TERRAFORM-PRO-002 practice questions
HashiCorp · Terraform Infrastructure Engineer Professional (002) · 300 questions
Original practice questions for the HashiCorp Certified: Terraform Infrastructure Engineer Professional (002) exam, covering scalable configuration design, state and backend operations, infrastructure lifecycle operations, CI/CD and automation workflows, security and governance, advanced module and registry practices, and HCP Terraform / Terraform Enterprise operations, written against Terraform 1.15. HashiCorp publishes no domain weights for this exam, so questions are spread evenly across its seven official objective areas.
This course contains the use of artificial intelligence.
About the Terraform Infrastructure Engineer Professional (002) exam
- Time allowed
- 1 hour 30 minutes
- Questions
- not published
- Passing score
- not published
- Format
- Multiple choice, online proctored
Exam details published by the vendor, checked 9 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Scalable Terraform Configuration Design · 43 questions
- A platform team must make sure every AWS resource in dev, staging and prod carries CostCenter and Owner tags. Engineers currently add a tags argument to each of roughly 200 resources by hand, and audits keep finding gaps. Which approach meets the requirement once, in code, with the least per-resource effort?
- The business wants the same web tier in three availability zones with different instance counts per zone, and expects to add or remove zones later without disturbing the zones that remain. Which input design should the module use?
- A compliance rule says no storage bucket may ever be publicly readable. The bucket module exposes a variable that controls the bucket's public-access setting. The team wants a violating value to stop the run during plan, before Terraform creates or changes anything. Where should the rule be expressed?
- A product team asks for environments in small, medium and large sizes. They should never need to know instance types or node counts, and any size other than those three must be rejected. How should the module translate the requirement into code?
- To meet a business rule that the production database must never be deleted by accident, an engineer adds lifecycle { preventdestroy = true } to it. Months later a refactoring pull request deletes the database's entire resource block from the configuration. What does terraform plan do?
- Two engineers run terraform plan on the same commit and get different results, because their machines selected different minor versions of the same provider. The repository's .gitignore excludes .terraform.lock.hcl. What change makes provider selection reproducible across laptops and CI?
- A root variable carrying a database password appears in clear text in plan output in CI logs. The team wants it hidden from CLI output today and needs to understand what risk remains afterwards. Which statement describes the right change and its limits?
- A team needs a database administrator password to be supplied at apply time and never written to the plan file or to state. The provider's database resource offers a write-only password argument. Which configuration meets the requirement?
- Every terraform plan shows in-place tag updates on dozens of resources, even immediately after a successful apply with no code changes. The shared tags local includes CreatedAt = timestamp(). What is causing the perpetual diff?
- A module accepts an instancecount input. Any value above 20 must stop the run before Terraform makes a single provider API call. A teammate proposes a check block that asserts var.instancecount <= 20. Which approach meets the requirement?
- A subnet is created with 10.1.9.0/24 instead of 10.1.1.0/24. The root module declares variable appcidr with default 10.1.1.0/24, sets local.subnetcidr = var.appcidr, and passes the local to a network module. The directory holds terraform.tfvars with appcidr = 10.1.1.0/24 and prod.auto.tfvars with appcidr = 10.1.9.0/24. Where does the wrong value come from?
- A module declares variable instancetype with default t3.small, and terraform.tfvars sets it to t3.large. A local is defined as instancetype = var.environment == "prod" ? "m5.xlarge" : var.instancetype. With environment set to prod, an output shows m5.xlarge although the team expected t3.large. What explains the result?
- A root module declares output dbendpoint with value = module.database.endpoint. terraform plan fails with an Unsupported attribute error saying the module object has no attribute named endpoint. The child module creates the database instance but declares no outputs. What fixes it?
- A CI job exports TFVARregion=eu-west-1, but terraform plan keeps using us-east-1. No -var or -var-file options are passed, and the variable's default is eu-central-1. Which explanation fits these symptoms?
- While debugging tags, an engineer opens terraform console and evaluates local.tags, defined as merge(var.basetags, var.teamtags), where basetags is {Owner = "platform", Env = "dev"} and teamtags is {Owner = "payments"}. What does local.tags["Owner"] return?
- A configuration declares resource "awsiamuser" "this" with foreach = toset(["alice", "bob", "carol"]). An operator must force replacement of only alice's user. Which address should be passed to terraform apply -replace?
- A module takes variable buckets of type list(string) and a resource uses foreach = var.buckets. terraform plan fails because foreach received a list. What is the correct fix?
- A resource uses count = length(var.queuenames) with ["orders", "billing", "audit"]. After billing is removed from the list, the plan replaces the audit queue and destroys another instance. Why does this happen, and what prevents it?
- An awseip resource uses foreach = toset(awsinstance.app[].id). On a fresh environment, terraform plan fails because the foreach value depends on resource attributes that cannot be determined until apply. What is the recommended fix?
- A security group uses dynamic "ingress" with foreach = var.rules, where var.rules is a list of objects with port and cidr attributes, and content sets fromport = ingress.value.port. One generated rule has the wrong port. Inside content, what do ingress.key and ingress.value refer to?
- A module sets instancetype = lookup(var.instancesizes, var.environment, "t3.micro"), where instancesizes is {dev = "t3.small", prod = "m5.large"} and environment is staging. What value does the expression produce?
- A network module computes subnet addresses with cidrsubnet(). What does cidrsubnet("10.0.0.0/16", 8, 2) return?
- A local builds subnet pairs with flatten([for tier, subnets in local.network : [for s in subnets : { tier = tier, subnet = s }]]), where local.network is {app = ["a", "b"], db = ["c"]}. What does the expression produce before it is converted for foreach?
- A module defines local.name = coalesce(var.overridename, var.defaultname) with overridename = null and defaultname = "web", and local.port = try(local.config.port, 8080), where local.config is yamldecode() of a file that has no port key. What are the two values?
- A local is defined as admins = { for name, role in var.users : name => role if role == "admin" }, where var.users is {alice = "admin", bob = "dev", carol = "admin"}. What is the value of local.admins?
- In Terraform 1.15, a module decodes JSON into local.raw and needs it as exactly list(object({ name = string, port = optional(number, 443) })), with the port default applied to entries that omit it, instead of relying on type inference. Which expression does that?
- An application server must be replaced whenever local.appconfighash changes. Adding replacetriggeredby = [local.appconfighash] to the server's lifecycle block fails validation. Which change achieves the replacement trigger?
- After every update to a CDN distribution, the team must invalidate its cache. Today a local-exec provisioner calls a vendor CLI. Their provider, used with Terraform 1.14 or later, now offers an action that performs the invalidation. How should they wire it to run after each update without managing it as a resource?
- A module takes variable settings of type object({ name = string, retentiondays = number, encrypted = bool }). Callers must be able to pass only name, with retentiondays defaulting to 30 and encrypted defaulting to true. How should the type constraint change?
- A data source selects the most recent image for an application, and the image must be built for the x8664 architecture. If the source returns any other architecture, the run must fail with a clear message before instances are created from it. Which configuration does that?
- A configuration must run a local migration script every time var.schemaversion changes, and the team wants to drop the null provider. Which configuration achieves this with built-in features only?
- A team wants Terraform to assert after every plan and apply that its public health endpoint returns HTTP 200. A failure must be reported but must never block a deployment, and HCP Terraform health assessments should keep evaluating it between runs. Which construct fits?
- One configuration must create a primary bucket in us-east-1 and a replica bucket in us-west-2 using the AWS provider. How should the providers be configured?
