yes
B) No

<details><summary>Answer</summary>B — Terraform is distributed as a compiled binary. No Go runtime needed.</details>

Mock Q38 — Domain 3

What does Terraform do with resources in state but removed from config?

A) Ignores them
B) Plans to destroy them
C) Creates new ones
D) Moves to backup state

<details><summary>Answer</summary>B</details>

Mock Q39 — Domain 5

Where are downloaded modules stored locally?

A) terraform.tfstate
B) .terraform/modules/
C) Root project directory
D) /usr/local/terraform/

<details><summary>Answer</summary>B</details>

Mock Q40 — Domain 6

What happens if you cancel terraform apply mid-execution?

A) Everything rolls back
B) Partial changes may exist; Terraform records what completed in state
C) Nothing happens
D) State file is deleted

<details><summary>Answer</summary>B</details>

Mock Q41 — Domain 7

What does terraform_remote_state do?

A) Stores state remotely
B) Reads outputs from another configuration's state
C) Migrates state
D) Encrypts state

<details><summary>Answer</summary>B</details>

Mock Q42 — Domain 8

join(", ", ["a", "b", "c"]) returns what?

A) ["a", "b", "c"]
B) "a, b, c"
C) "abc"
D) An error

<details><summary>Answer</summary>B</details>

Mock Q43 — Domain 8

Which for expression produces a list?

A) {for s in var.list : s => upper(s)}
B) [for s in var.list : upper(s)]
C) (for s in var.list : upper(s))
D) <for s in var.list : upper(s)>

<details><summary>Answer</summary>B — Square brackets produce a list. Curly braces produce a map.</details>

Mock Q44 — Domain 9

What is no-code provisioning in HCP Terraform?

A) Writing Terraform code automatically
B) Non-technical users deploying from pre-built templates via a UI
C) Running infra without code
D) Deprecated

<details><summary>Answer</summary>B</details>

Mock Q45 — Domain 2

What is the Terraform execution plan?

A) A billing estimate
B) A preview of changes generated by terraform plan
C) A deployment schedule
D) A list of installed providers

<details><summary>Answer</summary>B</details>

Mock Q46 — Domain 3

What is the correct way to declare a map variable with string values?

A) type = map
B) type = map(string)
C) type = dictionary(string)
D) type = hash(string)

<details><summary>Answer</summary>B</details>

Mock Q47 — Domain 5

What does terraform get do?

A) Gets remote state
B) Downloads and updates modules only
C) Gets provider docs
D) Gets output values

<details><summary>Answer</summary>B</details>

Mock Q48 — Domain 7

Each workspace has its own separate state file. True or False?

A) True
B) False

<details><summary>Answer</summary>A</details>

Mock Q49 — Domain 8

What is the TF_VAR_ prefix used for?

A) Setting Terraform CLI flags
B) Setting Terraform input variables via environment variables
C) Configuring providers
D) Setting backend options

<details><summary>Answer</summary>B</details>

Mock Q50 — Domain 6

What does terraform destroy -target=aws_instance.web do?

A) Destroys all resources
B) Destroys only the specified resource
C) Removes it from state only
D) Plans but doesn't destroy

<details><summary>Answer</summary>B</details>

Mock Q51 — Domain 7

What is a partial backend configuration?

A) A broken backend
B) Omitting some backend settings and supplying them via -backend-config at init
C) Half a state file
D) Read-only backend

<details><summary>Answer</summary>B</details>

Mock Q52 — Domain 9

Run triggers connect workspaces so changes in one trigger runs in another. True or False?

A) True
B) False

<details><summary>Answer</summary>A</details>

Mock Q53 — Domain 1

Which approach defines the desired end state and lets the tool figure out how?

A) Imperative
B) Declarative
C) Procedural
D) Sequential

<details><summary>Answer</summary>B</details>

Mock Q54 — Domain 8

What does a dynamic block generate?

A) Resources at runtime
B) Repeated nested blocks from a collection
C) Providers dynamically
D) Shell commands

<details><summary>Answer</summary>B</details>

Mock Q55 — Domain 5

How do you access a child module's output named vpc_id?

A) output.vpc_id
B) module.<name>.vpc_id
C) var.vpc_id
D) data.<name>.vpc_id

<details><summary>Answer</summary>B</details>

Mock Q56 — Domain 7

Sensitive values in the state file are stored how?

A) Encrypted
B) In plaintext
C) Excluded from state
D) Hashed

<details><summary>Answer</summary>B</details>

Mock Q57 — Domain 9

HCP Terraform Free tier supports up to how many managed resources?

