200+ Free Terraform Professional Practice Questions

Pass your HashiCorp Terraform Authoring and Operations Professional exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

200+ Questions

100% Free

1 / 200

Question 1

Score: 0/0

An AWS IAM role named app-prod-role was created manually before Terraform was adopted. After adding an aws_iam_role resource block, what is the safest next step if you want Terraform to manage the existing role without recreating it?

Run terraform import for the resource address and existing role name

Run terraform taint so Terraform refreshes the object

Run terraform apply -replace on the resource

Delete the role manually and let Terraform recreate it

to track

2026 Statistics

Key Facts: Terraform Professional Exam

Official Domains

HashiCorp

4 hrs

Duration

HashiCorp

$295

Exam Fee

HashiCorp

AWS

Current Lab Cloud

HashiCorp

48 hrs

Results ETA

HashiCorp

2 years

Credential Valid

HashiCorp

As of March 9, 2026, HashiCorp officially publishes six Terraform Professional objective groups, but it does not publish domain percentage weights, a fixed question count, or the passing threshold. The exam is online proctored through Certiverse, lasts 4 hours with a 15-minute break, costs $295 USD, includes one free retake after a failed attempt, and the credential remains valid for 2 years. Recent 2026 changes are administrative rather than blueprint-based: updated appointment rules, refreshed scheduling guidance, and updated recertification/retake knowledge-base articles.

Sample Terraform Professional Practice Questions

Try these sample questions to test your Terraform Professional exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 200+ question experience with AI tutoring.

1An AWS IAM role named app-prod-role was created manually before Terraform was adopted. After adding an aws_iam_role resource block, what is the safest next step if you want Terraform to manage the existing role without recreating it?

A.Run terraform import for the resource address and existing role name

B.Run terraform taint so Terraform refreshes the object

C.Run terraform apply -replace on the resource

D.Delete the role manually and let Terraform recreate it

Explanation: Importing associates the existing AWS object with the resource address in Terraform state. That lets Terraform begin managing the role without forcing a delete and recreate cycle.

2During an operations review, you need to see only drift between Terraform state and the real AWS environment without proposing configuration changes. Which command is most appropriate?

A.terraform validate

B.terraform plan -refresh-only

C.terraform apply -refresh-only

D.terraform state list

Explanation: The refresh-only planning mode compares recorded state with real infrastructure and shows the differences. It avoids mixing drift detection with pending configuration edits from the working directory.

3A production RDS instance must never be destroyed by a normal Terraform apply, even if someone removes its resource block or makes a change that would force replacement. Which lifecycle setting best enforces this?

A.create_before_destroy = true

B.ignore_changes = all

C.prevent_destroy = true

D.replace_triggered_by = [var.engine_version]

Explanation: The prevent_destroy lifecycle rule causes Terraform to return an error instead of destroying the resource. It is commonly used for high-risk objects such as production databases where deletion needs extra safeguards.

4An EC2 launch template should be replaced whenever a separate aws_ami_copy.gold image resource changes, even if no direct argument in the launch template changes. Which lifecycle argument is designed for this?

A.ignore_changes

B.replace_triggered_by

C.prevent_destroy

D.create_before_destroy

Explanation: replace_triggered_by tells Terraform to force replacement when referenced resources or attributes change. It is useful when the dependency matters operationally but is not represented by a normal argument diff on the resource itself.

5Before decommissioning a short-lived AWS sandbox, you want a reviewable execution plan that shows what Terraform would delete. Which command should you run first?

A.terraform plan -destroy

B.terraform destroy -auto-approve

C.terraform apply -destroy

D.terraform state rm

Explanation: A destroy plan previews the deletions without making any changes yet. That gives reviewers a chance to confirm the scope before anyone runs an actual destroy operation.

6Inside an aws_security_group resource, you need one ingress block for each port in var.allowed_ports. Which Terraform construct should you use?