- A reusable replication module, called with foreach, needs a second AWS provider configuration for its replica resources. The root defines provider "aws" with alias = "west". How should the module receive that configuration?
- A configuration uses resource "datadogmonitor" but has no requiredproviders entry for it. terraform init fails because it tries to install hashicorp/datadog, which does not exist. What fixes the installation?
- A provider "aws" block in a repository contains a hard-coded access key and secret key. Runs execute in HCP Terraform workspaces. What is the recommended remediation?
- A CI runner in an air-gapped network cannot reach the public Terraform Registry, and terraform init fails to download providers. Which approach lets init install providers inside the isolated network?
- A module declares version = "~> 5.3" for a provider in requiredproviders. Which provider versions does this constraint allow?
- An AI coding agent keeps generating provider arguments that were deprecated or removed in the provider version the team uses. The team wants the agent to keep working with the current provider release. What should they add to the agent's toolchain?
- A team wants an AI agent to write a call to a public registry module without guessing its interface. The agent is connected to the Terraform MCP server. What workflow should the agent follow?
- A developer wants to run the Terraform MCP server for an AI assistant inside a local IDE. Separately, a platform team plans a shared instance that many remote clients will reach over the network. Which transport choices fit HashiCorp's guidance?
- An AI agent connected through the Terraform MCP server can create, update and delete HCP Terraform workspaces and their variables. Security asks for safeguards before the agent is used against the production organization. Which safeguards fit HashiCorp's guidance?
- A team starts merging Terraform code generated by an AI agent connected to the Terraform MCP server. A reviewer asks whether the usual pipeline gates still need to apply to that code. What is the correct policy?
Terraform State and Backend Operations · 43 questions
- A team using the S3 backend wants state locking without maintaining a DynamoDB table, since the DynamoDB locking arguments are now deprecated. Which configuration should they adopt?
- A backend "s3" block sets bucket = var.statebucket so each environment can use its own bucket, and terraform init fails. How should the team supply a different bucket per environment?
- A project has kept state in a local terraform.tfstate file. The team adds a remote backend block and wants the existing state moved into it so nothing is recreated. Which command completes the change?
- A team edits its backend configuration to point at a new bucket whose state was already copied there by storage replication. They want terraform init to use the new settings and not attempt any state migration. Which command fits?
- A team uses the CLI-driven workflow with HCP Terraform. Their workspaces app-dev, app-staging and app-prod all carry the tag app. Developers want one configuration that lets them switch among those workspaces with terraform workspace select. How should the configuration connect?
- An application team reads the network team's VPC ID with the terraformremotestate data source. The network team's state also contains database passwords managed by other resources. What should the network team understand about this access?
- In HCP Terraform, a consuming workspace needs a producing workspace's outputs. The producing team will not grant access to its full state and wants the shared values to stay current automatically after each apply. Which approach fits?
- Two pipeline jobs for the same environment start terraform apply within seconds of each other. Both use an S3 backend configured with uselockfile = true, and neither passes -lock=false. What happens to the job that starts second?
- A CI runner was killed mid-apply, and every later run for that workspace now fails with an error that the state is locked, showing a lock ID and the dead runner as the holder. What should the engineer do?
- An operator suspects someone edited a security group's rules in the cloud console. The team wants to see exactly how the real object differs from what Terraform last recorded, without changing any infrastructure and without updating the state yet. Which command fits?
- A refresh-only plan shows that an ingress rule allowing 0.0.0.0/0 was added to a production security group outside Terraform. The change was unauthorized, and the Terraform configuration is still correct. Which action restores the approved rule set?
- A teammate renamed resource "awss3bucket" "logs" to resource "awss3bucket" "auditlogs" during a cleanup, and the plan now shows the bucket being destroyed and a new one created. The bucket holds data that must be kept. What is the reviewable fix?
- A team is handing an existing load balancer over to a separate networking team that manages it with its own tooling. The load balancer must keep running, but this configuration should stop managing it, and the change must go through the normal plan review in a pull request. What should they do?
- One instance in a foreach set, awsinstance.worker["b"], has a corrupted boot disk. Its configuration is fine, so a normal plan shows no changes. The team wants to rebuild just that instance through a reviewable plan. Which approach is current practice?
- An engineer pulled a workspace's state from HCP Terraform, hand-edited the JSON, and pushed it back with terraform state push -force. Runs now fail with state errors. The previous state version is known to be good. What is the safest recovery?
- A platform team is splitting one large configuration into separate network and compute configurations, each with its own HCP Terraform workspace. The subnets must move from the old state to the new network state without being recreated, through reviewed plans. Which approach fits?
- HCP Terraform health assessments report drift on a workspace: someone enabled versioning on a storage bucket in the console. After review, the team decides the change is correct and should become the new standard. How should they resolve the drift?
- A resource sets lifecycle { ignorechanges = [tags] } because an external cost tool rewrites tags. A refresh-only plan still reports the tags as changed outside of Terraform. An engineer thinks ignorechanges is broken. What explains the behavior?
- Before raising the AzureRM provider to a new major version, a lead wants a list showing which modules in the configuration, including nested child modules, declare a requirement on that provider and with what version constraints. Which command shows this?
- A base network module is about to be upgraded, and the team wants a picture of which resources in the configuration depend on its resources, whether through attribute references or dependson, to judge the blast radius. Which approach gives that view?
- A root module declares dependson = [module.network] on a module that contains several data sources. Since then, plans show many of that module's data source results as known after apply and propose more changes than expected. What is the recommended fix?
- A network workspace in HCP Terraform publishes an output named vpcid. Several application workspaces read it through tfeoutputs and are linked by run triggers. A developer wants to rename the output to networkvpcid. What is the main risk, and how should it be handled?
- A root configuration declares requiredversion = "~> 1.10.0" and runs on Terraform 1.10.5. The team bumps a registry module to a release whose own terraform block declares requiredversion = ">= 1.11". What happens, and what must change?
- A provider major upgrade removes an argument from the awsinstance resource type and changes its defaults. Before merging the upgrade, the team wants to know exactly which managed instances in this workspace would be affected and how. Which approach scopes the impact?
- In HCP Terraform, a network workspace feeds a platform workspace, which feeds an application workspace. The team wants each downstream workspace to queue a run automatically after its upstream workspace applies successfully. How should this be configured?
- Developers on macOS committed a dependency lock file after a provider upgrade. Linux CI runners now fail during terraform init, reporting that the provider package checksum doesn't match any checksum recorded in the lock file. What fixes this properly?
- An organization runs Terraform 1.9 in dev, stage, and prod, each with its own state. The lead wants to move all three to Terraform 1.15 while limiting risk. Which rollout plan is appropriate?
- Production was upgraded from Terraform 1.14 to 1.15 and has had several successful applies since. An engineer now wants to switch prod's pipeline back to 1.14 because a colleague prefers its plan output. What should the team understand first?
- A CI image installs the latest Terraform release whenever it is rebuilt, and a new minor version recently changed plan behavior without warning. The team wants upgrades to happen only deliberately and wants engineers' laptops held to the same rule. What should they do?
- An engineer changes a provider constraint from "~> 5.40" to "~> 5.60" and runs terraform init, which reports that the locked 5.45 does not match the new constraint. What does running terraform init -upgrade do here?
- After a team moves CI from Terraform 1.14 to 1.15, terraform validate starts failing on a backend "s3" block whose required bucket argument was misspelled as buckets. The same file validated cleanly on 1.14. What is the right response?
- A pipeline using the S3 backend sets AWSUSEFIPSENDPOINT=1 so state traffic goes to FIPS endpoints. After an upgrade to Terraform 1.15, the backend no longer uses the FIPS endpoint. Which change restores the intended behavior?