A) 100
B) 500
C) 1000
D) Unlimited

<details><summary>Answer</summary>B</details>

STUDY PLAN — 7-DAY SPRINT TO EXAM DAY

Revised based on your two official exam attempts (Feb & Apr 2026)

Your biggest threat is Section 8 (HCP Terraform) — it regressed to "Intense Study". Sections 1 and 4 are stuck at "Review Needed". Everything else meets expectations.

Day	Focus	Actions	Target
-----	-------	---------	--------
1	Section 8 — HCP Terraform (Part 5 + Part 8)	Study ALL HCP Terraform material. Complete 40 practice questions. This is your #1 failure point.	90%+
2	Section 4 — Terraform Config (Part 2)	Variables, precedence, count/for_each, dynamic blocks, functions, moved blocks. Complete 20 practice questions.	90%+
3	Section 1 — IaC Concepts (Part 9)	Deep-dive on IaC nuances: idempotency, drift, declarative vs imperative, shift-left, Terraform vs alternatives. Complete 20 practice questions.	90%+
4	Section 5 — Modules (Part 1) + Section 4 Config (Part 6 fixes)	Reinforce modules (practice quiz was 79.6%) + syntax fixes. Complete 30 practice questions.	90%+
5	Sections 6, 7 — State & Workflow (Parts 3 & 4)	Maintenance review — you meet expectations but stay sharp. Complete 35 practice questions.	90%+
6	Full Mock Exam (Part 7)	57 questions under timed conditions (60 min). Review every wrong answer in detail.	85%+
7	Targeted re-drill	Re-do ONLY the questions you got wrong on Days 1–6. Focus on HCP Terraform and Config traps.	95%+

Rules:

1. For every wrong answer, re-read the explanation and write it out in your own words
2. Do NOT move on until you score 90%+ on a section
3. On exam day: read every option carefully — the longest answer is not always correct
4. Spend 40% of your time on HCP Terraform — this is where you are losing the most marks

PART 8 — SECTION 8 DEEP-DIVE: HCP TERRAFORM (INTENSE STUDY — YOUR WORST SECTION)

This section REGRESSED between your two exam attempts. You need to rebuild your understanding from the ground up.

What Is HCP Terraform?

HCP Terraform (formerly Terraform Cloud) is a managed SaaS platform by HashiCorp for:

Remote state management (encrypted, versioned, locked automatically)
Remote plan & apply execution
VCS integration (GitHub, GitLab, Bitbucket, Azure DevOps)
Team collaboration with granular RBAC
Policy enforcement (Sentinel, OPA)
Cost estimation
Private module & provider registries
Drift detection
No-code provisioning

Exam trap: HCP Terraform and Terraform Cloud are the same product — HashiCorp rebranded. The exam uses "HCP Terraform".

Execution Modes — KNOW THESE COLD

Mode	Where Plan/Apply Runs	State Location	When to Use
------	----------------------	----------------	-------------
Remote (default)	HCP Terraform workers	HCP Terraform	Standard team workflow
Local	Your machine	HCP Terraform	Need local tools or want quick iteration
Agent	Self-hosted agent in your network	HCP Terraform	Private network resources behind firewall

# Remote execution (default — no extra config needed)
terraform {
  cloud {
    organization = "my-org"
    workspaces { name = "prod" }
  }
}

Agent Execution — When and Why

Agents are needed when HCP Terraform cannot reach your infrastructure directly (e.g., resources inside a private VPC, on-prem data centres). You install an agent pool in your network; HCP Terraform sends work to the agent.

Workspaces in HCP Terraform

An HCP Terraform workspace is NOT the same as CLI workspaces (terraform workspace).

Feature	CLI Workspace	HCP Terraform Workspace
---------	--------------	------------------------
State	Same backend, different state paths	Dedicated state per workspace
Variables	Shared	Per-workspace with variable sets
Permissions	None	Full RBAC
VCS link	None	Connected to a repo/branch
Run history	None	Full audit trail
Execution	Local only	Remote, local, or agent

Workspace Settings

Terraform version — pinned per workspace
Auto-apply — skip confirmation for successful plans (risky for prod)
Working directory — subdirectory within VCS repo
Trigger patterns — only trigger runs when specific files change
Execution mode — remote, local, or agent

Variable Management

Workspace Variables

Terraform variables — injected as var.name
Environment variables — set as OS env vars (e.g., AWS_ACCESS_KEY_ID, TF_VAR_region)
Can be marked sensitive (encrypted, write-only, never displayed again)
Can be overridden per run via CLI or API

Variable Sets

Reusable groups of variables applied to multiple workspaces:

Ideal for: shared cloud credentials, common tags, organisation-wide settings
Can be scoped to all workspaces or specific workspaces
Variables in a set can be overridden by workspace-level variables

Exam trap: Workspace variables take precedence over variable set variables.

