HashiCorp • Terraform-Associate
Validates knowledge of infrastructure as code concepts and the ability to use HashiCorp Terraform in production, covering resource lifecycle management, HCL configuration, providers and modules, state management, and collaborative workflows with HCP Terraform.
Questions
628
Duration
60 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
The HashiCorp Certified: Terraform Associate (004) validates foundational knowledge of infrastructure as code (IaC) using HashiCorp Terraform Community Edition and HCP Terraform. The certification demonstrates that a candidate understands core Terraform concepts including the resource lifecycle, HCL configuration syntax, provider and module usage, state management, and collaborative workflows. Version 004 of the exam covers Terraform 1.12 and introduces updated objectives around lifecycle rules such as `depends_on` and `create_before_destroy`, custom configuration validation conditions, ephemeral values and write-only arguments for sensitive data handling, and HCP Terraform workspace and project organization.
This certification is widely recognized across the cloud and DevOps industry as a benchmark for Terraform proficiency. It is delivered online via Certiverse, proctored remotely, and is valid for two years from the date of passing. Recertification is available by passing the same exam or a higher-level Terraform exam within six months of expiration. The credential includes a digital badge issued through Credly, suitable for sharing on LinkedIn, resumes, and professional profiles.
The Terraform Associate is designed for cloud engineers, DevOps engineers, and infrastructure practitioners who work with or are transitioning into infrastructure automation roles. Candidates are expected to have foundational Terraform skills—either through professional production experience or hands-on work in a personal or demo environment. The exam is appropriate for those in roles such as Cloud Infrastructure Engineer, DevOps Engineer, Site Reliability Engineer, or Platform Engineer who use Terraform to provision and manage cloud or on-premises resources.
Candidates should have basic terminal proficiency and a working understanding of on-premises and cloud architecture. The exam is not intended for complete beginners to cloud infrastructure but is well-suited for those who have completed introductory Terraform tutorials and want to formalize their knowledge with a vendor-recognized credential.
HashiCorp does not mandate formal prerequisites for the Terraform Associate exam, but recommends that candidates possess basic terminal skills and a general understanding of on-premises and cloud architecture prior to sitting the exam. Familiarity with at least one major cloud provider (AWS, Azure, or GCP) and its core services is beneficial, though provider-specific knowledge is explicitly not tested on the exam itself.
Professional experience using Terraform in production is recommended but not required—HashiCorp acknowledges that performing the exam objectives in a personal or demo environment may be sufficient preparation. Candidates should be comfortable reading and writing HCL configuration files, running Terraform CLI commands, and understanding concepts such as state, providers, modules, and the plan/apply workflow before attempting the exam.
The Terraform Associate (004) is a 60-minute, online-proctored exam delivered through the Certiverse platform. The exam consists of approximately 57–60 questions in multiple-choice format, including true/false, single-select, and multi-select question types. The exam is available only in English. The registration fee is $70.50 USD plus applicable taxes and fees.
HashiCorp uses a scaled scoring model and does not publicly disclose the exact number of scored versus unscored items. The passing score is broadly understood to require approximately 70% mastery across all domains. Candidates receive a pass/fail result immediately upon completion, with detailed objective-level performance feedback delivered within approximately 48 hours. The resulting credential is valid for two years.
Earning the Terraform Associate credential positions engineers competitively for roles that require infrastructure automation expertise, including Cloud Infrastructure Engineer, DevOps Engineer, Platform Engineer, and Site Reliability Engineer. According to HashiCorp, 88% of exam takers agree that passing a HashiCorp Associate-level exam makes job candidates more desirable to employers. Terraform's dominant position in the IaC market — used by organizations across every major industry vertical — means the certification is recognized by a broad range of employers and is frequently listed as a preferred or required qualification in infrastructure-related job postings.