- A platform team maintains a shared module whose input instancesize is being replaced by instancetype. All callers now run Terraform 1.15. The team wants callers who still pass instancesize to see a warning naming the replacement, without their runs failing. What should the team add?
- A team is about to move a production workspace from Terraform 1.14 to 1.15 and wants evidence that the new core version alone will not change infrastructure. Configuration and provider versions stay the same. What is the most useful test before applying anything with 1.15?
- A configuration calls module "network", which itself calls a nested subnets module. An engineer needs a quick list of every resource instance in state that belongs to module.network, including the nested module's resources. Which command produces that list?
- During an incident, an engineer needs every attribute Terraform has recorded for one foreach instance, awsinstance.web["api"], including its provider-assigned ID, printed in human-readable form. Which command should they run?
- A deployment script needs the value of the string output lbdnsname with no quotes or extra formatting so it can pass it to curl. Another pipeline stage needs all root outputs, including a map, in a stable machine-readable format. Which commands fit each need?
- A compliance team's audit tool needs to ingest the full current state of a workspace, with resource types, addresses and attribute values, in the stable machine-readable format Terraform documents for external tools. Which command should the pipeline run?
- A database password variable and its output are both marked sensitive = true, and plans and terraform output now display (sensitive). A security reviewer asks whether this means the password is no longer stored in the workspace state. What is the accurate answer?
- A configuration uses an ephemeral randompassword block and passes its result to a resource's write-only password argument. After apply, an engineer runs terraform state list and terraform show and finds no entry for the ephemeral block, and wonders whether state is broken. What explains this?
- An engineer wants to examine a remote workspace's state offline with jq while investigating an issue, without risking changes to the shared state. Which approach is appropriate?
- While debugging, an engineer wants to check the current value of awsvpc.main.cidrblock and test what cidrsubnet(awsvpc.main.cidrblock, 8, 2) returns, using the values already in state and without editing configuration or running a plan. Which tool fits?
- Resources in an HCP Terraform workspace changed unexpectedly last week. An engineer wants to see when each state change happened, which run and VCS commit produced it, and what changed between versions. Where should they look?
Infrastructure Lifecycle and Operations · 43 questions
- A single root configuration manages networking, databases, Kubernetes clusters and application services for one product. Plans take about 20 minutes, a small app change plans against everything, and one mistake can affect all layers. What is the recommended structural fix?
- A team uses one working directory with Terraform CLI workspaces named dev and prod on a single S3 backend. Security now requires prod to use different credentials and a separately access-controlled backend, so dev engineers cannot read prod state. What should they do?
- A large configuration's plans intermittently fail with HTTP 429 throttling errors from the cloud provider's API. The team wants plans to finish reliably now, without ignoring drift, while they consider longer-term changes. What should they adjust first?
- A platform team deploys the same set of components, network, cluster and service, together in many environments and regions. They want to define the components once, deploy them as a unit in HCP Terraform with each environment customized by inputs, and roll a change out environment by environment. Which feature fits?
- An HCP Terraform organization has grown to dozens of workspaces across three business units. Each unit's team should manage only its own workspaces, and the organization wants to keep one private registry and organization-wide policies. How should workspaces be organized?
- A pipeline runs terraform plan in one job, posts the plan for human approval, and runs apply in a later job after approval. The team must guarantee the apply performs exactly the actions that were approved, not a freshly computed plan. How should the jobs be set up?
- A plan for a load balancer contains the line +/- resource "awslb" "main", and the resource sets lifecycle { createbeforedestroy = true }. A junior reviewer asks what this marker means for the running service. What is the correct explanation?
- A nightly job runs terraform plan for many workspaces and should open a ticket only when a workspace has pending changes, while treating errors separately. Which approach lets the script tell these outcomes apart reliably?
- A change advisory board must approve the teardown of a temporary test environment and wants to review exactly which objects Terraform will remove before anything is deleted, then have that approved teardown executed as reviewed. What should the engineer do?
- A module uses foreach = toset(awssubnet.private[].id) to create route table associations. On a fresh environment, the plan fails with an error that foreach has dependencies that cannot be determined before apply. What is the best fix?
- A pipeline must run terraform apply without an interactive prompt. The security lead wants the change that executes to be exactly the change that was reviewed earlier in the pipeline. Which approach meets both requirements?
- An apply that should create ten resources creates eight and then fails on the ninth with a cloud quota error. After the quota is raised, what should the engineer expect and do next?
- A CI job saved a plan with terraform plan -out=tfplan and waited for approval. Meanwhile another pipeline applied a different change to the same workspace. When the approved job runs terraform apply tfplan, what happens?
- An engineer creates a plan file while the dev CLI workspace is selected, then switches to the staging workspace and runs terraform apply with that plan file on Terraform 1.15. What happens?
- During a production incident, one misconfigured security group rule is blocking traffic. The main branch also holds several merged but unapplied changes to other resources that have not been reviewed for release yet. The on-call engineer must correct only the broken rule right now. Which approach follows Terraform's guidance for this situation?
- A storage bucket was created by hand last year and now has to come under Terraform management. Team policy says every change to state must appear in a plan that is reviewed in a pull request and is then applied only by the pipeline. Which approach satisfies that policy?
- A team has written import blocks for 40 legacy resources but has no resource blocks for them yet. They want Terraform to draft the resource configuration so they do not have to write every argument by hand. Which workflow is correct?
- An engineer must import 30 existing subnets into a resource declared as awssubnet.this with foreach, keyed by subnet name. The real subnet IDs are already available in a map variable from name to ID. Which import configuration handles all 30 without writing 30 separate blocks?
- A workspace runs Terraform 1.15, and a recent provider release adds resource identity support to a resource type whose import IDs are long composite strings that engineers keep getting wrong. The team wants its import blocks to use identity instead. How should the import blocks change?
- A platform team must bring several hundred existing compute instances spread across one cloud account under Terraform management. Nobody has an inventory of their IDs, and hand-writing an import block for each is not practical. Using Terraform 1.15 and a provider that supports list resources, which approach fits?
- Changing the domain on a TLS certificate resource forces replacement. A load balancer listener references the certificate, and in the last change Terraform destroyed the old certificate before creating the new one, which broke HTTPS for several minutes. What should the team set so the next replacement avoids that gap?
- An autoscaling group is managed by Terraform, but a scaling policy changes its desired capacity throughout the day. Every plan now proposes setting desired capacity back to the configured value. Terraform must keep managing the group's launch template, sizes and tags. Which change is appropriate?
- A team runs dev and prod from the same Terraform configuration with separate state for each environment. An engineer runs terraform destroy against the dev state to tear dev down. It is rejected because the database resource sets preventdestroy = true. A colleague also worries the destroy could have removed prod resources. Which statement is accurate?
- An engineer wants an application instance to be replaced whenever the input variable appversion changes. They added replacetriggeredby = [var.appversion] to the instance's lifecycle block, and Terraform rejects it. Which change achieves the goal?
- An engineer deleted the resource block for a logging bucket, intending Terraform to stop managing it while the bucket and its data stay in place. The plan now proposes to destroy the bucket. Which change achieves the goal through a normal reviewed plan?
- A configuration uses CLI workspaces named dev and prod and builds resource names from the prefix app- followed by the interpolation of the current workspace name. Both workspaces store state in the same backend bucket, and engineers use the same cloud credentials for both. A security review asks whether this setup isolates production. What is the accurate assessment?
