Providers and Terraform Fundamentals — Terraform Associate 004 practice questions

Conceptually, what is the primary job of Terraform state?

1. To store a full history of every apply so that any earlier configuration can be restored
2. To bind each resource address to the real remote object it represents
3. To hold the values of input variables between runs so they need not be supplied again
4. To queue pending changes until an operator approves them in a later apply

Answer: B — To bind each resource address to the real remote object it represents

B) Correct — state is fundamentally the mapping from configuration addresses to real-world object identities, plus recorded attributes and metadata. A) overstates it: state is a current snapshot with at most a single local backup, not a change history. C) is a persistent misconception; variable values come from files, flags, environment or prompts on each run. D) describes a queued or gated run in a collaboration platform, not the role of the state file.

A reviewer sees a `required_providers` block in a colleague's configuration and asks where it legally belongs. The correct answer is that it must appear:

1. At the top level of the file, as a sibling of the resource, variable and provider blocks
2. Inside each `provider` block, so the version travels with its configuration
3. Inside a `backend` block, alongside the other initialisation-time settings
4. Nested inside the `terraform` block, which is where provider requirements are declared

Answer: D — Nested inside the `terraform` block, which is where provider requirements are declared

D) Correct — `required_providers` is a nested block of the `terraform` settings block. A) is the most common authoring error; a top-level `required_providers` is not valid. B) confuses requirements with configuration: the `provider` block holds settings such as region and credentials, not source and version. C) is wrong on both counts — `backend` configures state storage and is itself nested in the `terraform` block.

A colleague asks what `.terraform.lock.hcl` is actually for. The MOST accurate description is that it:

1. Records the exact provider versions selected and their checksums so later runs resolve identically
2. Prevents two engineers from running apply against the same state at the same time
3. Stores the resolved values of input variables so that plan and apply cannot disagree
4. Caches the last plan so that apply can be executed without recomputing the diff

Answer: A — Records the exact provider versions selected and their checksums so later runs resolve identically

A) Correct — the dependency lock file pins the selected provider versions together with verification hashes, making dependency resolution reproducible. B) describes state locking, an entirely different mechanism provided by the backend. C) confuses the lock file with a saved plan file, which is what captures resolved values. D) also describes a saved plan file produced by `plan -out`.

A configuration pins a provider with `version = "~> 4.16"`. Which set of releases satisfies this constraint?

1. Any 4.x release at or above 4.16, but nothing in the 5.x series
2. Only patch releases within 4.16, such as 4.16.1 and 4.16.2
3. Any release at or above 4.16, including 5.0 and later major versions
4. Exactly version 4.16.0 and no other release at all

Answer: A — Any 4.x release at or above 4.16, but nothing in the 5.x series

A) Correct — the pessimistic operator allows the rightmost specified component to increment, so `~> 4.16` permits 4.16 up to but excluding 5.0. B) is the meaning of `~> 4.16.0`, a near-twin constraint with one more component specified. C) describes `>= 4.16`, which deliberately allows major upgrades. D) describes `= 4.16.0`, an exact pin.

A team is evaluating a provider on the public registry and notices providers carry different tier labels. Which statement about those tiers is correct?

1. Community providers cannot be installed from the public registry, and must come from a private filesystem mirror
2. Official providers are published and maintained by HashiCorp, while partner providers are maintained by the technology vendor
3. Partner providers are HashiCorp-maintained forks of community code that the technology vendor has endorsed
4. The tier label determines which version constraint operators the provider is willing to accept at init time

Answer: B — Official providers are published and maintained by HashiCorp, while partner providers are maintained by the technology vendor

B) Correct — the tiers distinguish who owns and maintains the code: HashiCorp for official, the vendor for partner, and individuals or groups for community. A) is false: community providers install from the public registry like any other. C) inverts the partner relationship — partner providers are vendor-owned, not HashiCorp forks. D) invents a link between tier and constraint syntax; version constraints work identically for every provider.

What is a Terraform 'provider'?

