Free study guide · DevOps
How to pass the HashiCorp Certified: Terraform Associate (004)
What the exam covers, how to plan your study, and how to read its questions. From the CertLumen course for this exam, kept up to date with the official exam guide.
- Questions
- 57
- Time
- 60 minutes
- Passing score
- Not published
- Exam fee
- USD 70.50 plus locally applicable taxes and fees (free retake not included)
- Valid for
- 2 years
- Delivery
- Online proctored
What the exam covers
A study plan that works
The default path for engineers who have used Terraform a little but have not covered every exam objective. It covers all 21 lessons and all 15 labs in order, with a section drill after each section and daily flashcards. Configuration (t4) gets three days because it carries the most questions, and HCP Terraform (t8) gets a full day because it is the second largest topic. Mock Exam 1 and Mock Exam 2 come on days 13 and 14; Mock Exams 3 and 4 are for extra practice if you have time. Book the exam for day 15 or 16. Plan on about 1–2 hours a day.
| Day | Focus | Time |
|---|---|---|
| 1 | Kick-off: what IaC is, and how Terraform spans clouds | 130 min |
| 2 | Providers: install, version and combine | 90 min |
| 3 | State: what it stores and how plan uses it | 90 min |
| 4 | The core workflow: init, validate, plan, apply | 110 min |
| 5 | Destroy, fmt and the t3 drill | 90 min |
| 6 | Resources, data sources, references and variables | 120 min |
| 7 | Complex types, expressions, functions, dependencies and conditions | 120 min |
| 8 | Secrets, Vault and the t4 drill | 120 min |
| 9 | Modules | 120 min |
| 10 | State management: backends, locking and drift | 120 min |
| 11 | Import, state inspection and verbose logging | 110 min |
| 12 | HCP Terraform | 130 min |
| 13 | Mock Exam 1 and review | 150 min |
| 14 | Mock Exam 2, final review and booking | 150 min |
Exam strategy
How the exam works
The HashiCorp Certified: Terraform Associate (004) is an online proctored, multiple-choice exam delivered through the Certiverse platform. HashiCorp tests Terraform 1.12 and includes HCP Terraform content. Provider-specific knowledge is not required: questions use AWS, Azure or Google Cloud resources only as examples, and what they test is the Terraform language, CLI and workflow.
| Fact | Detail (from HashiCorp's certification page, study guide and certification FAQ) |
|---|---|
| Name | HashiCorp Certified: Terraform Associate (004). It replaced the 003 version; the guide says it tests Terraform 1.12 |
| Duration | 1 hour (60 minutes) |
| Format | Multiple choice, including multiple-answer items, delivered online with a proctor |
| Number of questions | Not published by HashiCorp. This course's mock exams use 57 questions, the figure third-party sites report, so treat it as a practice size |
| Passing score | Not published. HashiCorp says it does not share score percentages or the scoring threshold |
| Cost | USD 70.50 plus locally applicable taxes and fees. A free retake is not included |
| Validity | 2 years |
| Language | English |
| Results | Pass or fail is shown in Certiverse immediately after the exam. You get a performance report by objective, not a score. Badge and certificate can take up to 48 hours |
| Retakes | Wait 7 days between attempts; at most 4 attempts in a rolling 365 days. If you pass, you cannot retake it until your credential expires |
| Prerequisites | None mandatory. Basic terminal skills and an understanding of on-premises and cloud architecture; professional experience is recommended |
| Aids | None. No notes, second screen or other resources |
HashiCorp publishes the eight objective areas but not the number of questions or the weight of each area. The weights in this course (Configuration about 24%, HCP Terraform about 18%, Fundamentals and Core workflow about 12% each, and so on) are our estimates for balanced practice. Spend your time where there are most objectives: configuration, HCP Terraform, workflow and state.
The real exam mixes single-answer and multiple-answer questions, and the stem tells you how many to choose. The practice questions follow that rule: multiple-select stems end with (Choose two.) or (Choose three.) and have five options. Judge each option as true or false for the stated situation before you pick.
Pacing
Sixty minutes is a little over a minute per question if the paper is near 57 questions. Most items are short recall or read-the-snippet questions, so aim to answer the easy ones in 30 to 45 seconds and bank time for the scenario questions.
- Pass 1: answer everything you are sure of straight away, and flag any question where you are guessing between two options.
- Pass 2: return to the flagged ones with the time you banked. Re-read the stem for the exact verb (which command, which block, which file) and for how many answers it wants.
- Final two minutes: make sure every question has an answer and every multiple-answer question has the required number of selections. Leaving a question blank can never help.
The exam is not a typing test. If a snippet question has one option that is clearly valid HCL and three that use syntax Terraform does not have (function.x(), locals.name, for_each on a list), pick the valid one and move on.
How to read the questions
- Find the verb. 'Which command previews', 'which block reads', 'which flag skips the prompt'. The verb narrows the answer to one tool.
