Free HashiCorp Terraform Associate 004 Sample Questions

Correct answers: A, C, D — Configurations can be scanned for security misconfigurations before deployment.; Changes to infrastructure leave an audit trail in version control systems.; Standardized, approved modules can be reused to ensure compliance.

• A. Correct. IaC configurations can be statically analyzed and scanned by tools (such as tfsec, checkov, or Terraform Sentinel) before deployment. This allows teams to identify security misconfigurations and policy violations early in the CI/CD pipeline (Shift-Left security).
• B. Incorrect. IaC is used to manage and provision infrastructure; it does not automatically patch application-level code or handle runtime application vulnerabilities. Patching vulnerabilities requires application updates or patch management processes.
• C. Correct. Storing IaC definitions in a version control system (like Git) creates a persistent, immutable audit trail of every change made to the infrastructure, detailing who made the change, what was changed, and when.
• D. Correct. By using standardized, vetted, and approved modules, organizations can encapsulate security best practices and compliance requirements. Reusing these modules across different teams ensures consistency and adherence to organizational standards.
• E. Incorrect. Encryption at rest is a feature of the underlying cloud resource and must be explicitly configured within the Terraform HCL or provider settings. IaC tools do not automatically apply encryption unless defined in the configuration.
• F. Incorrect. Access to a cloud provider's web console is managed through Identity and Access Management (IAM) policies. While IaC can be used to provision and manage these IAM policies, the act of using IaC does not inherently block or prevent manual console access.

Correct answer: B — Run `terraform apply` again, and Terraform will detect the missing resource and recreate it based on the configuration.

• A. Manually recreating the VM is error-prone and does not guarantee consistency with the previous configuration. Additionally, it leads to state drift because Terraform's state file will not track the new resource until it is manually imported, defeating the purpose of Infrastructure as Code.
• B. This is the standard workflow for state reconciliation. Running `terraform apply` prompts Terraform to refresh the state and compare the current real-world infrastructure against the desired state defined in the configuration files. Upon detecting that the VM is missing, Terraform will automatically plan and execute the creation of a replacement resource that matches the defined configuration.
• C. Writing a custom script is unnecessary and time-consuming because Terraform is already designed to handle resource recovery. A custom script would also fail to update Terraform's internal state management system, leading to further management complexities.
• D. Running `terraform destroy` is destructive and would remove all other managed resources in the workspace, causing unnecessary downtime for the entire environment. Terraform is designed to perform incremental changes; it only needs to recreate the missing resource rather than rebuilding the entire stack.

Correct answer: C — By utilizing provider plugins that allow Terraform to interact with the specific APIs of each cloud platform.

• A. Terraform does not use a universal cloud abstraction layer that hides provider differences; instead, it relies on provider-specific schemas and resources, meaning HCL code is written specifically for the target provider's capabilities.
• B. Terraform does not require separate state files and directories for each cloud provider. You can declare and manage resources from multiple providers (e.g., AWS, Azure, and GCP) within the same configuration file and a single state file.
• C. Terraform utilizes provider plugins (providers) that implement the logic to interact with specific cloud platform APIs. This modular architecture allows Terraform Core to communicate with each provider plugin to manage resources across different platforms within the same configuration.
• D. Terraform interacts directly with cloud provider APIs via provider plugins rather than converting HCL into intermediate templates like AWS CloudFormation or Azure ARM templates.

Correct answers: B, C — Tracking resource dependencies to determine the correct order of creation or destruction; Caching resource attributes to improve performance for large infrastructures

• A. Terraform state is not a secure secrets store by default. While it does store sensitive values if they are part of a resource, the file is not encrypted by default unless using a specific backend that supports encryption (like S3 with SSE or HashiCorp Cloud Platform).
• B. Terraform state tracks resource dependencies and relationships. This metadata allows Terraform to determine the correct order for creation, update, and destruction operations, ensuring that dependencies are respected during the plan and apply phases.
• C. Terraform state caches resource attributes (such as IDs and metadata). This improves performance by allowing Terraform to compare the current configuration to the known state without necessarily querying the provider API for every single resource property every time, which is crucial for large infrastructures.
• D. The Terraform state file is not responsible for backing up infrastructure configuration (.tf) files. Configuration files should be managed in a Version Control System (VCS) like Git.
• E. Module versioning and distribution are handled by module registries or external VCS systems (like Git), not by the state file. The state file tracks specific resource instances, not module code versions.

