HashiCorp Certified: Terraform Professional

An AWS IAM role named app-prod-role was created manually before Terraform was adopted. After adding an aws_iam_role resource block, what is the safest next step if you want Terraform to manage the existing role without recreating it?

• ARun terraform import for the resource address and existing role name
• BRun terraform taint so Terraform refreshes the object
• CRun terraform apply -replace on the resource
• DDelete the role manually and let Terraform recreate it

During an operations review, you need to see only drift between Terraform state and the real AWS environment without proposing configuration changes. Which command is most appropriate?

• Aterraform validate
• Bterraform plan -refresh-only
• Cterraform apply -refresh-only
• Dterraform state list

A production RDS instance must never be destroyed by a normal Terraform apply, even if someone removes its resource block or makes a change that would force replacement. Which lifecycle setting best enforces this?

• Acreate_before_destroy = true
• Bignore_changes = all
• Cprevent_destroy = true
• Dreplace_triggered_by = [var.engine_version]

An EC2 launch template should be replaced whenever a separate aws_ami_copy.gold image resource changes, even if no direct argument in the launch template changes. Which lifecycle argument is designed for this?

• Aignore_changes
• Breplace_triggered_by
• Cprevent_destroy
• Dcreate_before_destroy

Before decommissioning a short-lived AWS sandbox, you want a reviewable execution plan that shows what Terraform would delete. Which command should you run first?

• Aterraform plan -destroy
• Bterraform destroy -auto-approve
• Cterraform apply -destroy
• Dterraform state rm

Inside an aws_security_group resource, you need one ingress block for each port in var.allowed_ports. Which Terraform construct should you use?

• AA dynamic block
• Bcount on the provider block
• CA provisioner block
• DAn output block

You are creating one subnet per Availability Zone from a map like {use1a = "10.0.1.0/24", use1b = "10.0.2.0/24"}. Which approach gives stable resource addresses if one AZ entry is later removed?

• AUse count based on length(var.subnets)
• BUse for_each over the map
• CAdd depends_on on the VPC resource
• DUse a dynamic block inside provider "aws"

Your module should discover the current AWS account ID at plan time instead of taking it as a variable. What is the preferred Terraform approach?

• AUse a local value with a hardcoded string
• BUse the aws_caller_identity data source
• CRead the ID from terraform.tfstate manually
• DUse output from a null_resource

A root module creates child modules with for_each = var.private_subnets, where each child module outputs subnet_id. Which expression best returns a map keyed by the original for_each keys with subnet IDs as values?

• A[for m in module.private_subnet : m.subnet_id]
• B{ for k, m in module.private_subnet : k => m.subnet_id }
• Czipmap(values(module.private_subnet), keys(var.private_subnets))
• Dtomap(module.private_subnet.subnet_id)

Your platform team defines default tags in local.common_tags, but each application may override specific keys with var.app_tags. Which expression produces the correct merged tag map with app-specific values winning conflicts?

• Aconcat(local.common_tags, var.app_tags)
• Bmerge(var.app_tags, local.common_tags)
• Cmerge(local.common_tags, var.app_tags)
• Dsetunion(local.common_tags, var.app_tags)

An input variable named instance_profile must require two attributes, name as string and root_volume_gb as number. Which type constraint is correct?

• Amap(string)
• Btuple([string, number])
• Cobject({ name = string, root_volume_gb = number })
• Dlist(any)

Your team wants provider selections to stay consistent across developer laptops and the CI runner after init. Which Terraform file should be committed to version control?

• Aterraform.tfstate
• B.terraform.lock.hcl
• C.terraform/
• Doverride.tf

A team stores state in an S3 backend and uses a DynamoDB table for locking. What problem does the lock primarily prevent?

• AProviders downloading different versions
• BTwo runs writing state at the same time
• CState files growing too large
• DBackend credentials expiring during plan

In HCP Terraform, a networking workspace must expose only approved outputs such as vpc_id to an application workspace, without giving the application team direct access to the full state snapshot. What is the best approach?

• AUse terraform_remote_state against the networking backend credentials
• BStore the VPC ID in a local variable inside the app workspace
• CPublish the value through the tfe_outputs data source and workspace output sharing contro…
• DCopy the state file into the app repository

In a CI pipeline, reviewers approve a specific Terraform plan before deployment. How do you ensure the exact reviewed actions are what get applied?

• ARun terraform apply with no arguments after approval
• BRun terraform plan -out=tfplan and later terraform apply tfplan
• CRun terraform state pull before terraform apply
• DRun terraform refresh immediately before apply

You are authoring a reusable VPC module and want callers to consume the created private subnet IDs. What should the module define?