- A root module contains terraform.tfvars with dev values and prod.tfvars with prod values. A manual production apply was run without -var-file, silently loaded the dev values, and resized production resources. Which change best prevents this from happening again?
- Dev and prod both call a shared registry module with version = "~> 3.0". Dev was tested on 3.4.0, but when prod was initialized two weeks later it installed 3.5.0, which nobody had tested. The team wants prod to run only module code that has already passed in dev. Which practice achieves this?
- An engineer wants each environment's state in a different S3 bucket and wrote bucket = var.statebucket inside the backend block. terraform init fails with an error about variables not being allowed there. The configuration targets Terraform 1.15. What is the supported way to vary backend settings per environment?
- One Terraform configuration deploys the same stack to a dev account and a prod account in the same cloud. Compliance requires that a dev run can never authenticate into the prod account. Which approach meets the requirement?
- A terraform apply fails with a vague provider error, and the team needs the provider's detailed debug output, which for this provider includes its API requests and responses. They want the output saved to a file and do not need Terraform core's internal logs. Which settings should they use?
- Two security groups each allow traffic from the other, and both rules are written as inline ingress blocks that reference the other group's ID. terraform plan now fails with a Cycle error naming both groups. Which change resolves the error?
- A pipeline's plan job fails with an error acquiring the state lock. The lock details show the operation, the user, and a creation time from a few minutes ago, and another pipeline job targeting the same state may still be running. What should the engineer do?
- A terraform apply fails while creating a storage bucket because the provider reports that a bucket with that name already exists. Investigation shows a teammate created the bucket by hand last week with the settings the configuration expects. Which response is correct?
- An apply ends with an error saying the provider produced an inconsistent result after apply. terraform validate passes, and the same configuration has applied cleanly for months. The error appeared right after a provider minor version upgrade. What does this error indicate, and what is the appropriate response?
- A root module calls a child module named network, which creates private subnets. The root needs those subnet IDs for a database resource, but referencing module.network.awssubnet.private[].id fails with an error. Which change provides the IDs correctly?
- A child module's output sometimes returns a tuple and sometimes a list depending on how it is called, and callers that pass it into list(string) variables keep breaking. The module targets Terraform 1.15, and the maintainers want the output itself to declare and enforce list(string). Which change achieves this?
- In HCP Terraform, an app workspace needs the subnet ID that a network workspace exposes as an output. Security does not want the app workspace's runs to have read access to the network workspace's full state. Which approach fits HashiCorp's recommendation?
- An application configuration hardcodes a VPC ID. The VPC belongs to a network team that manages it with its own tooling outside Terraform and occasionally rebuilds it, which breaks the application's plans each time. The VPC always carries agreed tags. How should the application configuration obtain the VPC ID?
- A module block uses source = "git::https://example.com/org/network.git" with version = "1.2.0", and terraform init rejects the configuration. The team wants to pin the module to the repository's v1.2.0 tag. Which change is correct?
- A platform team wants one root module to choose a registry module's version from an input variable so each environment's pipeline can pass its own version. The configuration targets Terraform 1.15. Which approach is supported?
- An engineer commits .terraform.lock.hcl and assumes it also pins the registry module that the configuration calls with version = "~> 4.1". Weeks later, a teammate's fresh init installs a newer 4.x module release. Why did this happen, and what pins the module?
- A provider release fixes a bug the team keeps hitting, and the new version falls within the configuration's existing version = "~> 5.40" constraint. Running terraform init in the repository, which has a committed lock file, still installs the older release. What should the engineer do?
CI/CD and Automation Workflows · 43 questions
- A team is designing a pipeline for a Terraform repository. Reviewers must approve exactly the changes that will be applied, and syntax or formatting problems should fail early. Which stage order meets these requirements?
- Pipeline jobs that run terraform plan sometimes hang until they time out. The logs show Terraform waiting for a value for a variable that has no default and that the job did not supply. How should the team make these jobs fail immediately instead of waiting?
- A team wants merge requests to be blocked automatically when any .tf file anywhere in the repository, including module subdirectories, is not in canonical HCL format. The check must not modify files in the job. Which command should the pipeline run?
- A pipeline saves a plan with terraform plan -out=tfplan. Reviewers want a human-readable rendering of exactly that plan posted to the pull request, and a policy tool needs a machine-readable version of the same plan. Which approach provides both?
- An HCP Terraform workspace is connected to a VCS repository. Each pull request gets a plan linked from the pull request, but reviewers with apply permission find no way to apply those plans. What explains this behaviour?
- A workspace in HCP Terraform uses the CLI-driven workflow, and the configuration contains a cloud block naming it. A developer runs terraform plan on their laptop and wonders where the plan actually executes and which variable values it uses. Which description is correct for this workspace's default remote execution mode?
- A company's in-house release orchestrator must start HCP Terraform runs. It communicates only over HTTP APIs, cannot run the Terraform CLI, and the configuration is assembled at release time rather than stored in a supported VCS repository. Which workflow fits?
- Every job in a busy CI system downloads the same providers again during terraform init, which slows runs and hits rate limits. The repository already commits .terraform.lock.hcl. Which change addresses this in a supported way?
- HCP Terraform must manage resources in a private data center network that has no inbound access from the internet, and security forbids opening inbound firewall rules. Runs must stay governed by the workspace's permissions, policies and run history. Which approach meets these requirements?
- A pipeline runs terraform test for a shared module, and the CI dashboard displays test results only from JUnit XML report files. The team still wants the normal human-readable test output in the job log. Which command meets both needs?
- A lint job must run terraform validate on every pull request. The configuration uses a remote backend, but the lint runner has no credentials for that backend and should never touch state. Which command sequence works?
- A web service runs on instances behind a load balancer. A new machine image must be rolled out, and changing the image forces replacement of the instances. The release must not cause an outage, and rollback must be fast if the new version misbehaves. Which deployment strategy fits?
- A shared networking module has released a new major version with breaking changes. Dev, staging and prod each call the module from their own root configuration with an exact version pin. The team wants the new version to reach production gradually and to be easy to roll back. Which approach fits?
- Fifty application instances are declared with count, and each image change makes Terraform replace them, which takes the service down. Cloud quotas do not allow doubling capacity, and the team wants replacement in health-checked batches. Which change best meets these goals?
- Dev and prod are separate HCP Terraform workspaces connected to the same repository. The team wants dev to apply automatically after a merge, while prod changes must wait for a person with apply permission to approve the plan. Which configuration achieves this?
- In HCP Terraform, an app workspace reads values produced by a network workspace. Whenever the network workspace successfully applies a change, the app workspace should automatically queue a new run so it picks up the new values. Which feature provides this?
- A team is choosing how to lay out dev, staging and prod in one Terraform repository. One proposal uses a long-lived Git branch per environment with the same file layout on each, and the other uses a directory per environment on a single main branch, each calling shared modules. Which assessment is accurate?
- A configuration change that broke a production service was applied an hour ago through the normal pipeline. The team wants to restore the previous infrastructure settings safely and keep state consistent with reality. Which rollback approach is appropriate?
- A new feature adds a queue and its access policy to a shared configuration that serves dev, staging and prod. The team wants these resources created only in dev until the feature is approved, without maintaining separate copies of the code. Which approach fits?
- A platform team must deploy the same set of networking, cluster and application components to many regions. They want one shared definition, each region planned and approved separately, and changes rolled out region by region, managed as a unit in HCP Terraform. Which approach fits these goals?
- An organization's separation-of-duties rule says developers who write Terraform code must not apply it to production, but they must still be able to queue plans in the prod HCP Terraform workspace and read the results. A separate operations team performs production applies. Which team access configuration meets the rule?