Correct answers: A, B, D — >=; ~>; !=

• A. Correct. The '>=' operator is a valid version constraint operator used to specify that the provider version must be greater than or equal to the specified version. It is often used to enforce a minimum requirement.
• B. Correct. The '~>' operator is known as the pessimistic constraint operator. It allows the rightmost version component to increment while keeping the higher-level components fixed, ensuring compatibility while allowing for patch or minor updates.
• C. Incorrect. The '=>' operator is not a valid syntax for version constraints in Terraform and will result in a configuration error.
• D. Correct. The '!=' operator is a valid version constraint used to exclude specific versions. It can be combined with other constraints to skip versions that are known to contain bugs.
• E. Incorrect. The '<<' operator is used in HCL (HashiCorp Configuration Language) for heredoc multi-line string syntax and is not a version constraint operator.
• F. Incorrect. While '==' is an equality operator used within Terraform expressions (like ternary logic), it is not used in version constraints. Terraform uses a single '=' (or no operator at all) to signify an exact version match.

Correct answers: A, C — Terraform Core communicates with provider plugins via RPC (Remote Procedure Call); Terraform automatically downloads required providers from the configured registry during `terraform init`

• A. Correct. Terraform Core communicates with provider plugins via RPC (specifically gRPC). Terraform launches provider plugins as separate processes and interacts with them over a standardized provider protocol, which keeps providers isolated from the core process.
• B. Incorrect. Provider plugins are separate executable binaries that are downloaded as needed; they are not statically compiled into the Terraform Core binary (a change that occurred in Terraform 0.10).
• C. Correct. During the `terraform init` process, Terraform identifies the required providers in the configuration, resolves their versions, and automatically downloads them from the HashiCorp Registry or other configured mirrors into a local cache directory.
• D. Incorrect. Terraform Core is responsible for parsing HCL (HashiCorp Configuration Language) files and managing the dependency graph. Providers receive structured configuration data from Core and implement the logic for managing specific resources.
• E. Incorrect. Terraform Core does not have knowledge of specific cloud APIs (like AWS, Azure, or GCP). It delegates all CRUD (Create, Read, Update, Delete) operations and API interactions to the provider plugins.

Correct answers: B, C — Deploying resources to multiple regions within the same cloud provider.; Using different sets of credentials or target accounts within the same cloud provider.

• A. Incorrect. Deploying to multiple different cloud providers (e.g., AWS and GCP) requires separate provider blocks (one for 'aws' and one for 'google'), but because they are different provider types, they do not require an alias to be distinguished from one another.
• B. Correct. When deploying resources to multiple regions within the same cloud provider, you must create multiple provider blocks for that provider and assign them aliases (for example, aws.us_east and aws.eu_west). This allows resources to target a specific regional configuration.
• C. Correct. Using different sets of credentials or targeting different accounts within the same cloud provider requires multiple provider blocks with aliases. This allows each block to hold its own specific credentials or account-level configuration, which resources can then reference.
• D. Incorrect. Provider versioning and upgrades are managed within the 'terraform' block under 'required_providers' using version constraints. Aliases are used for concurrent configurations of the same provider, not for handling version history.
• E. Incorrect. A single provider configuration can manage any number of resource types (e.g., EC2, S3, IAM) within the same region and account. You only need aliases when you need multiple distinct configurations (different regions, credentials, or endpoints).

Correct answers: A, C — Verifying that all required variables are declared.; Ensuring the syntax of the configuration files is valid HCL.