A.A dynamic block

B.count on the provider block

C.A provisioner block

D.An output block

Explanation: A dynamic block generates repeated nested blocks from a collection. It is the standard way to build repeated ingress or egress stanzas inside a single resource definition.

7You are creating one subnet per Availability Zone from a map like {use1a = "10.0.1.0/24", use1b = "10.0.2.0/24"}. Which approach gives stable resource addresses if one AZ entry is later removed?

A.Use count based on length(var.subnets)

B.Use for_each over the map

C.Add depends_on on the VPC resource

D.Use a dynamic block inside provider "aws"

Explanation: for_each keys each instance by the map key, so removing one entry does not shift the addresses of the others. A count-based approach can cause index churn and unnecessary replacements when the collection changes.

8Your module should discover the current AWS account ID at plan time instead of taking it as a variable. What is the preferred Terraform approach?

A.Use a local value with a hardcoded string

B.Use the aws_caller_identity data source

C.Read the ID from terraform.tfstate manually

D.Use output from a null_resource

Explanation: Data sources let Terraform query external information that already exists outside the current state. aws_caller_identity is the canonical way to retrieve the active AWS account ID for the configured credentials.

9A root module creates child modules with for_each = var.private_subnets, where each child module outputs subnet_id. Which expression best returns a map keyed by the original for_each keys with subnet IDs as values?

A.[for m in module.private_subnet : m.subnet_id]

B.{ for k, m in module.private_subnet : k => m.subnet_id }

C.zipmap(values(module.private_subnet), keys(var.private_subnets))

D.tomap(module.private_subnet.subnet_id)

Explanation: Modules created with for_each behave like a map, so a for expression over key and value preserves the original addressing. A list expression would discard the keys and make the result harder to use in downstream configuration.

10Your platform team defines default tags in local.common_tags, but each application may override specific keys with var.app_tags. Which expression produces the correct merged tag map with app-specific values winning conflicts?

A.concat(local.common_tags, var.app_tags)

B.merge(var.app_tags, local.common_tags)

C.merge(local.common_tags, var.app_tags)

D.setunion(local.common_tags, var.app_tags)

Explanation: The merge function combines maps from left to right, with later arguments overriding earlier keys. Putting var.app_tags last preserves the shared defaults while allowing the application to replace selected values.

About the Terraform Professional Exam

The HashiCorp Terraform Authoring and Operations Professional certification validates advanced, production-level Terraform expertise in configuration authoring and day-two operations. It emphasizes dynamic HCL, state and workflow design, module refactoring, provider management, and HCP Terraform collaboration patterns in an online-proctored exam that combines lab work with multiple-choice questions.

Assessment

Lab-based scenarios + multiple-choice items (official count not publicly disclosed)

Time Limit

4 hours (15-minute break included)

Passing Score

Not publicly disclosed by HashiCorp

Exam Fee

$295 USD (HashiCorp / Certiverse)

Terraform Professional Exam Content Outline

5 topics

Manage Resource Lifecycle

terraform init, plan, apply, destroy, and production-safe state operations such as import, drift reconciliation, and moved blocks

6 topics

Develop and Troubleshoot Dynamic Configuration

Validation, tests and checks, data sources, HCL functions, meta-arguments, complex input/output types, and sensitive data patterns

4 topics

Develop Collaborative Terraform Workflows

Version constraints, dependency lock files, remote state, automation workflows, and sharing data across configurations and workspaces

4 topics

Create, Maintain, and Use Modules

Module creation, consumption, refactoring, versioning, and decomposing larger configurations into reusable modules

4 topics

Configure and Use Terraform Providers

Provider architecture, aliasing, versioning, upgrades, authentication patterns, and troubleshooting provider/plugin issues

4 topics

Use HCP Terraform Collaboratively

Run workflow analysis, workspace design, access management, dynamic credentials, and policy/governance features; this domain is multiple-choice only