- A platform team uses remote-exec provisioners on awsinstance resources to install packages and push configuration after boot. Over months, servers built from the same configuration have drifted apart because package mirrors and scripts changed between runs, and failed provisioners leave instances tainted mid-setup. Which deployment strategy best addresses the root cause?
- A security review of an HCP Terraform organization finds AWSACCESSKEYID and AWSSECRETACCESSKEY stored as sensitive environment variables in dozens of workspaces. The CISO wants no long-lived AWS credentials stored in HCP Terraform at all, with every run receiving short-lived credentials instead. What should the platform team implement?
- An IAM role used by HCP Terraform dynamic credentials has a trust policy with StringEquals on app.terraform.io:aud and StringLike on app.terraform.io:sub matching organization:acme:. An auditor notes that any workspace in the acme organization could assume this production role. Only the prod-network workspace in the Networking project, in both plan and apply phases, should be trusted. What change meets this requirement?
- A security team requires that HCP Terraform plans in the payments workspace run with an AWS role that can only read resources, while applies use a separate role that can modify them. The workspace already uses dynamic provider credentials with TFCAWSRUNROLEARN. How should the team configure this?
- The data-platform project in HCP Terraform contains fifty workspaces that all deploy to one AWS account using the same IAM role through dynamic provider credentials. Workspaces added to the project later must pick up the settings automatically, and workspaces in other projects must not receive them. What is the most maintainable approach?
- A single HCP Terraform workspace must create a VPC in an application AWS account and a Route 53 record in a separate shared-services account in the same apply, using two aws provider blocks, one of them aliased. Both accounts already trust HCP Terraform's OIDC provider, and static keys are not allowed. How should the workspace supply credentials to both providers?
- An Azure team using HCP Terraform currently stores ARMCLIENTSECRET as a sensitive workspace variable. They want the same no-stored-secrets model the AWS teams use with dynamic provider credentials, covering both the plan and apply phases. What setup achieves this?
- A GCP team using HCP Terraform stores a service account JSON key in a sensitive GOOGLECREDENTIALS variable. Security wants keyless authentication for every run, and only tokens from the company's own HCP Terraform organization may be accepted. Which configuration meets both requirements?
- A security team already runs Vault with the AWS secrets engine and wants every HCP Terraform run to receive AWS credentials generated by that engine, so Vault remains the single place where cloud credential issuance is audited and leases are revoked. No Vault token or AWS key may be stored in HCP Terraform. Which feature fits?
- A workspace using AWS dynamic provider credentials was moved from the Default Project to a new Platform project in HCP Terraform. Its next run fails because the AWS role could not be assumed with web identity. No IAM policies or workspace variables changed. What is the most likely cause?
- A team runs terraform plan and apply directly in GitHub Actions with an S3 backend, not through HCP Terraform. Long-lived AWS access keys are stored as repository secrets, and security wants them removed. What is the recommended replacement?
- Two teams share an HCP Terraform organization, and each team owns its own project. Team A's dynamic credential variables currently live in a global variable set, so Team B's workspaces can also assume Team A's AWS role. How should the platform team isolate the credentials?
- A root module directory contains terraform.tfvars setting instancetype = "t3.small" and prod.auto.tfvars setting instancetype = "m6i.large". A pipeline runs terraform plan with no -var or -var-file options and no TFVAR environment variables. Which value does the plan use?
- During an incident, an engineer runs terraform apply -var="replicacount=6" in a root module directory where scaling.auto.tfvars sets replicacount = 3 and terraform.tfvars sets replicacount = 2. Which value is applied?
- An HCP Terraform workspace using the VCS-driven workflow has a workspace Terraform variable region = "us-east-2". A developer commits region.auto.tfvars with region = "eu-west-1" to the tracked branch. No variable sets define region. Which value does the next run use?
- A project-scoped variable set defines the Terraform variable allowedregions, and one workspace in that project also defines allowedregions as a workspace variable with a different value. The governance team wants the variable set's value to win in every workspace in the project. What should they do?
- A CI job runs terraform plan in a root module directory that contains dev.tfvars, staging.tfvars and prod.tfvars, but the plan uses each variable's default instead of the staging values. The three environment files must stay side by side in that directory. What is the correct fix for the staging job?
- An internal service generates the variable values for each deployment as a JSON object whose top-level keys are variable names. The team wants Terraform to load the file automatically on every plan in the root module, with no command-line options added. How should the generated file be named?
- terraform.tfvars sets tags = { owner = "platform", costcenter = "1234", env = "dev" }. A later-loaded prod.auto.tfvars sets tags = { env = "prod" }, intending to change only the env key. After apply, the resources have lost their owner and costcenter tags. Why?
- A CI job exports TFVARtags='{"team":"payments","tier":"gold"}' before running terraform plan in a root module whose tags variable is declared as map(string). The plan instead shows the tags defined in the directory's terraform.tfvars file. Why did the environment value not apply?
- After a module refactor removed the variable legacysubnet, a shared common.auto.tfvars file still assigns legacysubnet. Meanwhile, one engineer's script still runs terraform plan -var="legacysubnet=10.0.9.0/24". How does Terraform treat these two assignments?
- An HCP Terraform workspace variable allowedcidrs holds ["10.0.0.0/16", "10.1.0.0/16"]. The configuration declares the variable as list(string), but runs fail because the value arrives as a single string. How should the workspace variable be fixed?
Terraform Security and Governance · 43 questions
- Auditors find database passwords in plaintext inside a terraform.tfstate object in the S3 bucket used as a team's backend. Every engineer in the account can read the bucket, and server-side encryption is off. Which response addresses the finding?
- A child module builds a database connection string from a sensitive password variable and exposes it as output connstring with sensitive = true. The root module declares output "dbconn" { value = module.db.connstring }, and terraform plan fails with an error saying the output refers to sensitive values. What is the correct fix?
- A team's awsdbinstance sets password from a sensitive variable, and the password appears in state. The provider version they use offers the write-only argument passwordwo with a companion passwordwoversion argument. What is the effect of switching to passwordwo?
- A root module declares variable "dbpassword" with ephemeral = true and assigns var.dbpassword to the password argument of a database resource. terraform plan fails because an ephemeral value is used where it is not allowed. The provider version also offers a write-only password argument for that resource. Which change fixes the error and keeps the password out of state?
- A developer committed prod.auto.tfvars containing a third-party API key to the main branch of a shared repository, and the commit was pushed an hour ago. Which response best addresses the exposure?
- A root configuration sets accesskey and secretkey directly in the aws provider block, read from variables whose default values are committed to the repository. The team runs Terraform both from laptops and from HCP Terraform workspaces. What is the recommended change?
- A networking workspace in HCP Terraform publishes VPC and subnet IDs as outputs. Ten application teams read them with the tfeoutputs data source, and each team holds the Read workspace role on the networking workspace, which also lets them download complete state containing secrets. What is the least-privilege fix?
- An engineer plans to attach TFLOG=TRACE output from a failing production apply to a public issue on a provider's GitHub repository. What should the team consider before sharing it?
- To debug a failing connection, a developer adds output "dbpassword" { value = nonsensitive(var.dbpassword) } to a shared module, where var.dbpassword is declared with sensitive = true, and merges the change. What is the main risk?
- A configuration reads a database admin password from Vault's KV version 2 engine with a data source and passes it to a database resource's password argument, so the password appears in state. The Vault provider and the database resource both support Terraform's ephemeral and write-only features. Which pattern keeps the password out of state entirely?