• A. Correct. `terraform validate` checks for internal consistency, which includes ensuring that any variables referenced in the configuration have been properly declared and that variable blocks are internally consistent.
• B. Incorrect. `terraform validate` is a static analysis tool and does not contact cloud provider APIs. Checking for resource availability or stock is a runtime check that cannot be performed by validate.
• C. Correct. The primary function of `terraform validate` is to verify that the configuration files are syntactically valid HCL and to catch structural problems or parse errors.
• D. Incorrect. State locking and backend interaction occur during commands like `init`, `plan`, or `apply`. `terraform validate` runs purely against the local configuration files without checking the remote state.
• E. Incorrect. Permission validation requires making live API calls to the provider (e.g., AWS IAM). `terraform validate` does not authenticate or perform any external network requests to verify permissions.

Correct answer: A — terraform apply -destroy

• A. The `terraform destroy` command is a convenience alias for `terraform apply -destroy`. This command creates a destruction plan and, upon user confirmation, applies that plan to remove all infrastructure resources managed by the current configuration.
• B. While `terraform plan -destroy` creates a speculative plan showing what would be deleted, it does not actually execute the destruction. Therefore, it is not what `terraform destroy` (which includes an apply step) aliases.
• C. There is no `terraform delete` command in the Terraform CLI. Infrastructure removal is managed specifically through the destroy or apply commands.
• D. There is no `terraform rm` command. While `terraform state rm` exists to remove resources from the state file without affecting real-world infrastructure, it is not related to the destroy command's alias.

Correct answer: A — -parallelism

• A. Correct. The -parallelism flag is the Terraform CLI option that sets the maximum number of concurrent resource operations. By default, Terraform performs up to 10 concurrent operations. This flag can be adjusted (e.g., -parallelism=20) to speed up execution or decrease load on a provider's API.
• B. Incorrect. There is no -concurrency flag in the Terraform CLI; using it will result in an unknown flag error. Terraform uses -parallelism to control concurrent operations.
• C. Incorrect. The -max-threads flag is not a valid Terraform command-line argument. Concurrency in Terraform is managed at the resource graph level via the -parallelism flag.
• D. Incorrect. The -jobs flag is common in other automation tools and build systems (like 'make'), but it is not a valid flag for Terraform apply.

Correct answer: B — It initializes a working directory containing Terraform configuration files.

• A. Incorrect. Formatting configuration files to HashiCorp style conventions is the job of `terraform fmt`. `terraform init` does not modify the styling, whitespace, or layout of configuration files.
• B. Correct. `terraform init` is the first command that should be run after writing a new Terraform configuration. It initializes the working directory by installing required provider plugins, downloading referenced modules, and configuring the backend for state storage.
• C. Incorrect. Creating an execution plan is performed by the `terraform plan` command, which compares the current state and configuration to generate proposed changes. `terraform init` prepares the environment so that a plan can be generated later.
• D. Incorrect. Synchronizing the state with real-world infrastructure is part of operations like `terraform apply` or `terraform refresh`. While `terraform init` can configure or migrate a backend, it does not perform the reconciliation of state against actual resources.

Correct answer: A — terraform fmt -check

• A. Correct. The terraform fmt -check command checks if the configuration files are formatted correctly according to the canonical style. If any files require reformatting, the command returns a non-zero exit code, which causes the CI/CD pipeline step to fail. It only checks formatting and does not rewrite files.
• B. Incorrect. The terraform fmt -diff command displays the differences between the current formatting and the canonical style. While helpful for identifying specific formatting changes, it does not return a non-zero exit code by itself to fail a CI step; you must use the -check flag for that behavior.
• C. Incorrect. The terraform validate command checks whether a configuration is syntactically valid and internally consistent (e.g., checking provider schemas and required arguments). It does not check for adherence to the canonical formatting style (the 'look' of the code).
• D. Incorrect. While terraform fmt -write=false prevents the command from overwriting the source files, it does not necessarily set a non-zero exit code when formatting issues are found. The specific flag intended for CI failure logic is -check.

Correct answer: A — -detailed-exitcode

• A. Correct. The -detailed-exitcode flag changes the exit behavior of terraform plan. It returns 0 if no changes are required, 1 on error, and 2 if there are changes to apply. This allows CI/CD systems to detect the presence of infrastructure changes and respond programmatically (e.g., by failing a check or requiring manual approval).
• B. Incorrect. There is no -error-on-change flag in Terraform. To achieve functionality that detects changes via exit codes, the -detailed-exitcode flag must be used.
• C. Incorrect. The -strict flag is not a valid option for the terraform plan command and will result in an error indicating an unrecognized flag.
• D. Incorrect. There is no -check flag for the terraform plan command. While a -check flag is used with 'terraform fmt' to check for formatting issues, it is not used with 'plan' to detect infrastructure diffs.