Three Workflow Types — MUST MEMORISE

1. VCS-Driven Workflow (most common)

Connect a workspace to a VCS repo (GitHub, GitLab, etc.)
Push to branch → automatic plan
Merge PR → automatic plan + apply (if auto-apply enabled)
Pull requests get speculative plans (preview only, cannot apply)
Best for: teams using GitOps

2. CLI-Driven Workflow

Run terraform plan / apply from your local terminal
Execution happens remotely on HCP Terraform
Output streams back to your terminal
Must run terraform login first
Best for: individual developers, migration from OSS

3. API-Driven Workflow

Trigger runs via the HCP Terraform REST API
Best for: custom CI/CD pipelines, automation tools
Can upload configuration, trigger runs, check status programmatically

Sentinel Policy-as-Code — CRITICAL TOPIC

Sentinel evaluates planned changes against governance rules after plan, before apply.

Enforcement Levels

Level	Behaviour	Override?
-------	-----------	-----------
Advisory	Logs a warning, run continues	N/A — never blocks
Soft-mandatory	Blocks the run by default	Yes — authorised users can override
Hard-mandatory	Blocks the run unconditionally	No — cannot be overridden

What Sentinel Can Check

Resource types and attributes (e.g., "all instances must have tags")
Cost estimates (e.g., "monthly cost must not exceed $1000")
Time-based rules (e.g., "no deploys on weekends")
Provider restrictions

# Example Sentinel policy (conceptual)
import "tfplan/v2" as tfplan

main = rule {
  all tfplan.resource_changes as _, rc {
    rc.change.after.tags is not null
  }
}

OPA (Open Policy Agent)

HCP Terraform also supports OPA as an alternative to Sentinel. OPA uses Rego language. Both evaluate during the same phase (after plan, before apply).

Run Lifecycle in HCP Terraform

Pending → Fetching → Planning → Cost Estimating → Policy Check → Apply → Applied
                                                         ↓
                                                    (Sentinel/OPA)

Key stages:

1. Pending — queued
2. Planning — terraform plan executes
3. Cost estimating — estimates monthly cost delta
4. Policy check — Sentinel/OPA evaluates
5. Confirm & Apply — manual approval (unless auto-apply)
6. Applied — done

Speculative Plans

Triggered by pull requests in VCS-driven workflows
Cannot be applied — review only
Show the plan output as a PR comment/check
Help teams review infrastructure changes alongside code

Remote State in HCP Terraform

Encrypted at rest and in transit (AES-256)
Versioned — every state change saved, rollback possible
Locked automatically during runs
Access controlled via workspace permissions
No need to configure S3/DynamoDB/etc.

# In the consuming workspace
data "terraform_remote_state" "network" {
  backend = "remote"
  config = {
    organization = "my-org"
    workspaces = { name = "networking" }
  }
}

resource "aws_instance" "web" {
  subnet_id = data.terraform_remote_state.network.outputs.subnet_id
}

The source workspace must have the consuming workspace's permissions to read state.

Private Registry

Host private modules and providers within your organisation
Modules use standard naming: <NAMESPACE>/<NAME>/<PROVIDER>
Source format: app.terraform.io/<ORG>/<MODULE>/<PROVIDER>
Version pinning with version = "x.y.z"
Can publish from VCS repos

module "vpc" {
  source  = "app.terraform.io/my-org/vpc/aws"
  version = "2.0.0"
}

Authentication

terraform login — Opens browser, authenticates, stores API token in ~/.terraform.d/credentials.tfrc.json
Team tokens — for CI/CD pipelines
User tokens — per-individual
Organisation tokens — limited to specific API endpoints

Run Triggers

Workspace dependencies: changes in workspace A automatically trigger a run in workspace B.

Example: Networking workspace changes → Compute workspace automatically re-plans.

Cost Estimation

Shows estimated monthly cost of changes
Appears between plan and policy check
Supports AWS, Azure, GCP (partial)
Cost data feeds into Sentinel policies for budget enforcement

Drift Detection

Health assessments run periodically (configurable)
Compares actual infrastructure to state
Alerts when drift is detected
Can be configured to auto-queue a plan on drift

No-Code Provisioning

Non-technical users deploy infrastructure from pre-built module templates via the HCP Terraform UI
No HCL knowledge required
Admins publish "no-code ready" modules to the registry
Users select a module, fill in parameters, and deploy

HCP Terraform vs Terraform Enterprise

Feature	HCP Terraform	Terraform Enterprise
---------	---------------	---------------------
Hosting	SaaS (HashiCorp-managed)	Self-hosted (your infrastructure)
Free tier	Yes (up to 500 resources)	No
Air-gapped installation	No (requires internet)	Yes
SAML SSO	Paid plans only	Yes
Audit logging	Paid plans only	Yes
Sentinel	Paid plans only	Yes
Cost estimation	Yes	Yes
Agents	Yes	Yes
Private install	No	Yes

Exam trap: "Terraform Enterprise" = self-hosted. "HCP Terraform" = SaaS. The feature sets are similar, but Enterprise supports air-gapped environments.