- A database resource sets its password through a write-only argument fed by an ephemeral value, with the companion version argument set to 1. Security rotates the password in Vault, but terraform plan reports no changes. How should the team push the new password to the database?
- A compliance scan finds Vault-sourced API keys in an HCP Terraform workspace's state. The configuration reads them with a vaultkvsecretv2 data source and passes them to the provider block of a SaaS provider. Why are the keys in state, and what removes them?
- A team wants the database credentials Terraform uses during each run to be created on demand and to expire automatically shortly after the run, so no credential outlives the run that used it. They already operate Vault. Which approach fits?
- Every CI pipeline in a company authenticates to HCP Terraform with one team API token created two years ago with no expiration date, and a pipeline log once leaked it. What should the platform team implement going forward?
- Applications read a database password from AWS Secrets Manager, and a separate rotation function changes the value monthly. Terraform should create the secret and its access policy but must never hold the password or conflict with the rotation. What should the configuration manage?
- A module generates a database password with the randompassword resource and passes its result to a resource's write-only password argument, yet the password still appears in state. The random provider version in use supports ephemeral resources. What change keeps the generated password out of state?
- Several running services authenticate to a partner API with a key that Terraform provisions. The key must be rotated without any service losing access during the change. Which sequence achieves this?
- A company's dev and prod Terraform pipelines both assume one cloud role with administrator permissions. A compromised job in the dev pipeline could therefore change production. What is the recommended remediation?
- A deployment pipeline authenticates to HCP Terraform with a user API token that belongs to a senior engineer who is leaving the company next month. What should replace it?
- A production HCP Terraform workspace uses the VCS-driven workflow with auto-apply enabled on the main branch. Any developer with repository write access can push directly to main, which immediately applies to production. Which control set best reduces this risk?
- An open-source infrastructure repository runs terraform plan in CI for every pull request, including pull requests from forks, and the plan job has access to cloud credentials so it can refresh real resources. What is the main risk, and the fix?
- An HCP Terraform agent pool runs inside a restricted network segment that can reach payment systems. Any workspace in the organization can currently select the pool in its settings. How should access be limited?
- A GitHub Actions workflow assumes an AWS production role through OIDC. The role's trust policy checks only the audience and that the subject begins with the organization's repository path, so a workflow on any feature branch can assume it. How should the trust be tightened?
- A production workspace in HCP Terraform was destroyed overnight, and security needs to establish who queued the destroy run and who confirmed it. Which source should they use?
- Fifteen engineers belong to the owners team of an HCP Terraform organization, mostly so they can manage workspaces for their own applications. What change best follows least privilege?
- Developers hold the Write role on a production HCP Terraform workspace that uses the VCS-driven workflow. One developer ran terraform state rm against it from a laptop, and another downloaded the full state, which contains secrets. Developers still need to read runs and queue plans. Which access model fits?
- A platform team's engineers already write Rego policies for Kubernetes admission control. They want HCP Terraform to evaluate Terraform plans against policies written in the same language and enforce them on runs in selected projects. What should they use?
- A compliance rule says no run may create a public storage bucket, and no user, including organization owners, may override a failure. The team writes its policies in Sentinel. How should enforcement be configured?
- A platform team runs HCP Terraform for 40 workspaces across five projects. Security requires that encryption rules apply to every workspace, including ones created next year, while a cost-center tagging rule must apply only to workspaces in the analytics project. How should the team organize its policies?
- A hotfix run in a production HCP Terraform workspace stops because a Sentinel policy set to soft-mandatory fails. Security has reviewed the change and approved it as a one-time exception. What lets the run proceed while keeping the policy in place?
- A compliance lead wants every change to the organization's Sentinel policies to go through pull-request review and leave a full history, and wants HCP Terraform to start enforcing a merged change without anyone copying code into the UI. Which approach meets this requirement?
- A policy author has written a new Sentinel policy that blocks public storage buckets. Before it can stop anyone's run, the author wants evidence that it passes compliant plans and fails non-compliant ones, and then wants to watch its behavior on real runs for a week. What is the recommended approach?
- A team writes Sentinel policies that need to examine the attribute values Terraform intends to set, so non-compliant changes are stopped before anything is modified. At what point in an HCP Terraform run does policy evaluation occur?
- A global Sentinel policy set restricts compute instance types to an approved list. The machine learning team, whose workspaces all sit in their own HCP Terraform project, has an approved business need for GPU instance types that the list excludes. How should the platform team accommodate them?
- A newly formed cloud governance team must enforce the CIS AWS Foundations benchmark in HCP Terraform within weeks and has no Sentinel authors on staff. What is the most direct way to obtain enforceable policies?
- An engineer changes the name argument on a production managed database resource to match a new naming standard. The plan marks the database with -/+ and shows # forces replacement beside the name attribute. What does the plan mean?
- A team decommissions a staging environment, but terraform destroy fails with an error that a database instance cannot be destroyed because lifecycle.preventdestroy is set. The team lead confirms the database must really be deleted. What is the correct way to proceed?
- Security requires that a third-party scanning service inspect every planned change in production HCP Terraform workspaces and be able to stop a run when it finds a critical issue. How should the platform team integrate the scanner?
- A team wants obvious configuration mistakes, such as invalid references, unformatted files and known insecure settings, caught on every pull request before any terraform plan runs or any cloud credentials are used. Which addition to the CI pipeline meets this goal?
- An organization decides that any HCP Terraform run deleting resources in production workspaces must stop and receive explicit approval from a designated reviewer group, while runs that only create or update resources proceed normally. Which control meets this requirement?
- A company manages its network, databases and dozens of applications from one root configuration with a single state. A typo in an application change recently planned the replacement of a shared subnet, and every plan takes 25 minutes. Which change best reduces the risk and blast radius of routine changes?
- A platform team is building an automated reviewer for pull requests that must count how many resources a plan will delete or replace and fail the check above a threshold. Which approach gives the reviewer reliable, structured data to analyze?
- Two engineers start terraform apply against the same production configuration at almost the same moment. One uses a remote backend that supports locking; another team runs the same configuration as an HCP Terraform workspace. What prevents conflicting writes to state in each case?
Advanced Module Usage and Registry Practices · 43 questions
- An infrastructure team finds the same 200 lines defining a VPC, subnets and route tables copy-pasted into five root configurations, and the copies have started to drift as fixes land in only some of them. What is the best next step?
- During a design review, an engineer proposes a module that wraps a single storage bucket resource and exposes every one of the resource's arguments as an input variable with no added logic or defaults. How should the reviewer respond?
- An engineer moves an existing awsinstance.web resource block from the root module into a new child module called web, where it is now named awsinstance.this. The plan proposes destroying the old instance and creating a new one. What should the engineer add to keep the existing instance?
- A shared networking module has grown to 60 input variables, many of them feature flags, because every team asked for its own option. Upgrades now regularly break someone, and new users cannot tell which inputs matter. What is the best way to evolve the design?
- A configuration creates three instances with count = length(var.names). The team refactors it to foreach = toset(var.names) so removing one name no longer shifts the others. The plan now wants to destroy and recreate all three. What should the team add?
- A team is writing a reusable module that other teams will call, sometimes with count or foreach, and wants it to create resources in the AWS account and region the caller chooses. How should the module handle the AWS provider?
- Engineers struggle to trace where a value comes from because the root module calls a module that calls another module, four levels deep, and each level re-exports its child's outputs. Which refactoring does HashiCorp's module guidance favor?
- A platform team is building a shared storage bucket module for 30 application teams. Security requires that server-side encryption and public access blocking are always present on every bucket the module creates, with no way for a caller to turn them off. How should the module implement these guardrails?
