IaC Concepts and Terraform's Purpose — Terraform Associate 004 practice questions

A director claims that adopting Terraform will let the company lift a working AWS configuration onto Azure with no rewriting. Which correction is MOST accurate?

1. Correct in practice, because Terraform normalises equivalent resource types across the major cloud providers
2. Resource blocks remain provider-specific; what carries across is one workflow, language and state model
3. Correct only if every resource is wrapped in a module, which makes the resource types portable
4. Incorrect, because a single Terraform configuration cannot reference more than one cloud provider

Answer: B — Resource blocks remain provider-specific; what carries across is one workflow, language and state model

B) Correct — Terraform is multi-cloud in that one tool, language and workflow spans providers, but each `resource` type belongs to a specific provider and its schema. A) is the classic misconception; there is no cross-cloud normalisation layer. C) is a plausible-sounding partial — modules improve reuse and interfaces but do not change the underlying provider-specific resource types. D) overcorrects: a single configuration can absolutely declare several providers at once.

An operations group provisions each new environment by hand in the cloud console, following a wiki page. Staging and production have quietly diverged. Which advantage of infrastructure as code MOST directly addresses this problem?

1. It removes the need for the group to hold any credentials in the target cloud accounts
2. It guarantees that every provisioning run will complete without any API-level errors
3. It makes the environment definition a versioned artifact, so both environments build from one reviewed source
4. It converts existing console-built resources into code automatically the moment they are created

Answer: C — It makes the environment definition a versioned artifact, so both environments build from one reviewed source

C) Correct — the controlling benefit here is a single, versioned, reviewable definition that both environments are built from, which removes the hand-built divergence. A) tempts because IaC changes how credentials are used, but the tool still needs credentials — it does not eliminate them. B) is a common misconception: IaC makes runs repeatable, not immune to API errors, quota limits or transient failures. D) describes import, which is a deliberate operation you run, not an automatic capture of console activity.

Which is a KEY benefit of Terraform over cloud-specific IaC tools?

1. Provider-agnostic: one workflow spans AWS, Azure, GCP, Kubernetes and thousands more
2. It targets AWS exclusively, so it needs no abstraction layer over other cloud vendor APIs
3. It is free of charge on AWS only, and licensed per resource on every other cloud platform
4. It removes the need to learn any configuration syntax by generating all code automatically
5. It manages virtual machine instances only, leaving networking and identity to other tools

Answer: A — Provider-agnostic: one workflow spans AWS, Azure, GCP, Kubernetes and thousands more

A is right: the plugin-based provider model gives one workflow across many platforms, unlike CloudFormation (AWS-only) or ARM/Bicep (Azure-only). B inverts the point. C invents a licensing model. D is false - you still write HCL. E understates scope: providers cover networking, identity, DNS, SaaS and more.

Management asks how the team would even learn that someone had changed a managed resource outside Terraform. Conceptually, which answer is correct?

1. Terraform emits an alert automatically whenever a managed object is modified outside a run
2. The lock file records object fingerprints and is compared against the provider on every command
3. A run refreshes managed objects from the provider APIs and reports the difference as proposed changes
4. Only a destroy operation reveals such changes, because it is the only command that reads back every managed object

Answer: C — A run refreshes managed objects from the provider APIs and reports the difference as proposed changes

C) Correct — Terraform learns of out-of-band change by reading the current object from the provider during a run and comparing it against state and configuration. A) attributes continuous monitoring to Terraform, which it does not perform; it is a run-time tool. B) confuses the dependency lock file, which pins provider versions and their checksums, with anything about infrastructure objects. D) is off-base: refresh happens during plan and apply too, and destroy is not needed to surface drift.

A firm runs an on-premises virtualisation platform and is expanding into a public cloud. They want one change process covering both. Which characteristic of Terraform makes this hybrid approach practical?

1. On-premises platforms and public clouds are both reached through providers, so one workflow covers both
2. Terraform can manage public cloud resources natively and reaches on-premises systems through provisioners
3. Terraform maintains one state file per cloud vendor, which is what enables hybrid management
4. The on-premises platform must first be fronted by a cloud-hosted gateway that Terraform can address

Answer: A — On-premises platforms and public clouds are both reached through providers, so one workflow covers both

A) Correct — anything with an API can have a provider, so on-premises platforms and public clouds are handled by the same plan/apply workflow. B) is half-right with the caveat wrong: provisioners are a last resort for in-instance actions, not the mechanism for managing on-premises platforms. C) invents a per-vendor state rule; state is per working directory or workspace, and one state can hold objects from many providers. D) fabricates an architectural requirement that does not exist.

What is Infrastructure as Code (IaC)?