Correct answers: B, C — It should be committed to your version control system to ensure consistent runs across your team.; It is automatically generated or updated when you run `terraform init`.

• A. The `.terraform.lock.hcl` file should not be ignored. It is intended to be committed to version control to ensure consistent provider checksums and versions across all team members and CI/CD environments; ignoring it would defeat the purpose of dependency locking.
• B. This is a primary best practice. Committing the lock file ensures that everyone working on a project uses the exact same version of providers and verified checksums, preventing unexpected changes or inconsistencies between environments.
• C. Terraform automatically generates or updates this file during the `terraform init` process. It records the specific provider versions selected and cryptographic checksums for all relevant platforms to ensure repeatable installations.
• D. The lock file is managed by Terraform and does not require manual editing. Updates are typically performed using the `terraform init -upgrade` command. Manual editing is discouraged as it can introduce errors or break checksum verification.
• E. The lock file specifically tracks provider dependencies. The required version of the Terraform CLI itself is specified within the `terraform` configuration block using the `required_version` attribute, not in the lock file.

Correct answer: C — terraform graph

• A. The command 'terraform map' does not exist in the Terraform CLI. In Terraform, 'map' is a data type and a collection of functions, not a command used for dependency visualization.
• B. The 'terraform state list' command is used to enumerate resources currently tracked in the state file. While helpful for inspecting what is in the state, it does not provide information about resource dependencies or generate a visual graph.
• C. The 'terraform graph' command generates a visual representation of a configuration or execution plan. It outputs the dependency graph in DOT format, which can then be rendered into an image (such as SVG or PNG) using tools like Graphviz.
• D. There is no '-draw' flag for the 'terraform plan' command. The 'terraform plan' command is strictly used to create and show an execution plan in text format; it does not generate graphical dependency diagrams.

Correct answer: D — object

• A. Incorrect. A string is a primitive scalar type in Terraform's type system, representing a single sequence of Unicode characters. It is not a structural or collection type.
• B. Incorrect. A number is a primitive scalar type used for numeric values. It does not represent a structured or composite data type, as it contains only a single value.
• C. Incorrect. A bool is a primitive scalar type representing logical true or false. Complex structural types, by contrast, can contain multiple named fields or elements.
• D. Correct. An object is a complex structural type in Terraform that groups multiple named attributes, each with its own specific type constraint. Terraform distinguishes between primitive types (string, number, bool), collection types (list, map, set), and structural types (object, tuple).

Correct answers: A, C — Add `depends_on = [aws_iam_role_policy_attachment.example]` to the Lambda function resource.; Use an explicit dependency to force the correct creation order.

• A. Correct. Adding the `depends_on` meta-argument to the Lambda function resource creates an explicit dependency, forcing Terraform to complete the creation of the IAM role policy attachment before initiating the Lambda function creation.
• B. Incorrect. Co-location within the same module does not create a dependency. Terraform only establishes order through implicit dependencies (attribute references) or explicit dependencies (`depends_on`).
• C. Correct. When an implicit dependency (an attribute reference) does not exist between two resources, you must use an explicit dependency (via the `depends_on` meta-argument) to force a specific creation order.
• D. Incorrect. This would make the policy attachment depend on the Lambda function, meaning the Lambda would be created first. This is the opposite of the desired behavior and could lead to execution errors if the Lambda requires those permissions immediately.
• E. Incorrect. Referencing the Lambda ARN inside the policy attachment would create an implicit dependency where the attachment depends on the Lambda. This would result in the Lambda being created before the attachment, which fails to meet the requirement.

Correct answer: C — To check for a specific condition before a resource is created, updated, or destroyed.