• AA local value for private_subnet_ids
• BAn output named private_subnet_ids
• CA provider alias called private_subnet_ids
• DA backend block in the child module

Your internal module registry is releasing a breaking v2 of a popular ECS service module, but existing workloads must stay on the v1 behavior until they are tested. What is the best practice for consumers?

• AOmit the version argument so Terraform picks the newest release
• BPin the module with an explicit version constraint and upgrade intentionally
• CCopy the module code into every root module
• DAdd ignore_changes to the module block

You are moving existing aws_s3_bucket.logs and aws_s3_bucket_policy.logs resources into module.logging in the same configuration. How can you preserve state mappings during the refactor without recreating the resources?

• ARun terraform destroy and then terraform apply after creating the module
• BAdd moved blocks from the old addresses to the new module addresses
• CAdd depends_on to the module block
• DRe-run terraform init with -upgrade

A child module declares configuration_aliases for aws.replica because it creates read replicas in a second region. What must the calling module do?

• ANothing; provider aliases are discovered automatically from the child module
• BDefine only the default aws provider and Terraform will synthesize aws.replica
• CPass the needed provider mappings in the module block's providers argument
• DAdd required_version inside the module call

For an automated Terraform run in CI, what is the recommended way to supply AWS credentials?

• AHardcode access keys in provider blocks committed to Git
• BUse environment variables or an assumed role mechanism outside the configuration
• CPut the keys in outputs so modules can share them
• DStore the keys in the Terraform state file manually

Your root module manages resources in us-east-1 and us-west-2. How should you model the second AWS provider configuration?

• ACreate a second provider block with alias and reference it where needed
• BUse count = 2 on the provider block
• CDefine a local value for the second region and Terraform creates the provider automatical…
• DUse terraform workspace select us-west-2

After a fork, your organization must migrate state references from hashicorp/aws to company/aws for a custom provider distribution. Which command performs this state address migration?

• Aterraform providers mirror
• Bterraform state replace-provider hashicorp/aws company/aws
• Cterraform init -migrate-state
• Dterraform workspace new company-aws

A developer opens a pull request connected to an HCP Terraform VCS-driven workspace and wants to see the impact without changing state. What type of run should be created?

• AA destroy run
• BA speculative plan
• CA state migration run
• DA refresh-only apply

Your HCP Terraform workspace needs AWS access, but security policy forbids long-lived static keys in workspace variables. What is the best solution?

• AAdd AWS keys as sensitive Terraform variables and rotate them manually
• BUse HCP Terraform dynamic provider credentials with AWS workload identity or role trust
• CCommit a shared credentials file to the repository
• DUse local-exec to fetch keys during apply

The platform team wants every HCP Terraform workspace to enforce rules such as mandatory cost-center tags before apply. Which feature should they use?

• AWorkspace tags
• BPolicy sets with Sentinel
• CRun triggers
• DSpeculative plans

Your team clones a Terraform repository that uses an S3 backend and several child modules from the Terraform Registry. Which command should be run first in the working directory?

• Aterraform apply
• Bterraform init
• Cterraform validate
• Dterraform refresh

Production resources may have drifted after a manual console change, but you do not want Terraform to propose configuration-driven updates yet. Which command best updates state and shows only drift-related actions?

• Aterraform plan -refresh-only
• Bterraform plan -destroy
• Cterraform apply -replace=aws_instance.web
• Dterraform state pull

An EC2 instance is unhealthy and must be recreated on the next reviewed deployment, but the rest of the plan should remain unchanged and auditable. Which approach is preferred?

• ARun terraform taint aws_instance.web and let the next apply discover it
• BRun terraform state rm aws_instance.web so Terraform recreates it from scratch
• CRun terraform plan -replace=aws_instance.web -out=tfplan, review the plan, and apply the…
• DDelete the instance manually in the AWS console before running terraform apply

A team needs a fully reviewed teardown of a sandbox stack before deleting anything. Which workflow gives the safest approval path?

• Aterraform destroy -auto-approve
• Bterraform plan -destroy -out=destroy.tfplan, review it, then terraform apply destroy.tfpl…
• Cterraform apply -refresh-only
• DDelete the resources manually in the AWS console and run terraform refresh

You renamed aws_s3_bucket.logs to aws_s3_bucket.audit_logs in configuration and want Terraform to track the new address without destroying the bucket. What should you add?

• Alifecycle { ignore_changes = all }
• BA moved block from the old address to the new address
• Cterraform fmt
• DAn import block

A module should reject any environment variable that is not one of dev, stage, or prod before planning resources. What Terraform feature fits best?

