HashiCorp Certified: Terraform Associate (004) Quick Review

This Quick Review is an IT Mastery study companion for candidates preparing for the HashiCorp Certified: Terraform Associate (004) exam from HashiCorp, exam code 004. Use it to refresh high-yield Terraform concepts before moving into topic drills, mock exams, original practice questions, and detailed explanations.

High-yield exam mindset

The Terraform Associate exam rewards practical understanding more than memorization. You should be able to look at a small Terraform configuration, predict what Terraform will do, choose the correct CLI command, and identify how state, providers, variables, modules, and HCP Terraform fit together.

What to prioritize first

Terraform’s purpose in one page

Terraform is an infrastructure as code tool. You write declarative configuration that describes desired infrastructure, and Terraform uses provider plugins to interact with external APIs.

Terraform is commonly compared with configuration management tools. The key distinction: Terraform primarily manages infrastructure lifecycle through APIs. It is not a continuous configuration enforcement agent by default.

Core Terraform workflow

    flowchart LR
	    A[Write configuration] --> B[terraform fmt]
	    B --> C[terraform init]
	    C --> D[terraform validate]
	    D --> E[terraform plan]
	    E --> F{Review changes}
	    F -->|Accept| G[terraform apply]
	    F -->|Revise| A
	    G --> H[State updated]

Essential CLI commands

Saved plan decision rule

Use a saved plan when you need to guarantee that the reviewed plan is the exact plan applied:

1. Run terraform plan -out=tfplan.
2. Review the saved plan.
3. Run terraform apply tfplan.

If you run terraform apply without the saved plan file, Terraform performs a fresh plan.

Terraform configuration structure

Terraform configuration is written in the Terraform language, commonly stored in .tf files.

Blocks, arguments, and expressions

A common exam-style mistake is confusing the syntax elements.

Example resource address pattern:

resource_type.local_name.attribute

For a resource declared as resource "aws_instance" "web", the address is aws_instance.web.

Providers

Providers are plugins Terraform uses to interact with APIs. HashiCorp Terraform downloads required providers during terraform init based on configuration and dependency lock selections.

Provider requirements vs provider configuration

High-yield distinction:

• required_providers says which provider and acceptable versions.
• provider blocks say how to configure provider instances.

Provider version constraints

Common trap: terraform init -upgrade can select newer provider versions allowed by constraints. Normal initialization respects the lock file unless changes require selection.

Provider aliases

Provider aliases let one configuration use multiple instances of the same provider, such as multiple regions or accounts.

Trap: Defining an aliased provider does not automatically make every resource use it. A resource or module must be associated with the correct provider instance.

Resources and data sources

Resource vs data source

Decision rule:

• Use a resource when Terraform should own lifecycle.
• Use a data source when Terraform should only look something up.

Resource actions in a plan

Terraform plans use action symbols. Know what they imply.

Replacement can occur when an argument cannot be updated in place according to provider behavior.

Variables, locals, and outputs

Input variables

Variables parameterize modules. Important attributes include:

Common trap: sensitive = true helps with display redaction, but it does not guarantee the value is absent from state.

Local values

Use locals for reusable computed expressions. They are not user inputs and cannot be overridden at runtime.

Outputs

Outputs expose values from the root module or child modules.

Trap: A child module’s internal resources are not directly part of the calling module’s interface. Use outputs to expose needed values.

Type system and expressions

Terraform has primitive, collection, and structural types.

Lists, sets, and maps

Useful expression patterns

Do not overuse dynamic expressions in exam scenarios. Many questions test whether you know the simpler, clearer Terraform construct.

Dependencies and resource graph

Terraform builds a dependency graph from references.

Implicit vs explicit dependencies

Example: If a resource uses aws_vpc.main.id, Terraform knows the VPC must exist first.

Common trap: Adding depends_on everywhere is not a best practice. It can make plans more conservative and harder to understand.

Lifecycle meta-argument

The lifecycle block changes how Terraform handles resource changes.

count and for_each

This is a frequent source of mistakes.

Decision rule:

• Use count for simple optional creation or identical repeated resources.
• Use for_each when each instance has a stable identity.

Common trap: Removing item 1 from a list used with count can shift indexes and cause unintended changes. A map with for_each often avoids that problem.

Modules

A module is a container for Terraform configuration. Every Terraform configuration has a root module. A module called by another module is a child module.

Module basics

Module source examples

Trap: terraform init downloads or installs modules. If you add or change module sources, run terraform init again.