• A. This describes a postcondition block, which verifies results after a resource action has taken place. Preconditions are evaluated before the action occurs.
• B. Validating input variable values is handled by validation blocks within the variable definition itself, not by precondition blocks within a resource lifecycle.
• C. Precondition blocks are used within the lifecycle block of a resource or data source to ensure specific criteria are met before Terraform performs a create, update, or destroy operation. If the condition evaluates to false, Terraform halts the operation for that resource.
• D. This describes the 'check' block feature, which runs independently of specific resource lifecycles. Preconditions are explicitly tied to the lifecycle of the resource or data source in which they are defined.

Correct answer: C — Terraform returns an error stating that the data source could not be found or matched.

• A. Data blocks are strictly read-only and used for fetching information. Unlike resource blocks, they do not manage the lifecycle of infrastructure and cannot automatically create missing resources.
• B. Terraform cannot silently ignore a failed data lookup because subsequent resources often depend on the attributes provided by that data source. If the lookup fails, Terraform cannot resolve the dependency graph, leading to a failure rather than continuation.
• C. If a data source cannot find or match the requested resource, the provider returns an error. Since the data block is required to satisfy configuration dependencies, Terraform will report this error and fail the plan unless a fallback mechanism is specifically implemented.
• D. While Terraform can prompt for interactive input for variables, it does not support interactive prompts for provider-level data lookups. If the external API call fails to find the resource, it results in an execution error.

Correct answers: C, D — object; tuple

• A. Incorrect. A list is a collection type, not a structural type. It represents an ordered, homogeneous sequence of values where every element must be of the same type.
• B. Incorrect. A map is a collection type used to represent an unordered set of key/value pairs with homogeneous value types. It is not a structural type, as it doesn't define a fixed shape for heterogeneous data.
• C. Correct. An object is a structural type in Terraform. It defines named attributes, each with its own specific type, allowing for the creation of complex, heterogeneous schemas that describe the shape of a value.
• D. Correct. A tuple is a structural type representing a fixed-length sequence of elements where each element can have a different type. Unlike a list, its structure is defined by the specific types at each position.
• E. Incorrect. A set is a collection type. It represents an unordered collection of unique values that must all share the same homogeneous element type.

Correct answer: B — cidrsubnet("10.0.0.0/16", 8, 0)

• A. The cidrhost function is used to calculate a specific IP address within a given CIDR block by adding an integer offset. It returns a single host IP (e.g., 10.0.0.8), not a subnet range.
• B. Correct. The cidrsubnet function is specifically designed to calculate a subnet address within a given CIDR prefix. The parameters used here (base prefix, 8 additional bits, and index 0) correctly extend the /16 to a /24 and select the first available subnet (10.0.0.0/24).
• C. There is no built-in Terraform function called subnetcalc. Subnet math is handled primarily by cidrsubnet.
• D. ipsubnet is not a valid Terraform built-in function. This name does not exist in Terraform's standard function set; cidrsubnet is the correct choice for this task.

Correct answers: A, C — Configure the Vault provider block with the Vault server address and a valid authentication token.; Use a Vault data source, such as `vault_generic_secret` or `vault_database_credentials`, to fetch the credentials.

• A. Correct. To interact with Vault, the provider must be configured with the server address and a valid authentication method (such as a token, AppRole, or IAM). This allows Terraform to authenticate and communicate with the Vault API.
• B. Incorrect. The `vault_generic_secret` resource is used to manage (create/update) static secrets. For dynamic database credentials, you are fetching secrets generated by the database secrets engine, not creating new ones.
• C. Correct. Terraform data sources are used to fetch information from external systems. To retrieve dynamic credentials, you would use a data source like `vault_database_credentials` (specifically for DB engines) or `vault_generic_secret` (for reading paths) at plan/apply time.
• D. Incorrect. There is no `sensitive = false` setting on the Vault provider block. While individual variables or outputs can be marked as sensitive, this does not control whether Terraform can read the credentials.
• E. Incorrect. Storing a Vault root token in the Terraform state file is a major security risk and violates best practices. You should use appropriate, less-privileged auth methods and avoid persisting sensitive tokens in the state.

Correct answer: B — Terraform can use any version that is 1.2.0 or higher, but strictly less than 2.0.0.

