HashiCorp Terraform-Associate-004 - HashiCorp Certified: Terraform Associate (004) (HCTA0-004)

Terraform configuration can import modules from various sources, not only from the public registry. Modules can be sourced from local file paths, Git repositories, HTTP URLs, Mercurial repositories, S3 buckets, and GCS buckets. Terraform supports a number of common conventions and syntaxes for specifying module sources, as documented in the [Module Sources] page. References = [Module Sources]

The terraform plan command does not update the state file. Instead, it reads the current state and the configuration files to determine what changes would be made to bring the real-world infrastructure into the desired state defined in the configuration. The plan operation is a read-only operation and does not modify the state or the infrastructure. It is the terraform apply command that actually applies changes and updates the state file.References = Terraform's official guidelines and documentation clarify the purpose of the terraform plan command, highlighting its role in preparing and showing an execution plan without making any changes to the actual state or infrastructure .

Rationale for Correct Answer (C):

Credentials should not be hardcoded in Terraform files. Best practice is to configure them via environment variables or secret managers.

Analysis of Incorrect Options:

A: Shared servers introduce risk and drift.

B: Storing secrets in config/version control is insecure.

D: Incorrect since option C is valid.

Key Concept:

Separation of credentials from code is a Terraform security best practice.

The two steps that are required to provision new infrastructure in the Terraform workflow are init and apply. The terraform init command initializes a working directory containing Terraform configuration files. It downloads and installs the provider plugins that are needed for the configuration, and prepares the backend for storing the state. The terraform apply command applies the changes required to reach the desired state of the configuration, as described by the resource definitions in the configuration files. It shows a plan of the proposed changes and asks for confirmation before making any changes to the infrastructure. References = [The Core Terraform Workflow], [Initialize a Terraform working directory with init], [Apply Terraform Configuration with apply]

A secure string is not a valid option to keep secrets out of Terraform configuration files. A secure string is a feature of AWS Systems Manager Parameter Store that allows you to store sensitive data encrypted with a KMS key. However, Terraform does not support secure strings natively and requires a custom data source to retrieve them. The other options are valid ways to keep secrets out of Terraform configuration files. A Terraform provider can expose secrets as data sources that can be referenced in the configuration. Environment variables can be used to set values for input variables that contain secrets. A -var flag can be used to pass values for input variables that contain secrets from the command line or a file. References = [AWS Systems Manager Parameter Store], [Terraform AWS Provider Issue #55], [Terraform Providers], [Terraform Input Variables]

This is the best time to run terraform validate, as it will check your code for syntax errors, typos, and missing arguments before you attempt to create a plan. The other options are either incorrect or unnecessary.

Rationale for Correct Answer:

A: The plan is stale because state changed after it was created. The correct fix is to recreate the plan against the latest state and apply that new plan.

B: Running terraform apply without specifying the old plan causes Terraform to re-plan using the current state and configuration, then apply the resulting changes.

Analysis of Incorrect Options (Distractors):

C: -lock=false disables locking; it does not make an old plan valid and is unsafe in team environments.

D: -refresh-only changes what’s recorded in state (when applied) but does not “unstale” an existing saved plan file.

E: terraform state push is for advanced/manual state management and does not update a saved plan file; using it here is inappropriate and risky.

Key Concept: Saved plans are tied to a specific state snapshot; if state changes, you must re-plan.

Confidentiality: UsingHCP Terraform/Terraform Cloud’s private registrykeeps the module configurations within your organization, ensuring privacy and access control.

Version Constraints: The private registry supportssemantic versioning, allowing you to manage versions of your modules as Terraform does natively.

Browsable Directory: The private registry offers a user interface to browse modules, making it easy for users within the organization to locate and manage modules.

This setup aligns with HashiCorp’s design forprivate registry supportin Terraform, meeting all listed requirements for secure, version-controlled, and searchable module storage.

Rationale for Correct Answer: terraform graph outputs a Graphviz DOT representation of Terraform’s dependency graph, which you can pipe into Graphviz tools (e.g., dot) to visualize resource/module dependencies.

Analysis of Incorrect Options (Distractors):

B: terraform show displays state or a plan file in human-readable form (or JSON with -json), not DOT.

C: terraform refresh (deprecated as a standalone command in newer workflows) refreshes state, not graph output.

D: terraform output prints root module outputs, not dependency graphs.

Key Concept: Visualizing Terraform’s dependency graph using terraform graph.

Rationale for Correct Answer (True):

Variables without defaults are required inputs. If the calling module doesn’t supply a value, Terraform will fail with an error at plan time.

Analysis of Incorrect Option:

False: Incorrect, because Terraform does not assume defaults when none are provided.

Key Concept:

Terraform modules enforce required vs. optional variables depending on whether a default is set.