Module input and output decision rule

A child module should not rely on hidden assumptions in the root module. Pass required values as inputs, and expose only needed results as outputs.

Bad exam instinct: trying to directly reference a resource inside a child module from the root module.

Correct pattern: expose a child module output, then reference module.child.output_name.

State

Terraform state is central to how Terraform works. State maps configuration resource addresses to real infrastructure objects and stores metadata needed for planning.

Why state exists

Local vs remote state

High-yield trap: Do not commit local state files to version control. State may contain secrets, IDs, generated passwords, and sensitive metadata.

Backend concepts

A backend defines where Terraform stores state and how operations interact with it.

State commands

Use terraform state commands carefully.

Trap: Removing something from state does not delete the infrastructure. It only makes Terraform stop tracking it at that address.

Drift and refresh

Drift occurs when real infrastructure changes outside Terraform.

Common trap: If someone changes infrastructure manually, Terraform does not magically prevent it. Terraform detects or responds to drift during later operations.

Workspaces

Terraform workspaces allow multiple state instances for the same configuration.

Common traps:

• Workspaces separate state, not code.
• Workspaces are not a universal substitute for separate accounts, projects, directories, or environment-specific architecture.
• The same configuration can behave differently if it uses terraform.workspace in expressions.

Files and directories to recognize

Variable value precedence

For local CLI usage, if the same variable is set in multiple places, later/higher-precedence sources override earlier/lower-precedence sources.

Trap: Variable declarations define the input contract. Variable value files provide values; they do not declare variables.

Provisioners

Provisioners run scripts or commands as part of resource creation or destruction. Terraform supports provisioners such as local-exec and remote-exec.

Exam-safe rule: provisioners are a last resort. Prefer provider-native resources, images, cloud-init, configuration management, or other purpose-built mechanisms when possible.

HCP Terraform review

HCP Terraform is HashiCorp’s managed platform for Terraform collaboration, automation, state, and governance capabilities. Terraform Enterprise provides related capabilities for self-managed enterprise environments.

HCP Terraform capabilities to recognize

Remote execution trap

If Terraform runs remotely, credentials, environment variables, files, and network access must be available to the remote execution environment. Do not assume your local shell environment is available.

Security and sensitive data

Terraform configurations often touch credentials, generated secrets, and infrastructure identifiers.

Common trap: Marking a value sensitive is not encryption by itself. It is primarily a display-handling feature in Terraform.

Common exam traps and corrections

Quick decision tables

Which Terraform construct should you choose?

Which command should you choose?

Practice focus for the question bank

When you move from this Quick Review into IT Mastery practice, spend extra time on scenario questions. The exam often feels like “what should Terraform do next?” rather than “define this word.”

Use topic drills and original practice questions to test:

1. Workflow recognition Identify the correct command for initialization, validation, planning, applying, importing, output inspection, and state inspection.

2. Configuration reading Read small HCL snippets and predict references, dependencies, variable values, and resource addresses.

3. State behavior Decide whether a command changes state, changes infrastructure, both, or neither.

4. Module interfaces Trace inputs into a child module and outputs back to the root module.

5. Provider setup Distinguish provider requirements, provider configuration, aliases, and lock file behavior.

6. HCP Terraform scenarios Recognize when a run happens remotely, where variables must live, and how remote state/collaboration changes the workflow.

7. Common traps Practice questions that contrast resource vs data, count vs for_each, variable vs local, backend vs provider, and local execution vs remote execution.

Final rapid review checklist

Before taking the HashiCorp Certified: Terraform Associate (004) exam, confirm that you can answer these without notes:

• What does each core CLI command do?
• What does terraform init install or configure?
• What is stored in .terraform.lock.hcl?
• How do provider version constraints work?
• How are provider aliases used?
• What is the difference between a resource and a data source?
• Why does Terraform need state?
• Why is remote state useful for teams?
• Why can state be sensitive?
• When should you use for_each instead of count?
• How do modules receive inputs and expose outputs?
• What does depends_on solve, and why should it be used sparingly?
• What does lifecycle change?
• What changes when Terraform runs in HCP Terraform instead of your local shell?
• What does importing infrastructure do — and not do?

Next step: use a question bank with topic drills, original practice questions, mock exams, and detailed explanations to turn this Quick Review into exam-ready decision speed.

Continue in IT Mastery

Use this Quick Review as a final concept map, then move into IT Mastery for focused topic drills, mixed practice sets, timed mock exams, and detailed explanations. The practice questions are original IT Mastery practice items; they are not official HashiCorp questions, copied live-exam content, or exam dumps.