• A. This interpretation is incorrect. The constraint defines a continuous range of valid versions, not just two specific versions. Furthermore, the operator '< 2.0.0' explicitly excludes version 2.0.0 from the range.
• B. Correct. The syntax specifies a version range where multiple conditions must be met (the comma acts as a logical AND). It allows any module version that is greater than or equal to 1.2.0 but strictly less than 2.0.0, permitting minor and patch updates within the 1.x series while preventing breaking changes from a 2.0.0 major version upgrade.
• C. Incorrect. A specific version pin would be written as `version = "1.2.0"`. Using comparison operators indicates that Terraform is allowed to select any version that falls within the specified range.
• D. Incorrect. Terraform strictly enforces version constraints. While it will typically attempt to download the newest version available, it will only do so if that version satisfies all conditions in the constraint range.

Correct answers: A, B — version = "~> 1.2"; version = ">= 1.2.0, < 2.0.0"

• A. Correct. The pessimistic constraint operator (`~>`) allows only the rightmost specified digit to increment. By specifying `~> 1.2`, you allow the minor version (and patch versions) to increase, but prevent the major version from changing to 2.0.0. This is because it is equivalent to `>= 1.2.0, < 2.0.0`.
• B. Correct. This explicit range allows any version starting from 1.2.0 up to, but not including, 2.0.0. This correctly allows both minor updates (like 1.3.0) and patch updates (like 1.2.4) while strictly blocking major version upgrades.
• C. Incorrect. The constraint `~> 1.2.0` only allows the rightmost digit (the patch version) to increment. It would allow 1.2.4 but would block 1.3.0, as it is equivalent to `>= 1.2.0, < 1.3.0`.
• D. Incorrect. Wildcard syntax like `1.x` is not a standard or portable Terraform version constraint. Terraform requires comparison operators or the pessimistic constraint operator for semver ranges.
• E. Incorrect. The range `>= 1.2.0, <= 2.0.0` allows version 2.0.0 to be used. The requirement explicitly stated that version 2.0.0 should not be allowed.

Correct answer: A — source = "github.com/hashicorp/example//vpc"

• A. Correct. Terraform uses a special double-slash (`//`) syntax to separate the repository address from the internal directory path. This tells Terraform to fetch the entire repository but then use the specified subdirectory as the module root.
• B. Incorrect. Using a single slash would lead Terraform to interpret the entire string as the repository address. The double-slash is required to explicitly mark where the repository path ends and the subdirectory within that repository begins.
• C. Incorrect. Terraform does not recognize a `?dir=` query parameter for selecting subdirectories. While query parameters like `?ref=` are used to specify branches or tags, subdirectories must be specified using the `//` delimiter.
• D. Incorrect. The hash (#) fragment syntax is not used for subdirectory paths in Terraform module sources. Terraform specifically looks for the double-slash (`//`) to identify paths inside a fetched repository.

Correct answer: B — Run the command with the `-lock-timeout=60s` flag.

• A. The top-level `terraform` block in configuration is used for setting provider requirements, the required Terraform version, and backend configuration. It does not support a `lock_timeout` attribute to control CLI lock behavior.
• B. The `-lock-timeout` flag is a standard CLI option for commands that require a state lock (like `plan`, `apply`, and `destroy`). Setting `-lock-timeout=60s` tells Terraform to retry acquiring the lock for up to 60 seconds before failing with an error.
• C. Environment variables starting with `TF_VAR_` are exclusively used to assign values to input variables defined in your HCL code. They cannot be used to pass command-line flags or configure core CLI behaviors like locking.
• D. Terraform does not have a `wait` command. While you could implement external logic in a shell script, the native way to handle lock contention is via the `-lock-timeout` flag.

Correct answer: B — In the `.terraform/terraform.tfstate` file within the project directory.