1. A reusable bundle of configuration called from the root module with a source argument
2. An editor integration that validates HCL and offers completion while you write resources
3. The storage location, local or remote, where Terraform persists the state of the resources
4. A plugin that talks to a specific API, turning configuration into calls on that service
5. A named alias for an alternate state file used to run one configuration several times

Answer: D — A plugin that talks to a specific API, turning configuration into calls on that service

D is right: providers are plugins that implement resource and data source types and translate configuration into API calls; they are declared in required_providers and installed by init. A is a module, B is tooling, C is a backend and E is a workspace - all distinct from the plugin layer that actually reaches the platform.

Which block declares a dependency on an external API plugin in Terraform?

1. resource
2. module
3. provider
4. output

Answer: C — provider

Trick: this is the off-by-one block keyword archetype. A 'provider' block configures a plugin (region, credentials). 'resource' declares a managed object; 'module' calls a reusable group; 'output' exposes values.

In the expression provider = aws.west, what is 'aws.west'?

1. A resource of type 'aws' whose local name inside this configuration is west
2. A module named west that exports an aws provider for its callers to consume
3. A reference to the aws provider configuration carrying the alias 'west'
4. A workspace named west that scopes the run to the us-west state partition

Answer: C — A reference to the aws provider configuration carrying the alias 'west'

C is right: the meta-argument selects which provider configuration a resource or module uses, and the part after the dot is the alias declared on a second provider block. A reads it as a resource address, which uses the same dotted shape and is the natural misread. B invents a module output of a provider. D confuses provider selection with workspaces. Omit the argument and the resource takes the default, unaliased configuration for its type.

A configuration has one `provider "aws"` block with no alias and one with `alias = "dr"`. A resource omits the `provider` meta-argument entirely. Which provider instance configures it?

1. Neither — omitting the meta-argument is an error once any alias exists in the configuration
2. The block without an alias, which is the default instance for that provider
3. The aliased block, because an explicitly named instance takes precedence over an unnamed one
4. Whichever block appears first in the file, since provider selection follows declaration order

Answer: B — The block without an alias, which is the default instance for that provider

B) Correct — the block without `alias` is the default configuration, used by every resource of that provider that does not select otherwise. A) is a common worry but false; defining aliases does not make the meta-argument mandatory elsewhere. C) reverses the precedence rule — aliased instances are opt-in only. D) invokes file ordering, which never determines behaviour in Terraform; the language is declarative and order-independent.

What does the constraint `version = ">= 3.0, < 4.0"` instruct Terraform to do?

1. Prefer 3.0 but fall back to a 4.x release if no 3.x release is available in the registry
2. Accept any release that satisfies both conditions, so 3.x releases only, excluding 4.0 itself
3. Accept either the 3.x series or the 4.x series, since the two listed conditions are alternatives
4. Install 3.0 and 4.0 side by side so that resources may reference whichever they need

Answer: B — Accept any release that satisfies both conditions, so 3.x releases only, excluding 4.0 itself

B) Correct — comma-separated constraints are combined with AND, so the allowed window is 3.0 up to but not including 4.0. A) invents fallback behaviour; an unsatisfiable constraint is an error, not a downgrade to something outside the range. C) reads the comma as OR, a frequent misreading. D) is impossible: exactly one version of a given provider is selected per configuration.

A configuration must create resources in two AWS regions. Explain the mechanism, and say what happens to a resource that omits the provider meta-argument.

You declare a default aws provider block for the first region and a second aws provider block with an alias for the other region, then point specific resources at the alias with provider = aws.<alias>. Any resource that omits the provider meta-argument uses the default, unaliased configuration for that provider type. Aliases are not inherited automatically by child modules — a module must declare the alias in its own configuration_aliases and be passed the provider explicitly.

What does the required_providers block declare, and inside which top-level block does it live?

It declares each provider the configuration needs, giving a local name mapped to a source address and a version constraint. It lives inside the top-level terraform block, for example: terraform { required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } }.

Multiple instances of provider?

Use alias. Example: provider "aws" { alias = "west" region = "us-west-2" }.

Name the Terraform version constraint operators and what each one means.

= or bare version means exactly that version • != excludes a version • > , >= , < , <= compare • ~> is the pessimistic constraint operator, allowing the rightmost specified component to increment only. Multiple constraints can be combined with commas and all must be satisfied.