- One root configuration holds a core network that changes about once a year and application services that are redeployed several times a day. Each application deploy plans and locks the network resources too, and network changes need a separate approval chain. How should the team restructure?
- A team refactors a large configuration by renaming resources and moving several into modules, adding moved blocks for each change. Before merging, reviewers want proof the refactor does not touch any real infrastructure. Which evidence is sufficient?
- A widely used internal module has accumulated about 30 moved blocks over eight minor releases as resources were renamed and regrouped. A maintainer proposes deleting them all in the next minor release to tidy the code. Several teams still pin versions from a year ago. What should the maintainer do?
- A module maintainer deletes an output named subnetids that looked unused inside the module and publishes the change as a patch release. Several root configurations reference module.network.subnetids. What happens to those callers, and how should such a removal be handled?
- A module maintainer adds a new input variable, logretentiondays, with no default value and publishes the change as minor version 2.3.0. Every caller that runs terraform init -upgrade then fails to plan. How should the maintainer have released the new input?
- A module maintainer plans to remove the input variable subnetid in the next major version in favor of subnetids. The team wants every caller that still passes subnetid to see a clear warning now, without breaking anyone's current plans. Which Terraform 1.15 feature should they use?
- A module accepts a bucketconfig input with name, retentiondays and versioning. Callers must always set name, and should be able to omit retentiondays and versioning and receive 30 and true, while Terraform still type-checks every attribute. How should the variable type be declared?
- Callers of a shared network module keep passing malformed values for the vpccidr input, and the error only appears deep in the cloud provider's API response during apply. The maintainer wants a clear, module-specific error at plan time. What should the maintainer add?
- A shared module starts using a language feature added in Terraform 1.11. Teams still running Terraform 1.9 now see confusing configuration errors instead of a clear message that their CLI is too old. What should the maintainer add to the module?
- A module is at version 1.4.2. Two changes are ready: first, a fix for a wrong default tag value with no interface change, released on its own; second, renaming the input instancesize to instancetype. Following semantic versioning, which versions should the two releases carry?
- A caller adds foreach to a module block to create one copy of a shared module per team. terraform init now fails, reporting that the module cannot be used with foreach because it contains its own provider configuration. What must change for the caller's design to work?
- A new team trying to adopt an internal module cannot tell from its files which inputs are required, what each one means, or how a typical call looks, and keeps asking the maintainers. What change best makes the module's contract self-documenting?
- A disaster-recovery module creates resources in a primary and a secondary AWS region. The maintainer wants callers to pass two separately configured AWS providers into the module, and wants the module to declare that requirement explicitly. What belongs in the module?
- A module's subnetids output used to return a list. A refactor wrapped the value in toset() and consumers that index subnetids[0] broke without any warning from the module itself. Which Terraform 1.15 capability makes the output's type an enforced part of the contract?
- An engineer wants to use the VPC module listed on the public Terraform Registry under the namespace terraform-aws-modules, the module name vpc and the target provider aws, and pin it with the version argument. Which source value is correct?
- An organization named acme-corp publishes an internal module named vpc for the aws provider to its HCP Terraform private registry. A team wants to call it from a configuration and pin a version. Which source value should the module block use?
- A production root configuration calls a registry module at version 3.2.1. CI checks out the repository fresh and runs terraform init on every run. The team requires that a newly published module release never reach production until someone deliberately changes the configuration. Which approach meets this?
- A team wants to publish a module that manages VPC endpoints for AWS to the public Terraform Registry. The code already follows the standard module structure. What must the GitHub repository look like before the registry can publish the first version?
- A platform team publishes modules to the HCP Terraform private registry. They want every Git release tag such as v2.4.0 to become a distinct, pinnable module version automatically, with no one typing a version number into HCP Terraform. Which publishing type should they choose?
- A configuration uses a public registry module pinned to version 4.x. The team wants to upgrade to 5.0, whose release notes say several resources were renamed and regrouped inside the module. What is the safest upgrade procedure?
- A security reviewer asks whether a third-party provider in a new configuration is maintained by HashiCorp, by a technology partner, or by an individual community contributor. Where is this information shown?
- Business analysts need to provision standard reporting environments themselves through HCP Terraform, choosing only a few approved settings, without writing or reviewing any Terraform configuration. The platform team already maintains the module in the private registry. What should they enable?
- A registry module named consul for the aws provider in the hashicorp namespace contains several submodules. A team needs only the submodule stored in the module's modules/consul-cluster directory. How should the module block's source reference it?
- An engineer is writing a module block for a public registry module for the first time and needs a reliable list of its required and optional inputs with their types and defaults, its outputs, and its provider dependencies. Which source should the engineer consult?
- A module computes resource names from several input variables. The maintainer wants a test in a .tftest.hcl file that checks the computed names without creating any real infrastructure. How should the run block be configured?
- A module test must fail with a message that tells the reader exactly what went wrong when the module's endpointurl output does not start with https. What belongs inside the run block in the .tftest.hcl file?
- A module's unit tests must run in a CI job that has no cloud credentials at all, yet the module's resources have computed attributes, such as IDs and ARNs, that other resources and outputs reference. What should the test files use?
- A module reads data.awsami.base and passes its id to awsinstance.web. The team's unit test uses mockprovider "aws" {} and a default apply-mode run block, and it must assert that awsinstance.web.ami equals ami-0123456789abcdef0 instead of a random generated string. Which addition to the test file makes the data source return that exact value?
- A test file uses mockprovider "aws" {} plus overrideresource { target = awss3bucket.logs, values = { arn = "arn:aws:s3:::logs" } }. A run block with command = plan asserts that output.bucketarn equals that ARN, but the assertion fails because the value is unknown. The run must remain a plan-only run. Which change fixes it?
- variable "environment" has a validation block that only allows dev, stage or prod. A module author wants a test that passes precisely because the value qa is rejected, and fails if the validation is ever removed. Which run block achieves this?
- A module repository contains main.tf, variables.tf and a tests directory holding networktest.hcl and defaultstest.hcl, each with run and assert blocks. Running terraform test from the module root reports that no tests were found. What is the cause?
- A test file has 30 run blocks. Each uses its own setup module or a distinct statekey, none references another run's outputs, and the whole file runs one run at a time and takes too long. The authors want the independent runs to execute concurrently without splitting the file. Which change does this?
- An integration test for an S3 module has run blocks with no command attribute and real AWS credentials. A new engineer asks what happens to the buckets the test creates once terraform test finishes. Which answer is correct?
- A module under test needs an existing VPC ID. The repository contains a helper configuration in ./testing/vpc that creates a VPC and outputs vpcid. The integration test must create that VPC first, then run the module under test against it. How should the test file be written?
- A test file sets bucketprefix = "test" and region = "us-east-1" in a file-level variables block, and six run blocks use those values. One run must check behaviour when bucketprefix is "audit" while still using the same region. What is the cleanest way to do this?
HCP Terraform / Enterprise Operations · 42 questions
- A new platform team is onboarding 40 microservices owned by five product teams into HCP Terraform. Each service has dev and prod, every team must manage only its own services, and shared credentials and policies should be applied per team rather than per service. How should the hierarchy be laid out?
- The payments team must be able to create, configure, run and delete any workspace in the payments project, including future ones. It must not rename or delete the project, change which teams can access it, or touch workspaces in other projects. Which permission should the team receive?
- A repository holds the configuration for a shared networking stack. The team wants HCP Terraform to queue a run automatically whenever a pull request is merged to main, and to show a plan on every pull request, without writing any pipeline code. Which workspace workflow fits?