`cloud` Block vs `backend` Block

# cloud block — HCP Terraform
terraform {
  cloud {
    organization = "my-org"
    workspaces { name = "prod" }
  }
}

# backend block — other backends (S3, azurerm, gcs, etc.)
terraform {
  backend "s3" {
    bucket = "my-state"
    key    = "prod/terraform.tfstate"
    region = "us-east-1"
  }
}

They CANNOT coexist. Use one or the other.

Section 8 — Intensive Practice Questions (25 questions)

Q1

What happens when a pull request is opened against an HCP Terraform VCS-connected workspace?

A) The infrastructure is automatically applied
B) A speculative plan runs and the results are shown on the PR
C) The workspace is locked
D) Nothing happens until the PR is merged

<details><summary>Answer</summary>

B) A speculative plan runs and the results are shown on the PR

Speculative plans are preview-only and cannot be applied directly. They help teams review changes before merging.

</details>

Q2

An HCP Terraform workspace has region = "us-east-1" set. A variable set applied to the same workspace has region = "eu-west-1". Which value is used?

A) eu-west-1 (variable set wins)
B) us-east-1 (workspace variable wins)
C) An error occurs
D) The last one created wins

<details><summary>Answer</summary>

B) us-east-1 (workspace variable wins)

Workspace-level variables always take precedence over variable set variables.

</details>

Q3

What is the purpose of the agent execution mode?

A) To run plans faster
B) To execute Terraform operations in a private network that HCP Terraform cannot directly reach
C) To save costs
D) To use a different Terraform version

<details><summary>Answer</summary>

B) To execute Terraform operations in a private network that HCP Terraform cannot directly reach

Self-hosted agents run inside your network, allowing access to resources behind firewalls.

</details>

Q4

Where does terraform login store the API token?

A) In terraform.tfstate
B) In ~/.terraform.d/credentials.tfrc.json
C) In an environment variable
D) In the HCP Terraform UI only

<details><summary>Answer</summary>

B) In ~/.terraform.d/credentials.tfrc.json

</details>

Q5

What is the difference between Sentinel advisory and soft-mandatory policies?

A) They are identical
B) Advisory warns but never blocks; soft-mandatory blocks but authorised users can override
C) Advisory blocks; soft-mandatory warns
D) Both always block

<details><summary>Answer</summary>

B) Advisory warns but never blocks; soft-mandatory blocks but authorised users can override

</details>

Q6

Can the cloud block and backend block be used in the same configuration?

A) Yes, for redundancy
B) No, they are mutually exclusive
C) Only in Enterprise
D) Only with remote execution

<details><summary>Answer</summary>

B) No, they are mutually exclusive

You must choose one or the other.

</details>

Q7

What triggers a run in a VCS-driven HCP Terraform workflow?

A) Running terraform plan locally
B) A push to the connected branch or a PR opened against it
C) A cron schedule
D) Manually clicking "Start Run" only

<details><summary>Answer</summary>

B) A push to the connected branch or a PR opened against it

Pushes trigger full plan+apply cycles; PRs trigger speculative plans.

</details>

Q8

An HCP Terraform workspace is connected to the main branch. A developer pushes to feature-x. What happens?

A) A run is triggered
B) Nothing — only pushes to the connected branch trigger runs
C) The workspace is locked
D) An error occurs

<details><summary>Answer</summary>

B) Nothing — only pushes to the connected branch trigger runs

Only commits to the connected branch (or PRs targeting it) trigger workspace runs.

</details>

Q9

What are the three execution modes in HCP Terraform?

A) Fast, normal, slow
B) Remote, local, agent
C) Plan, apply, destroy
D) CLI, VCS, API

<details><summary>Answer</summary>

B) Remote, local, agent

Don't confuse execution modes (where code runs) with workflow types (how runs are triggered).

</details>

Q10

When does cost estimation appear in the HCP Terraform run lifecycle?

A) Before the plan
B) After the plan, before the policy check
C) After the apply
D) It runs in parallel with the plan

<details><summary>Answer</summary>

B) After the plan, before the policy check

The lifecycle is: Plan → Cost Estimate → Policy Check → Confirm → Apply.