1. Building infrastructure by clicking through the provider's web console and noting steps
2. Maintaining written runbooks that describe how to build the environment by hand each time
3. Defining infrastructure in version-controlled code that is reviewable and repeatable
4. Drawing architecture diagrams that generate a bill of materials for the procurement team
5. Racking and cabling physical servers before any software configuration work can begin

Answer: C — Defining infrastructure in version-controlled code that is reviewable and repeatable

C is right: expressing infrastructure as code brings version control, peer review, repeatable delivery and drift detection. A and B are the manual practices IaC displaces, even when carefully documented. D is design output, not an executable definition. E is physical work that says nothing about how the environment is then configured.

A platform team already manages compute with Terraform and now wants to manage DNS records, a monitoring vendor's alerts, and a source-control organisation's repositories in the same pipeline. Which statement BEST describes what makes this possible?

1. Only infrastructure vendors publish providers, so the SaaS services must be handled by separate scripts
2. Terraform can manage SaaS services only when they expose an infrastructure-compatible resource model
3. Terraform's workflow is service-agnostic: any API with a provider can be declared alongside compute
4. Managing SaaS services in Terraform requires that each one be defined in a data block rather than a resource

Answer: C — Terraform's workflow is service-agnostic: any API with a provider can be declared alongside compute

C) Correct — the plan/apply workflow is agnostic to what sits behind the API, so SaaS resources are declared alongside infrastructure. A) is factually wrong: many SaaS vendors publish providers on the public registry. B) invents a qualifying condition that does not exist. D) confuses `data` (read existing information) with `resource` (create and manage a lifecycle) — SaaS objects Terraform owns are resources.

Which statement best describes a declarative IaC tool like Terraform?

1. You write step-by-step procedures and Terraform executes each of them in the given order.
2. You click through the cloud console and Terraform records the actions you performed there.
3. You describe the desired end state and Terraform derives the operations needed to reach it.
4. You write shell scripts calling cloud CLIs and Terraform schedules those scripts in sequence.

Answer: C — You describe the desired end state and Terraform derives the operations needed to reach it.

C is right: you declare what should exist, and Terraform builds a dependency graph, diffs the desired state against the recorded state, and chooses the create, update and destroy operations itself. A is the imperative archetype and tempts because provisioners look procedural. B describes console recording, which Terraform does not do — import is the deliberate equivalent. D is scripting, the very thing declarative IaC replaces.

Which of the following is NOT a benefit of Infrastructure as Code?

1. Infrastructure definitions can be version controlled and reviewed like application code
2. Environments can be reproduced consistently across development, staging and production
3. Running infrastructure is guaranteed never to drift from the committed configuration
4. Proposed infrastructure changes can be reviewed in a plan before they are deployed

Answer: C — Running infrastructure is guaranteed never to drift from the committed configuration

C is right as the non-benefit: drift still happens because people and other automation change resources out of band. IaC narrows the window and gives you the tools to detect it — a refresh-only plan surfaces the difference, and managing drift is an examinable objective — but nothing about writing code prevents someone editing a resource in the console. A, B and D are genuine, routinely cited advantages.

Which statement best contrasts configuration management tools (Ansible, Chef, Puppet) with Terraform?

1. Configuration management provisions the cloud infrastructure; Terraform configures the OS layer.
2. Terraform targets Windows hosts, whereas configuration-management tools target Linux hosts.
3. They are functionally identical, so the choice between them is essentially arbitrary.
4. Configuration management configures software on existing machines; Terraform provisions infra.

Answer: D — Configuration management configures software on existing machines; Terraform provisions infra.

D is right: Terraform creates and manages the infrastructure objects — networks, machines, databases, DNS — while configuration management installs and maintains software on machines that already exist. A is the same sentence with the roles reversed, which is the trap. B invents an operating-system split that neither tool has. C ignores a real division of labour: the two are complementary and are frequently used together.

IaC benefits?

Repeatable, version-controlled, documented, fast deployment, reduced errors.

Describe the format and logistics of the Terraform Associate 004 exam, and state what HashiCorp does NOT publish about it.

It is multiple choice in three question styles — true/false, single-answer, and multiple-answer where the question states how many to pick. It runs 60 minutes, costs $70.50 USD, is delivered online proctored in English with no prerequisites, and the certification is valid for 2 years. HashiCorp publishes neither the question count nor the passing score — the widely repeated 57 questions and 70 percent figures are community folklore, not official.

When did the Terraform Associate 004 exam launch, when did 003 retire, and which Terraform version does 004 test?

004 launched on 8 January 2026 and 003 retired on 7 January 2026. The 004 exam tests Terraform 1.12, a nine-minor jump from the 1.3 baseline that 003 tested.

Terraform Associate exam structure?

Exam 004, launched 8 January 2026, tests Terraform 1.12 and runs 60 minutes, online proctored. HashiCorp publishes neither the question count nor the passing score, so the widely repeated 57 questions and 70% are folklore.