• A. Incorrect. The top-level `terraform.tfstate` file in the project root is the default local state file. When a remote backend is used, the infrastructure state is stored remotely, and this local file is not used to store backend connection metadata.
• B. Correct. When you initialize a remote backend, Terraform records the backend configuration and metadata in a local file located at `.terraform/terraform.tfstate`. This file acts as a pointer or cache so the Terraform CLI knows which remote backend to communicate with for future commands, even though the actual infrastructure state remains remote.
• C. Incorrect. While you can use environment variables or the `-backend-config` flag to provide settings during the initialization process, Terraform does not persist or store the finalized backend details in an environment variable named `TF_BACKEND_CONFIG`.
• D. Incorrect. The `.terraform.lock.hcl` file is the dependency lock file. Its purpose is to track provider versions and their checksums to ensure configuration consistency across different environments, not to store backend connection strings.

Correct answers: A, C — Terraform will refresh the state and detect that the security group is missing.; Terraform will propose a plan to recreate the missing security group to match the configuration.

• A. Correct. By default, `terraform plan` performs a refresh step. This compares the current state of infrastructure with the state file and the remote provider. During this process, Terraform will detect that the security group no longer exists in the cloud provider.
• B. Incorrect. Terraform does not modify your configuration files (.tf files) during a plan or refresh. The configuration is the user-defined desired state and must be manually updated by a human.
• C. Correct. Terraform's primary objective is to make the real-world infrastructure match the configuration. Since the resource is defined in code but missing in reality, the execution plan will include an action to create the security group to restore the desired state.
• D. Incorrect. Terraform is designed to handle drift automatically. It will not halt or throw an error simply because a resource was deleted; instead, it provides a path to remediation via the plan output.
• E. Incorrect. Terraform generally aims to fix the missing dependency by recreating it. While dependent resources might require updates or replacement if the recreation of the security group results in a new ID that they reference, the plan does not default to destroying all dependent resources.

Correct answer: A — TRACE

• A. TRACE is the most verbose log level available in Terraform. It captures low-level details, including the exact raw HTTP request and response payloads exchanged between Terraform providers and cloud APIs. This level is essential for troubleshooting specific API-related failures like a 500 Internal Server Error where the payload contents are needed.
• B. DEBUG provides internal logs useful for troubleshooting Terraform's internal logic and plugin behavior, but it typically lacks the detailed raw HTTP request/response bodies provided by the TRACE level.
• C. INFO shows high-level informational messages about Terraform's operations and execution progress. It does not include the detailed request/response data or raw API payloads needed for protocol-level debugging.
• D. WARN restricts output to warnings and error messages. It suppresses the detailed informational and trace messages required to see the specific API requests being sent to the provider.

Correct answer: B — terraform import azurerm_virtual_network.main <vnet-resource-id>

• A. Incorrect. The `terraform state push` command is used to manually upload a local state file to a remote backend. It is not used for importing infrastructure and can be dangerous as it may overwrite remote state without safety checks.
• B. Correct. The `terraform import` command is specifically designed to bring existing infrastructure under Terraform's management. It maps an existing resource (identified by its provider-specific ID) to a defined resource address in your configuration, populating the state file without recreating the resource.
• C. Incorrect. The `terraform state mv` command is used to rename resource addresses within the state file (refactoring). It requires the resource to already be managed by Terraform and present in the state; it cannot fetch external resources by ID.
• D. Incorrect. The `terraform apply -target` command restricts an apply operation to a specific resource address. It does not perform imports. If the resource is not in the state, Terraform will attempt to create it, which would likely result in an 'AlreadyExists' error from Azure.

Correct answers: A, B — Write an empty `resource "azurerm_virtual_network" "vnet1" {}` block in the configuration before running the command.; Use the `import` block instead and run `terraform plan -generate-config-out=vnet.tf`.

• A. Correct. When using the standard `terraform import` CLI command, Terraform requires a matching resource block to already exist in your .tf files. Creating a stub or empty resource block with the correct type and local name allows Terraform to map the imported state to a configuration address.
• B. Correct. Introduced in Terraform v1.5, the declarative `import` block allows you to specify imports in HCL. When used with the `terraform plan -generate-config-out` flag, Terraform will automatically generate the required configuration for the imported resource, resolving the issue of the resource not existing in config.
• C. Incorrect. `terraform init -upgrade` is used to update provider versions and initialize the backend; it does not create or detect missing resource blocks in your configuration.
• D. Incorrect. There is no `-force` flag for the `terraform import` command that allows it to skip the requirement of having a corresponding resource block in the configuration.
• E. Incorrect. Manually editing the state file is not a recommended practice and can lead to state corruption. Furthermore, adding an entry to the state file does not resolve the error of the resource address being missing from the HCL configuration code.