</details>

Q11

How does HCP Terraform protect sensitive variables?

A) They are stored in plaintext but hidden in the UI
B) They are encrypted at rest, write-only, and masked in run logs
C) They are deleted after each run
D) They are stored locally, not in the cloud

<details><summary>Answer</summary>

B) They are encrypted at rest, write-only, and masked in run logs

Once saved, sensitive variables cannot be read back — only overwritten or deleted.

</details>

Q12

What is a run trigger in HCP Terraform?

A) A webhook to an external service
B) A dependency between workspaces: changes in workspace A trigger a run in workspace B
C) A scheduled cron job
D) A button in the UI

<details><summary>Answer</summary>

B) A dependency between workspaces: changes in workspace A trigger a run in workspace B

</details>

Q13

How does HCP Terraform handle state locking?

A) You must configure DynamoDB
B) Automatically — no external locking mechanism required
C) It uses file-based locks
D) Locking is not supported

<details><summary>Answer</summary>

B) Automatically — no external locking mechanism required

HCP Terraform manages locking internally during every run.

</details>

Q14

What is the free tier limit for HCP Terraform?

A) 100 managed resources
B) 500 managed resources
C) Unlimited for 30 days
D) No free tier exists

<details><summary>Answer</summary>

B) 500 managed resources

</details>

Q15

An organisation wants to share AWS credentials across 20 workspaces. What is the best approach?

A) Set the credentials in each workspace individually
B) Use a variable set scoped to those 20 workspaces
C) Hardcode them in the Terraform config
D) Use a shared backend

<details><summary>Answer</summary>

B) Use a variable set scoped to those 20 workspaces

Variable sets avoid repetitive configuration and make credential rotation a single update.

</details>

Q16

What is drift detection in HCP Terraform?

A) Detecting changes in Terraform configuration files
B) Periodic health assessments that compare actual infrastructure to the Terraform state
C) Monitoring provider version updates
D) Detecting unused variables

<details><summary>Answer</summary>

B) Periodic health assessments that compare actual infrastructure to the Terraform state

When drift is found, HCP Terraform can alert you or auto-queue a plan to reconcile.

</details>

Q17

What is no-code provisioning?

A) Terraform without configuration files
B) Non-technical users deploying from pre-built module templates via the HCP Terraform UI
C) Automatically generating Terraform code
D) Running terraform apply without a plan

<details><summary>Answer</summary>

B) Non-technical users deploying from pre-built module templates via the HCP Terraform UI

Admins publish "no-code ready" modules; users select and deploy from the UI without writing HCL.

</details>

Q18

What authentication method does the API-driven workflow use?

A) Username and password
B) API tokens (team tokens, user tokens, or organisation tokens)
C) SSH keys
D) OAuth only

<details><summary>Answer</summary>

B) API tokens (team tokens, user tokens, or organisation tokens)

</details>

Q19

How does HCP Terraform differ from Terraform Enterprise?

A) They are the same product
B) HCP Terraform is SaaS (HashiCorp-hosted); Enterprise is self-hosted with air-gapped support
C) Enterprise is deprecated
D) HCP Terraform has more features

<details><summary>Answer</summary>

B) HCP Terraform is SaaS (HashiCorp-hosted); Enterprise is self-hosted with air-gapped support

Enterprise adds air-gapped installation, SAML SSO, and audit logging to the base feature set.

</details>

Q20

A Sentinel policy with enforcement level "hard-mandatory" fails. What happens?

A) A warning is logged and the run continues
B) The run is blocked and cannot be overridden
C) An admin can override the block
D) The policy is ignored

<details><summary>Answer</summary>

B) The run is blocked and cannot be overridden

Hard-mandatory policies are absolute. Only soft-mandatory policies can be overridden.

</details>

Q21

In the CLI-driven workflow, where does the plan actually execute?

A) Entirely on your local machine
B) On HCP Terraform's infrastructure, with output streamed to your terminal
C) Half local, half remote
D) On a GitHub Actions runner

<details><summary>Answer</summary>

B) On HCP Terraform's infrastructure, with output streamed to your terminal

You run terraform plan locally, but the actual computation happens remotely.

</details>

Q22

What does HCP Terraform's state versioning enable?

A) Nothing useful
B) Rollback to a previous state version if the current one is corrupted or incorrect
C) Versioning of Terraform CLI
D) Tracking of HCL file changes

<details><summary>Answer</summary>

B) Rollback to a previous state version if the current one is corrupted or incorrect

Every state mutation is saved as a new version with full history.

</details>

Q23

Which of these is NOT a valid HCP Terraform workflow type?