How to Pass the Terraform Professional Exam

What You Need to Know

Passing score: Not publicly disclosed by HashiCorp
Assessment: Lab-based scenarios + multiple-choice items (official count not publicly disclosed)
Time limit: 4 hours (15-minute break included)
Exam fee: $295 USD

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

Terraform Professional Study Tips from Top Performers

1Spend most of your time on resource lifecycle and dynamic configuration because those objective groups contain the most official subtopics

2Practice import, moved blocks, drift reconciliation, and safe plan/apply review on AWS-backed Terraform projects

3Refactor flat configurations into modules repeatedly so module boundaries, inputs, outputs, and versioning become automatic

4Drill provider aliases, version constraints, lock files, and credential patterns until you can diagnose provider issues quickly

5Use Linux-based timed practice because the real exam expects terminal fluency in addition to Terraform fluency

6Review HCP Terraform run modes, workspaces, dynamic credentials, and policy enforcement because that domain is still tested even though it is multiple-choice only

Frequently Asked Questions

What is the Terraform Professional exam format?

HashiCorp describes Terraform Professional as an online-proctored assessment that combines lab-based scenarios with multiple-choice questions. In the labs, you work in a pre-provisioned Linux environment and are graded on Terraform configuration, state, and the resulting infrastructure behavior. HashiCorp also says the current exam uses the AWS provider, and that Terraform documentation, limited Terraform Registry access, limited AWS documentation, and the AWS console are available during the exam.

How many questions are on the Terraform Professional exam?

HashiCorp does not publicly publish a fixed item count for the Terraform Authoring and Operations Professional exam. The official certification page only states that the assessment is lab-based plus multiple choice and lasts 4 hours with a 15-minute break. For preparation, focus on the six published objective groups rather than trying to optimize for a public question total that HashiCorp does not disclose.

What is the passing score for Terraform Professional?

HashiCorp does not publicly share the score percentage or scoring threshold for its certification exams. Its exam-results guidance states that candidates receive a pass/fail result and a section-level report, but not the score percentage or cut score. For the Professional exam specifically, HashiCorp says results are emailed within 48 hours after the appointment.

Do you need Terraform Associate before taking Terraform Professional?

No formal prerequisite is required, but HashiCorp lists Terraform Associate certification as recommended. The official orientation page puts more emphasis on extensive production Terraform experience, Linux terminal skills, AWS provider familiarity, cloud credential handling, advanced configuration authoring, and deep workflow knowledge. In practice, most successful candidates already operate Terraform in production rather than studying purely from scratch.

What changed for the Terraform Professional exam in 2026?

As of March 9, 2026, I did not find an official 2026 objective-blueprint revision or new domain weighting announcement for Terraform Professional. The meaningful 2026 updates are operational: HashiCorp refreshed its appointment rules and requirements guidance, scheduling instructions, and recertification/retake knowledge-base articles. Those updates emphasize the GitHub-linked Certification Portal, Certiverse delivery, exact ID-name matching, a one-monitor rule, the 24-hour reschedule/cancel cutoff, and accommodation requests at least 3 business days in advance.

What resources can you use during the exam?

HashiCorp says candidates can access Terraform documentation, limited Terraform Registry access, limited AWS documentation, and the AWS console during the Terraform Professional exam. The orientation page also explicitly says external search engines and other websites are not available. That means speed with Terraform docs navigation matters, especially for provider arguments, HCL syntax edge cases, and HCP Terraform workflow details.

What are the most important Terraform Professional study areas?

The broadest objective coverage is in resource lifecycle management and dynamic configuration, followed by collaborative workflows, modules, providers, and HCP Terraform. The most common failure points are import/drift reconciliation, module refactoring, provider aliasing and authentication, lock-file and version-constraint reasoning, and HCP Terraform governance patterns. Treat this as a production-practice exam: timed lab work matters more than memorizing trivia.