Correct answers: B, C — To group related workspaces together for better organization and visibility.; To apply a common set of variables and policies to multiple workspaces.

• A. Incorrect. Projects in HCP Terraform are organizational and governance constructs, not execution mechanisms; they do not trigger or perform infrastructure provisioning on their own or bypass the `terraform apply` command.
• B. Correct. Projects are designed to group related workspaces together, making it easier for teams to organize, manage, browse, and report on sets of workspaces with a common purpose or belonging to a specific team or department.
• C. Correct. Projects enable more efficient governance at scale by allowing administrators to associate variable sets and policy sets with a specific project. This ensures that a common set of variables and compliance rules are applied automatically to all workspaces within that project.
• D. Incorrect. Projects do not replace the need for version control systems (VCS) like Git. VCS integrations remain the primary method for managing code history, triggers, and collaboration on Terraform configurations.
• E. Incorrect. Projects do not change state storage mechanics; HCP Terraform manages state files remotely to ensure security, locking, and collaboration. Storing state files locally on a user's machine is not a benefit or feature of using Projects.

Correct answer: C — The plan executes on an HCP Terraform worker, and the plan file is stored within the HCP Terraform run.

• A. Incorrect. This describes a standard local execution using a local backend. When using the `remote` backend, the execution is offloaded to HCP Terraform.
• B. Incorrect. While HCP Terraform supports a 'Local' execution mode where state is remote but execution is local, the default and primary purpose of the `remote` backend is to perform remote runs where execution happens on HCP Terraform infrastructure.
• C. Correct. Using the `remote` backend (or the newer `cloud` block) triggers remote execution by default. Terraform CLI uploads the configuration to HCP Terraform, where a worker executes the plan. The resulting plan artifact is stored within the HCP Terraform run context, though the logs are streamed back to the local terminal.
• D. Incorrect. Although the plan executes on an HCP Terraform worker, the plan file itself is not automatically downloaded to the user's local filesystem. It is maintained within the HCP Terraform platform for audit and application purposes.

Correct answer: B — A global Variable Set.

• A. Incorrect. A shared Terraform module is used to share reusable infrastructure configuration code across workspaces. It does not provide a mechanism for centrally managing or distributing provider credentials; credentials would still need to be provided to the module within each specific workspace.
• B. Correct. Variable Sets in HCP Terraform allow you to group variables (Terraform variables or environment variables like AWS_ACCESS_KEY_ID) and apply them to multiple workspaces or the entire organization. This centralizes credential management, ensures consistency, and avoids the need to manually duplicate credentials in every workspace.
• C. Incorrect. A remote backend configuration block defines where Terraform stores and locks its state files. It is not designed to manage or distribute provider-specific authentication credentials across multiple workspaces.
• D. Incorrect. Using a terraform.tfvars file in each workspace repository requires manual duplication of the credentials, which contradicts the goal of the question. Additionally, storing sensitive credentials in plain-text files within version control is a major security risk.

Correct answer: C — Terraform packages the configuration directory, uploads it to HCP Terraform, and triggers a remote run which executes the plan on an HCP Terraform worker.

• A. Incorrect. When a workspace is configured for remote execution, the Terraform CLI does not perform a local plan. Instead, it initiates a remote run where the logic and state comparison happen on HCP Terraform infrastructure.
• B. Incorrect. Terraform does not generate an authoritative plan file locally and then upload it. In remote execution mode, the source configuration is uploaded first, and the plan file is generated server-side by the HCP Terraform worker.
• C. Correct. In remote execution mode, the local CLI acts as a client. Running `terraform plan` packages the configuration (including subdirectories), uploads the bundle to HCP Terraform, and triggers a remote run. The plan is then executed on a remote worker, with the output streamed back to the user's terminal.
• D. Incorrect. The Terraform CLI is specifically designed to support remote operations. You do not need to use the UI to trigger a plan; the CLI provides a seamless experience for initiating remote runs from a local development environment.