A) VCS-driven
B) CLI-driven
C) API-driven
D) SSH-driven

<details><summary>Answer</summary>

D) SSH-driven

The three workflows are VCS-driven, CLI-driven, and API-driven.

</details>

Q24

How do you source a module from the HCP Terraform Private Registry?

A) source = "git::https://app.terraform.io/org/module.git"
B) source = "app.terraform.io/<ORG>/<MODULE>/<PROVIDER>"
C) source = "private://<ORG>/<MODULE>"
D) source = "registry.terraform.io/<ORG>/<MODULE>"

<details><summary>Answer</summary>

B) source = "app.terraform.io/<ORG>/<MODULE>/<PROVIDER>"

Private registry modules use the app.terraform.io hostname with the standard namespace/name/provider format.

</details>

Q25

What can Sentinel policies evaluate?

A) Only resource types
B) Planned changes, cost estimates, and any data available in the plan
C) Only apply results
D) Only variable values

<details><summary>Answer</summary>

B) Planned changes, cost estimates, and any data available in the plan

Sentinel can enforce rules on resources, costs, time-of-day, provider versions, and more.

</details>

PART 9 — SECTION 1 DEEP-DIVE: IaC WITH TERRAFORM (REVIEW NEEDED — STUCK ACROSS 2 ATTEMPTS)

You scored 94.4% on practice but "Review Needed" on BOTH real exams. The exam tests nuances you're missing.

Core Concepts the Exam Tests

Declarative vs Imperative

Approach	Description	Example Tools
----------	-------------	---------------
Declarative	Define the desired end state; the tool figures out how	Terraform, CloudFormation, Pulumi
Imperative	Define step-by-step instructions for how to reach the state	Bash scripts, Ansible (procedural mode), AWS CLI

Terraform is declarative. You say "I want 3 instances" — not "create instance, create instance, create instance".

Idempotency

Applying the same configuration multiple times produces the same result. If 3 instances exist and config says 3, Terraform does nothing. It does NOT create 3 more.

Infrastructure Drift

Real-world infrastructure changes outside of Terraform (manual console changes, other tools)
terraform plan detects drift by comparing state to real infrastructure
terraform plan -refresh-only specifically checks for drift without proposing config changes
terraform apply -refresh-only updates state to match reality without changing infrastructure

Shift-Left

Moving testing, validation, and security checks earlier in the development lifecycle. In IaC context:

Validate configuration before deploying
Run terraform validate and terraform plan in CI before merge
Use Sentinel/OPA policies to enforce rules before apply
Catch problems in code review, not in production

Benefits of IaC — COMMON EXAM TRAPS

Benefit	True or Trap?
---------	---------------
Version control infrastructure changes	✅ TRUE
Reproducible environments	✅ TRUE
Eliminates ALL infrastructure errors	❌ TRAP — reduces errors, doesn't eliminate them
Enables collaboration via code review	✅ TRUE
Self-documenting (code = documentation)	✅ TRUE
Faster provisioning than manual	✅ TRUE
Disaster recovery (rebuild from code)	✅ TRUE
Prevents configuration drift permanently	❌ TRAP — detects and corrects drift, but drift can still occur

Terraform's Role Compared to Other Tools

Tool	What It Does	Overlap with Terraform?
------	-------------	------------------------
Ansible	Configuration management (software on servers)	Minimal — Terraform provisions infra, Ansible configures it
Chef/Puppet	Configuration management	Same as Ansible
CloudFormation	AWS-only IaC	Direct competitor but single-cloud
Pulumi	Multi-cloud IaC (imperative languages)	Direct competitor
Packer	Machine image creation	Complementary — build images, Terraform deploys them

"Snowflake Servers" / Configuration Drift

Manually configured servers that diverge over time = snowflake servers
Each server becomes unique and unreproducible
IaC eliminates this by defining infrastructure as repeatable code
This is the key problem IaC solves

What Terraform Does NOT Do

Does NOT manage application code deployments (use CI/CD tools)
Does NOT configure software on servers (use Ansible/Chef/Puppet)
Does NOT monitor running applications (use monitoring tools)
Does NOT replace all manual operations (still need humans for design decisions)

Section 1 — Practice Questions (20 questions)

Q1

Terraform is a declarative tool. What does this mean?

A) You write step-by-step commands to execute
B) You define the desired end state and Terraform determines the actions needed
C) You must specify the order of resource creation
D) You use a graphical interface

<details><summary>Answer</summary>

B) You define the desired end state and Terraform determines the actions needed

</details>

Q2

What does idempotency mean in the context of Terraform?