- Read the scope words. 'Without changing infrastructure', 'without destroying', 'only for this run', 'across all workspaces'. These separate
plan -refresh-onlyfromapply,state rmfromdestroy,-targetfrom a normal run. - Check the edition. HCP Terraform (hosted, formerly Terraform Cloud) and Terraform Enterprise (self-managed) share the workflow. A question that says 'private network, no inbound firewall rule' means an HCP Terraform agent.
- Count the answers. (Choose two.) means exactly two. Partial credit is not something to rely on.
- Translate old names. Terraform Cloud is HCP Terraform;
taintis-replace;refreshis-refresh-only; theremotebackend is thecloudblock.
The traps this exam sets
| Trap | What the question does | The rule |
|---|---|---|
| Sensitive is not secret | Offers sensitive = true as the way to keep a value out of state | It only hides the value in CLI and UI output. The value is still in state and plan files. Only ephemeral values with write-only arguments stay out of state |
| Validate is not plan | Asks which command finds an API error or an existing resource | validate is local and checks syntax and consistency only. plan talks to providers |
| Refresh does not change infrastructure | Describes apply -refresh-only as 'fixing' drift | It updates state to match reality. A normal apply reverts drift on arguments your configuration sets |
| state rm is not destroy | Says terraform state rm deletes the resource | It only forgets it. The real object keeps running. Deleting the resource block and applying destroys it |
| Lock file is for providers | Asks which file pins module versions | .terraform.lock.hcl records provider versions and checksums only. Modules are pinned with version or ?ref= |
| init is not upgrade | Says a newer provider will be installed by terraform init | Plain init reuses the locked version. Only init -upgrade moves to the newest allowed version |
| count versus for_each | Removes an item from the middle of a list | count shifts indexes and replaces later instances. for_each keeps keys stable. for_each takes a map or a set of strings, never a list |
| Version works only for registries | Puts version on a Git or local module | Registry modules use version. Git uses ?ref=. A local path has no version |
| HCP workspace is not a CLI workspace | Mixes the two terms | A CLI workspace is a named state in one directory. An HCP Terraform workspace has its own variables, permissions, runs and state history |
| Targeting and -refresh=false are exceptions | Offers them as the normal way to speed up | -target can leave state and configuration out of step, and -refresh=false hides drift. Neither belongs in the routine workflow |
| Saved plan limits | Applies a saved plan with -var or expects -auto-approve to matter | A saved plan already contains its values and applies without a prompt. Variables cannot be set when you apply it |
| Generated config is a draft | Says -generate-config-out produces ready configuration | It is experimental, writes to a new file only, and needs review |
Distractors usually (1) promise something IaC or Terraform does not do, such as translating a resource between clouds, removing the need for state, or encrypting state by itself; (2) use a command or flag that does not exist, such as terraform apply -upgrade or terraform init -refresh; (3) use the right command in the wrong scope, such as destroy where state rm was asked.
Hands-on matters
HashiCorp's own study guide is built around its tutorials and says to prioritise the workflow commands, state operations (moving, importing, removing), modules and HCP Terraform setup. Do the labs in this course: they run on your own computer with the local, random, null and Docker providers and the HCP Terraform free tier, so they cost nothing. Typing terraform plan and reading the symbols teaches more than rereading a table.
The last week
- 7 to 5 days before: finish any unread lessons and take every section drill. Log each miss with the rule, not just the right answer.
- 4 to 3 days before: take Mock Exam 1 under exam conditions, no notes, 60 minutes. Review every miss and every guess.
- 2 days before: take Mock Exam 2 and fix the gaps. Re-read the Renames page and the Keyword cues.
- Day before: light review only. Skim the Cheat sheet, the traps table above and the Exam day page. Run the Certiverse system check, check that the name on your account matches your ID, and sleep.
- Exam day: follow the Exam day page. Read each stem twice, flag and move on, and use the final minutes for flagged questions.
Words that point to the answer
Phrases in a question that usually point to one answer. The course has the full list.
| When the question says | Think of |
|---|---|
| Desired end state, Terraform works out the steps | Declarative |
| Applying an unchanged configuration again changes nothing | Idempotent |
| Same provider in two regions | Second provider block with alias, chosen with provider = aws.west |
| Make every machine install the same provider build | Commit .terraform.lock.hcl |
| Move providers to the newest allowed version | terraform init -upgrade |
| Terraform records which real object each resource address maps to | State |
| Update state to match reality without changing infrastructure | terraform apply -refresh-only (preview with plan -refresh-only) |
| Apply exactly the plan that was reviewed | terraform plan -out=FILE, then terraform apply FILE |
| Recreate one resource although nothing changed | terraform apply -replace=ADDRESS |
| Preview a destroy | terraform plan -destroy |
Revise from the cheat sheet
The course's cheat sheet has a page for each of these:
- IaC with Terraform: concepts at a glance
- Fundamentals: providers and state
- Core workflow: commands, flags and symbols
- Configuration: blocks, variables, types and conditions
- Modules: sources, versions and scope
- State management: backends, locking and drift
- Maintaining infrastructure: import, state inspection, logging
- HCP Terraform: structure, runs, governance and connection
Practise with the real exam's mix
372 exam-style questions, 4 timed practice exams, flashcards and an AI tutor.