HashiCorp Certified: Terraform Associate (TF-Associate-004) practice questions

A practitioner runs 'terraform apply' in a new directory that contains only 'main.tf', with no 'backend' or 'cloud' block declared. After the apply succeeds, where does Terraform record the resulting state by default?

terraform {
  required_providers {
    local = {
      source = "hashicorp/local"
    }
  }
}
resource "local_file" "note" {
  filename = "${path.module}/note.txt"
  content  = "hello"
}

• AIn a file named 'terraform.tfstate' in the current working directory, using the local backend.check_circle Correct
• BIn HCP Terraform, because any workspace is automatically linked to the remote state service.
• CIn the provider's own datastore, since the 'local' provider manages where state is persisted.
• DNowhere on disk, because state is held only in memory until a backend is added.

Why A is correct: With no backend or cloud block configured, Terraform uses the local backend by default and writes state to 'terraform.tfstate' in the working directory.

Why B is wrong: HCP Terraform is only used when a 'cloud' block is present; without one Terraform never links a workspace to a remote service, so this is wrong.

Why C is wrong: It is tempting to conflate the 'local' provider with the local backend, but providers manage resources and never decide where state is stored.

Why D is wrong: Terraform always persists state after an apply; the default local backend writes it to disk immediately rather than keeping it only in memory.

A team has been provisioning identical staging and production environments by clicking through the cloud console by hand, and the two environments keep ending up subtly different. They decide to define the whole environment once as Terraform configuration and apply it to each environment. Which advantage of IaC most directly addresses their problem?

• AFaster raw provisioning speed, because Terraform always creates cloud resources more quickly than the console does.
• BRepeatability, because applying the same configuration produces the same environment every time it is run.check_circle Correct
• CAutomatic cost reduction, because Terraform selects the cheapest resource sizes on the team's behalf.
• DElimination of the need for any cloud provider credentials during provisioning.

Why A is wrong: Speed can improve, but Terraform is not guaranteed to be faster than the console, and speed is not what fixes environments that differ from each other.

Why B is correct: Defining the environment as code and reapplying it gives a repeatable, reproducible build, which is exactly what removes the subtle differences between the two environments.

Why C is wrong: Terraform provisions whatever sizes the configuration specifies and does not choose cheaper options by itself, so this does not address inconsistency.

Why D is wrong: Terraform still authenticates to the provider with credentials to make changes, so this is factually wrong and unrelated to environment consistency.

A platform team wants every run in an HCP Terraform workspace to be blocked from applying if a proposed AWS security group opens port 22 to the whole internet. They want this enforced automatically as part of the run, before the apply stage. Which HCP Terraform feature should they use?

# proposed change flagged during plan
resource "aws_security_group_rule" "ssh" {
  type        = "ingress"
  from_port   = 22
  to_port     = 22
  protocol    = "tcp"
  cidr_blocks = ["0.0.0.0/0"]
}

• AA policy as code check using Sentinel or OPA, attached to the workspace so it evaluates the plan between the plan and apply stages.check_circle Correct
• BThe cost estimation feature, which inspects the plan and refuses to apply resources that create a security risk.
• CA private module registry constraint that rejects any module publishing a rule with an open CIDR block.
• DA workspace run trigger that fires a downstream workspace to revert the offending rule after the apply completes.

Why A is correct: Sentinel and OPA are HCP Terraform's policy as code engines; a policy set attached to the workspace runs against the plan and can produce a hard-mandatory failure that blocks the apply.

Why B is wrong: Cost estimation is a genuine HCP Terraform feature and runs at a similar point in the run, which makes it tempting, but it only reports projected spend and never blocks a run for a security condition.

Why C is wrong: The private registry hosts and versions shared modules and providers, so it sounds governance related, but it does not evaluate the contents of a plan or enforce rules at run time.

Why D is wrong: Run triggers do chain workspaces together, which feels like automation, but they act after a run finishes and cannot prevent the risky apply from happening in the first place.