A) Each apply creates new resources
B) Applying the same configuration multiple times produces the same result with no unintended changes
C) Configuration files change on each run
D) Resources are always destroyed and recreated

<details><summary>Answer</summary>

B) Applying the same configuration multiple times produces the same result with no unintended changes

</details>

Q3

IaC eliminates ALL infrastructure errors. True or False?

A) True
B) False

<details><summary>Answer</summary>

B) False — IaC significantly reduces errors and improves consistency, but logic errors, misconfigurations in code, and external factors can still cause issues.

</details>

Q4

What is a "snowflake server"?

A) A server running in a cold region
B) A manually configured server that has drifted into a unique, unreproducible state
C) A server with automatic scaling
D) A frozen/decommissioned server

<details><summary>Answer</summary>

B) A manually configured server that has drifted into a unique, unreproducible state

IaC eliminates snowflake servers by defining all infrastructure as repeatable code.

</details>

Q5

What is "shift-left" in IaC?

A) Moving servers to a different region
B) Moving testing, validation, and security checks earlier in the development lifecycle
C) Shifting workloads from on-prem to cloud
D) A deployment strategy

<details><summary>Answer</summary>

B) Moving testing, validation, and security checks earlier in the development lifecycle

In practice: run terraform validate, terraform plan, and policy checks in CI before merging.

</details>

Q6

What is infrastructure drift?

A) Moving infrastructure between clouds
B) Real-world infrastructure changing outside of Terraform, causing state to diverge from reality
C) Terraform automatically updating providers
D) Configuration files changing over time

<details><summary>Answer</summary>

B) Real-world infrastructure changing outside of Terraform, causing state to diverge from reality

</details>

Q7

How does Terraform detect drift?

A) It monitors infrastructure continuously
B) During terraform plan, it refreshes the real state and compares it to the configuration
C) It reads Git history
D) It checks cloud provider logs

<details><summary>Answer</summary>

B) During terraform plan, it refreshes the real state and compares it to the configuration

</details>

Q8

Which tool is MOST complementary to Terraform (not a competitor)?

A) CloudFormation
B) Pulumi
C) Packer (builds machine images that Terraform deploys)
D) ARM Templates

<details><summary>Answer</summary>

C) Packer (builds machine images that Terraform deploys)

Packer creates AMIs/images; Terraform provisions infrastructure using those images. They work together.

</details>

Q9

What is the main advantage of multi-cloud IaC tools like Terraform over single-cloud tools like CloudFormation?

A) They are faster
B) They use a single language and workflow to manage resources across multiple providers
C) They are cheaper
D) They have better support

<details><summary>Answer</summary>

B) They use a single language and workflow to manage resources across multiple providers

</details>

Q10

Terraform provisions infrastructure. What does it NOT typically do?

A) Create cloud resources
B) Manage network configurations
C) Install and configure software on servers
D) Manage DNS records

<details><summary>Answer</summary>

C) Install and configure software on servers

Configuration management (installing packages, configuring services) is the domain of Ansible, Chef, or Puppet.

</details>

Q11

A developer manually changes a security group in the AWS console. What happens on the next terraform plan?

A) Terraform ignores the change
B) Terraform detects the drift and proposes changes to bring the resource back to the declared state
C) Terraform crashes
D) The manual change is written to the config

<details><summary>Answer</summary>

B) Terraform detects the drift and proposes changes to bring the resource back to the declared state

</details>

Q12

What does IaC enable for disaster recovery?

A) Nothing — disaster recovery requires manual work
B) Infrastructure can be rebuilt from code in a new region/account since the full definition is in version control
C) Automatic failover
D) Data backup

<details><summary>Answer</summary>

B) Infrastructure can be rebuilt from code in a new region/account since the full definition is in version control

The code IS the disaster recovery plan for infrastructure.

</details>

Q13

Terraform prevents drift from ever occurring. True or False?

A) True
B) False

<details><summary>Answer</summary>

B) False — Terraform detects and can correct drift, but it cannot prevent someone from making manual changes outside of Terraform.

</details>

Q14

What does terraform plan -refresh-only do?

A) Plans all resource changes
B) Refreshes the state from real infrastructure and shows any drift, without proposing config-based changes
C) Destroys refreshed resources
D) Updates the configuration files

<details><summary>Answer</summary>

B) Refreshes the state from real infrastructure and shows any drift, without proposing config-based changes

</details>

Q15

Which is an example of IaC enabling collaboration?

A) Sharing SSH keys
B) Using version control to review, approve, and audit infrastructure changes as code
C) Giving everyone admin access
D) Using a shared console login

<details><summary>Answer</summary>

B) Using version control to review, approve, and audit infrastructure changes as code

</details>

Q16

Terraform uses a declarative approach. If your config says 3 instances and 3 already exist, what happens?