The Terraform Associate complements cloud provider certifications (AWS, Azure, GCP) by validating multi-cloud, provider-agnostic infrastructure skills that those vendor-specific certs do not cover. It is commonly pursued alongside or after an associate-level cloud certification to build a well-rounded infrastructure credential profile. For engineers looking to advance further, HashiCorp offers the Terraform Authoring and Operations Professional certification as a logical next step, validating advanced production-level Terraform expertise.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 628 questions.
1. A DevOps team develops a Terraform module that provisions Azure virtual machines. They want to ensure that all VMs are created with encryption at rest enabled before the resource is created, and verify after creation that the VM has a public IP address assigned. Which lifecycle configuration should they implement? (Select one!)
Explanation
Preconditions are evaluated before resource creation and should validate input requirements like encryption settings that can be checked before applying changes. Postconditions are evaluated after resource creation and should verify resource attributes like the public IP that only exist after the VM is created. Using postconditions for encryption checks would allow creation of non-compliant resources. Using preconditions for public IP checks would fail since the attribute doesn't exist yet. Two preconditions cannot verify post-creation attributes. Two postconditions cannot prevent creation of misconfigured resources.
2. A Terraform configuration manages an RDS database instance that took 6 hours to restore from a snapshot and contains critical production data. The infrastructure team wants to prevent accidental destruction of this database through configuration changes while still allowing updates to non-destructive attributes like backup retention periods. Which lifecycle meta-argument configuration accomplishes this goal? (Select one!)
Explanation
The prevent_destroy lifecycle argument causes Terraform to reject any plan that would destroy the associated infrastructure object, protecting against accidental deletion through configuration changes while still permitting attribute updates. However, this protection has an important limitation: it does not prevent destruction if the resource block is completely removed from configuration, and the terraform destroy command still functions. The create_before_destroy argument addresses downtime during replacement, not destruction prevention. Setting ignore_changes to all prevents all updates including desired ones like backup retention changes. The replace_triggered_by argument forces replacement when referenced values change, which is the opposite of the requirement.
3. An operations team manages Terraform state with an S3 backend using DynamoDB for locking. They want to eliminate the DynamoDB dependency while maintaining state locking. Which Terraform 1.10+ feature should they enable? (Select one!)
Explanation
Terraform 1.10 introduced S3 native locking via the use_lockfile parameter. When enabled, Terraform creates .tflock files in S3 instead of using DynamoDB for state locking. This eliminates the DynamoDB table requirement and associated costs while maintaining locking functionality. There is no lock_table parameter that accepts S3 bucket paths—lock_table specifically refers to DynamoDB tables. The server_side_encryption_configuration parameter controls encryption, not locking. There is no enable_native_locking parameter in Terraform backend configuration.
4. A security team reviews Terraform configurations and discovers that sensitive output values marked with sensitive = true still appear in state files. They need to completely prevent specific values from being stored in state. Which two Terraform 1.10+ features address this requirement? (Select two!)
Multiple correct answersExplanation
Ephemeral variables with ephemeral = true completely omit variable values from state files, unlike sensitive = true which only hides display. Write-only arguments introduced in Terraform 1.11 accept ephemeral values and prevent their storage in state or plan files. Output blocks do not support ephemeral = true as a valid parameter. Data sources do not have an omit_from_state parameter in Terraform syntax. Local values with sensitive = true only affect display output and do not prevent state storage.
5. A company uses Terraform modules from the public Terraform Registry. They reference a module using the source hashicorp/consul/aws and want to ensure they use versions 3.0 or higher but avoid the 4.0 major release. Which version constraint should they use? (Select one!)
Explanation
The constraint >= 3.0, < 4.0 explicitly allows any version from 3.0 up to but not including 4.0, which precisely meets the requirement. Combined version constraints use comma separation to specify multiple conditions. The pessimistic constraint ~> 3.0 would only allow 3.0.x versions, blocking 3.1, 3.2, and other minor releases within the 3.x series. The caret operator ^ is not a valid Terraform version constraint operator. The wildcard syntax 3.* is not valid in Terraform version constraints, which require explicit operators.
One-time access to this exam