• AVariable validation
• BPostconditions
• Cignore_changes
• Ddepends_on

Your configuration must launch instances into an existing VPC managed outside this workspace. Which construct should read the current VPC ID at plan time without taking ownership of the VPC?

• AA resource block
• BA data source
• CAn output block
• DA moved block

You have var.subnets as a list of objects with attributes name, cidr, and enabled. You need a stable for_each map containing only enabled subnets keyed by name. Which expression is correct?

• A[for s in var.subnets : s.name => s if s.enabled]
• B{ for s in var.subnets : s.name => s if s.enabled }
• Czipmap(var.subnets[*].name, var.subnets[*].enabled)
• Dtoset([for s in var.subnets : s if s.enabled])

You are creating one aws_security_group_rule per CIDR block, and list order may change over time. Which meta-argument is usually safer than count because it keeps resource addresses stable by key?

• Alifecycle
• Bfor_each
• Cprovider
• Ddepends_on

A module input must accept a map of application definitions, where each value includes a required port number and an optional health_check_path string. Which type constraint is the best fit?

• Alist(string)
• Bmap(any)
• Cmap(object({ port = number, health_check_path = optional(string) }))
• Dobject({ apps = string })

Which statement about sensitive = true on a Terraform variable is correct?

• AIt encrypts the value in state automatically
• BIt prevents the value from being sent to providers
• CIt redacts the value in normal CLI output, but you still need secure secret storage and s…
• DIt forces Terraform to read the value from Vault

A CI job should use the exact provider selections already reviewed by the team and fail if the lock file needs to change. Which init option supports that goal?

• A-upgrade
• B-reconfigure
• C-lockfile=readonly
• D-migrate-state

Why is a remote backend preferred over local state for a shared production workspace?

• AIt automatically converts HCL to JSON
• BIt enables shared access and state locking for teams
• CIt removes the need for provider credentials
• DIt prevents infrastructure drift entirely

In CI, you want terraform plan to return one exit code for errors, a different one when there are pending changes, and zero when the plan is empty. Which flag is designed for that workflow?

• A-json
• B-detailed-exitcode
• C-compact-warnings
• D-parallelism=1

A networking stack exports VPC and subnet IDs that an application stack must consume. Which Terraform construct is specifically designed to read outputs from another state snapshot?

• Alocals
• Bterraform_remote_state data source
• Cmoved block
• Dcheck block

When authoring a reusable AWS module, where should provider configuration such as region or account aliases usually live?

• AInside every child module so the module is self-contained
• BOnly in the root module, with the child module exposing inputs and outputs
• CInside outputs.tf so consumers can override it later
• DInside .terraform.lock.hcl

How do you pin a Terraform Registry module to a specific released version?

• ADefine provider "module" with version = "x.y.z"
• BSet version = "x.y.z" inside the module block
• CAdd the module version inside the backend block
• DPut the module version in .terraform-version

You refactored a root-managed security group into module.network.aws_security_group.app, and the real AWS object must not be recreated. What should you add to preserve state mapping in configuration?

• AAn import block for the new address and then manually delete the old address from state
• Bmoved { from = aws_security_group.app to = module.network.aws_security_group.app }
• Clifecycle { create_before_destroy = true }
• Ddepends_on = [module.network]

Three environments repeat nearly identical EC2, IAM, and ALB blocks with only a few variable differences. What refactor best improves maintainability without changing the overall architecture?

• AKeep duplicate resource blocks and add more comments
• BMove the shared pattern into a module and call it with environment-specific inputs
• CReplace the resources with data sources so they are easier to copy
• DPut all repeated values into locals and leave the resource duplication in place

A child module must create Route 53 records in a shared services AWS account while the root module manages compute in the application account. What is the recommended pattern?

• ADefine aliased aws provider configurations in the root module and pass the needed alias t…
• BHardcode access keys for both accounts inside the child module
• CUse two different backends inside the same module
• DDeclare duplicate resource names and let Terraform infer the account

Which AWS provider authentication approach is most appropriate for Terraform automation from a security standpoint?

• AHardcode access_key and secret_key in the provider block
• BCommit a shared credentials file to the repository
• CUse short-lived credentials supplied through environment variables, IAM roles, or dynamic…
• DStore long-lived keys in locals.tf and reference them from the provider

A child module references provider = aws.us_east_1, but Terraform errors that no suitable provider configuration is available. What fix is usually required inside the child module?

• AAdd lifecycle { ignore_changes = [provider] } to the affected resources
• BDeclare the alias in required_providers with configuration_aliases and pass it from the r…
• CMove the provider block into Terraform state
• DRun terraform destroy first so Terraform can rebuild provider metadata