A) 3 more instances are created (total 6)
B) Nothing — infrastructure already matches the desired state
C) All 3 are destroyed and recreated
D) An error occurs

<details><summary>Answer</summary>

B) Nothing — infrastructure already matches the desired state

This is idempotency in action.

</details>

Q17

What is the relationship between Terraform and Ansible?

A) They are direct competitors
B) Terraform provisions infrastructure; Ansible configures software on it — they are complementary
C) Ansible has replaced Terraform
D) They cannot be used together

<details><summary>Answer</summary>

B) Terraform provisions infrastructure; Ansible configures software on it — they are complementary

</details>

Q18

Why is IaC described as "self-documenting"?

A) It generates PDF documentation
B) The infrastructure code itself serves as documentation of the desired state
C) It writes comments automatically
D) It creates architecture diagrams

<details><summary>Answer</summary>

B) The infrastructure code itself serves as documentation of the desired state

Reading the .tf files tells you exactly what infrastructure exists and how it's configured.

</details>

Q19

What happens when you run terraform apply -refresh-only and approve?

A) Resources are destroyed
B) The state file is updated to match real infrastructure, but no infrastructure changes are made
C) Configuration files are updated
D) Nothing happens

<details><summary>Answer</summary>

B) The state file is updated to match real infrastructure, but no infrastructure changes are made

This reconciles state with reality without modifying actual cloud resources.

</details>

Q20

HashiCorp Terraform is cloud-agnostic. What does this mean?

A) It only works with HashiCorp cloud
B) It can manage resources across multiple cloud providers using a single tool and language
C) It does not require cloud access
D) It works offline only

<details><summary>Answer</summary>

B) It can manage resources across multiple cloud providers using a single tool and language

Via providers, Terraform supports AWS, Azure, GCP, and hundreds of other services.

</details>

*Good luck. Your Sections 2, 3, 5, 6, 7 already meet expectations — protect those. Smash Sections 8, 4, and 1 and you WILL pass.*

HCTA-004 Study Manual

TERRAFORM ASSOCIATE 004 — FOCUSED REMEDIATION GUIDE

OFFICIAL EXAM HISTORY

Attempt 1 — 13 February 2026 — FAIL

Attempt 2 — 15 April 2026 — FAIL

DIAGNOSIS — WHY YOU ARE FAILING

🔴 CRITICAL — Section 8: HCP Terraform → INTENSE STUDY (got WORSE)

🟡 STUCK — Section 1: IaC with Terraform → REVIEW NEEDED (no improvement)

🟡 STUCK — Section 4: Terraform Configuration → REVIEW NEEDED (no improvement)

✅ STRENGTHS — Sections 2, 3, 5, 6, 7

REVISED PRIORITY ORDER (based on real exam results)

PART 1 — DOMAIN 5: MODULES (CRITICAL — 10 wrong answers)

Theme A: What Modules ARE

Key Facts to Memorise

Mini-drill

Theme B: How You CALL Modules

Passing Input Variables

Key Rule: terraform init Is REQUIRED After Adding/Changing Module Sources

terraform get vs terraform init

Theme C: Module Sources

Terraform Registry (Public)

Private GitHub Repository

HCP Terraform Private Registry

Domain 5 — Practice Questions (20 questions)

Q1

Q2

Q3

Q4

Q5

Q6

Q7

Q8

Q9

Q10

Q11

Q12

Q13

Q14

Q15

Q16

Q17

Q18

Q19

Q20

PART 2 — DOMAIN 8: READ, GENERATE & MODIFY CONFIGURATION (High Weight — NOT STUDIED)

Variable Types

Variable Precedence (LOWEST → HIGHEST)

Conditional Expressions

Count vs for_each

Dynamic Blocks

Key Functions

For Expressions

Splat Expression

moved Block (004-specific)

depends_on

Outputs

Environment Variables for Input Variables

terraform.workspace

Domain 8 — Practice Questions (20 questions)

Q1

Q2

Q3

Q4

Q5

Q6

Q7

Q8

Q9

Q10

Q11

Q12

Q13

Q14

Q15

Q16

Q17

Q18

Q19

Q20

PART 3 — DOMAIN 7: IMPLEMENT & MAINTAIN STATE (High Weight — NOT STUDIED)

Key Rule: `terraform init` Is REQUIRED After Adding/Changing Module Sources

`terraform get` vs `terraform init`

`moved` Block (004-specific)

`depends_on`

`terraform.workspace`

`terraform_remote_state` Data Source

What Triggers a Re-run of `terraform init`?