- A team must keep its state in HCP Terraform for locking and history, but its plans and applies have to execute on each engineer's laptop with credentials already present there. Which workspace execution mode should be set?
- During a two-hour database maintenance window, operations needs to stop anyone from applying changes to the prod-db workspace, whether the run comes from VCS, the CLI, the API or a run trigger. Which action meets this need?
- A prod workspace has cost estimation enabled and a Sentinel policy set attached. A run finished planning, showed an estimate, and is now paused without applying, and the run page shows the state Policy Override. Which statement correctly describes the run's progress?
- Engineers want a message in their Slack channel whenever a run in the prod-api workspace is waiting for someone to approve the plan or a policy override, but not for every run that starts or finishes. What should they configure?
- A regulated customer cannot send state or run data to any SaaS service, but its teams want the same workspaces, private registry, policy sets and VCS-driven runs that HCP Terraform provides. Which offering should the customer use?
- Workspaces, team access and variables in an HCP Terraform organization are created by hand in the UI, and settings now differ between teams in ways nobody can explain. The platform team wants every change to these settings reviewed and versioned. What should it do?
- Before approving any production apply, finance wants each HCP Terraform run on AWS, Azure and Google Cloud resources to show the estimated monthly cost and how much the change raises or lowers it. What provides this?
- With cost estimation enabled, the platform team wants a guardrail that stops any run whose change would raise the estimated monthly cost by more than 500 dollars, while allowing an authorized approver to let an exception through. How should this be implemented?
- Leadership asks how the organization's HCP Terraform Standard bill is calculated so it can forecast next year's cost. Which description of the usage measure is accurate?
- A security advisory requires upgrading the hashicorp/aws provider in every workspace that still uses a 4.x release. The platform team needs a list of affected workspaces across the whole organization today, without changing any configuration. What should it use?
- Finance cannot attribute the AWS bill to teams because resources created through Terraform carry inconsistent tags. The platform team wants every taggable AWS resource in a configuration to get cost-center and team tags without editing each resource block. What should it do?
- An organization has hundreds of workspaces that nobody has applied in over a year, and many still hold managed resources that cost money. The platform team wants to find them and clean them up safely. Which approach is correct?
- Developers create short-lived test environments in their own HCP Terraform workspaces, and many are forgotten and keep running for weeks. The platform team wants such environments torn down automatically when nobody has changed them for a few days. What should it configure?
- A director wants a quick organization-wide view of how many resources HCP Terraform currently manages, together with counts of projects, workspaces and applies and the plan's limits, without building any tooling. Where should the director look?
- One Terraform configuration for an order service must be deployed to dev, stage and prod in HCP Terraform. Each environment needs its own state, its own variable values and its own approval settings, while the code stays identical. How should the workspaces be organized?
- All workspaces in the dev project need the same TFVARregion value and the same non-production credentials, including workspaces added later. Workspaces in the prod project must not receive these values. What should the platform team configure?
- A CLI-driven configuration links to several HCP Terraform workspaces through a cloud block with workspaces { tags = { app = "billing" } }. The matching workspaces are billing-dev, billing-stage and billing-prod. An engineer must run a plan against prod. What should the engineer do?
- A monorepo holds envs/dev, envs/stage, envs/prod and a shared modules directory. The VCS-backed prod workspace currently plans on every commit to any file. It should plan only when files under envs/prod or modules change. How should the workspace be configured?
- The networking repository uses main for ongoing work and a release branch for approved changes. The dev workspace should run on merges to main, while the prod workspace, connected to the same repository, must run only on changes to the release branch. What should be configured?
- Reviewers want per-environment, non-secret values such as instance sizes and replica counts to appear in pull request diffs and in Git history next to the code. Each environment has its own directory and HCP Terraform workspace. Where should these values live?
- The stage workspace reads outputs from the prod-network workspace through terraformremotestate. Security requires that no other workspace, including the dev workspaces in the same project, can read prod-network's state. How should prod-network be configured?
- Stage and prod workspaces each call the company's network module from the private registry. Platform wants prod to receive exactly the module code that was already applied and verified in stage, with no edits in between. Which promotion approach meets this?
- Developers want a temporary environment for each feature branch: a workspace that runs that branch's code, receives the team's dev variable set, and is removed when the branch is merged. The platform team wants this automated through its pipeline. What should it use?
- A production workspace is pinned to Terraform 1.9.8 and must move to 1.15. The configuration's requiredversion allows both releases. The team wants the change done with the least risk of surprise infrastructure changes. Which approach is best?
- Several HCP Terraform workspaces were set to always use the newest Terraform release. After a new release came out overnight, plans in those workspaces began showing different behaviour, and nobody had approved an upgrade. What change prevents this from happening again?
- Two hundred HCP Terraform workspaces must move from Terraform 1.13 to 1.15 in controlled batches, and every change has to be reviewable and repeatable. Clicking through each workspace's settings page is not acceptable. What should the platform team do?
- A workspace was upgraded from Terraform 1.12 to 1.15 and a successful apply ran. A week later an engineer wants to switch the workspace back to 1.12 because a colleague prefers its output format. What is the correct guidance?
- A configuration declares requiredversion = "~> 1.15.0". Its HCP Terraform workspace is still set to Terraform 1.14.3, and every run now fails during initialization with an unsupported Terraform version error. What is the correct fix?
- A producer workspace publishes network outputs, and five consumer workspaces read them with terraformremotestate. All six are on Terraform 1.10 and will move to 1.15 on different days. Which sequencing minimises the risk of consumers failing to read the producer's state?
- Before changing a workspace from Terraform 1.13 to 1.15, the team wants to see how the configuration behaves on 1.15 without altering the workspace's version setting and without any risk of an apply. What should it do?
- Terraform 1.9 has reached end of life inside the company, and the platform team needs a current list of every workspace in the organization that still runs a 1.9.x release, with no changes to any workspace. Where should it look?
- Teams in one HCP Terraform organization start runs from VCS merges, from the CLI with the cloud block, and from a CI system calling the API, and every workspace uses remote execution. Security needs one set of Sentinel rules enforced on every run, whatever started it. What should the platform team do?
- Policy authors keep their Sentinel policies in a VCS-connected policy set repository. A recent merge contained a logic error that blocked many production runs. They want every pull request to that repository to prove each policy passes and fails on the right sample data. What should the repository's pipeline do?
- A GitHub Actions workflow drives HCP Terraform through the API: it uploads a configuration version and then reports success. A hard-mandatory Sentinel policy failed on a recent run, yet the workflow showed green and nobody noticed. What should the workflow do?
- A team runs Terraform in Jenkins with an S3 backend, outside HCP Terraform, and must enforce the same policy-as-code rules on proposed changes before any apply. Which pipeline design does this?
- A new Sentinel rule requiring encryption on all storage resources would fail for many existing workspaces if enforced today. The governance team wants the rule live in every workspace without breaking teams on day one, and to block violations later. What rollout should it use?
- Developers complain that a Sentinel policy only reports the main rule as false, so they cannot tell which resource broke it or why, and each fix reveals another failure on the next run. What change to the policy addresses this?
- A Sentinel policy limits the number of instances a single run may create. The data project should allow 20, while every other project should allow 5. The governance team wants one copy of the policy code. How should this be implemented?
- Policies in an HCP Terraform organization are currently edited directly in the web UI. A faulty edit last month blocked deployments, and nobody could see who changed what or roll back quickly. What should the governance team move to?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by HashiCorp or IBM.