Practice exam · HashiCorp
HashiCorp Certified: Terraform Associate (003) practice exam
Short answer
The HashiCorp Certified: Terraform Associate (003) practice exam has 50 questions in 60 minutes, with a 70% passing mark, as configured here. The fastest way to know whether you are ready is to sit a full exam on the clock and read your score by domain, not only the total.
Domains covered
- HCP Terraform Capabilities
- IaC Concepts and Terraform Purpose
- Interact with Terraform Modules
- Read, Generate, and Modify Configuration
- Terraform CLI and Core Workflow
- Terraform State
Sample questions, with explanations
Three questions from the bank, open to read.
A platform team wants to standardize that all modules consuming the internal 'mycorp/vault' provider use any version in the 1.x line but never automatically jump to 2.0, which contains breaking changes. They add the constraint to required_providers. Which version constraint string correctly expresses 'any 1.x release, including future 1.x patches and minors, but not 2.0'?
- version = "~> 1.0" ✓ (correct)
- version = "= 1.0"
- version = "~> 1.2.0"
- version = ">= 1.0"
Why this is correct
The pessimistic constraint operator '~>' with two version segments, '~> 1.0', allows the rightmost specified component (the minor) and the patch component to increment while pinning the leftmost (major) component, meaning >= 1.0.0 and < 2.0.0. That is exactly 'any 1.x but not 2.0'. '~> 1.2.0' is wrong because with three segments it only allows the patch to increment, meaning >= 1.2.0 and < 1.3.0, which excludes future minors like 1.4. '>= 1.0' is wrong because it permits 2.0 and beyond, exactly the breaking upgrade the team wants to block. '= 1.0' is wrong because it pins to a single exact version (1.0.0) and forbids any later 1.x patch or minor release.
An engineer wants to guarantee that the exact set of changes reviewed during planning is what actually gets applied, with no chance of drift or a recomputed diff between review and execution. Which workflow achieves this?
- Run `terraform plan -refresh=false` then `terraform apply -refresh=false`
- Run `terraform plan -out=tfplan`, then `terraform apply tfplan` ✓ (correct)
- Run `terraform apply -auto-approve` twice and compare outputs
- Run `terraform plan` then immediately `terraform apply` and type 'yes'
Why this is correct
Saving a plan with `-out` and then applying that saved plan file makes Terraform execute exactly the recorded set of actions; no new plan is computed at apply time, so review and execution are identical. Running a bare `plan` then a bare `apply` is wrong because the apply recomputes a fresh plan against current state, which can differ from what was reviewed. Running `apply -auto-approve` twice is wrong because each apply computes its own plan and auto-approves it — comparing outputs does not lock the reviewed change set and skips review entirely. Using `-refresh=false` on both commands is wrong because, although it skips refresh, the apply still recomputes the diff from configuration and state and may not match the earlier plan; only a saved plan file guarantees identical actions.
A resource attribute requires a value that may be absent. The author writes `bucket = coalesce(var.custom_bucket, "default-bucket")` expecting it to fall back to the literal when `var.custom_bucket` is an empty string. The plan errors or behaves unexpectedly with an empty string. What is the correct understanding?
- `coalesce` returns the first non-null, non-empty argument, so an empty string is skipped only if `coalesce` is given a non-empty fallback — but it errors when all arguments are empty/null. ✓ (correct)
- `coalesce` is not a valid Terraform function; the author should have used `try` to provide a fallback.
- `coalesce` always returns its last argument, so the default literal is what gets used regardless of the variable.
- `coalesce` only skips `null`, not empty strings, so an empty `var.custom_bucket` is returned and the default is never used.
Why this is correct
`coalesce` returns the first argument that is neither null nor an empty string; given `("", "default-bucket")` it skips the empty string and returns `default-bucket`, but if every argument is empty/null it raises an error because there is nothing to return. That matches the described 'errors or behaves unexpectedly' when inputs are empty. The claim that `coalesce` only skips `null` and not empty strings is the misconception — that behavior describes a different fallback approach (e.g. `var.x != "" ? var.x : default` or `try`), not `coalesce`. `coalesce` does not 'always return its last argument'; it returns the first usable one. `coalesce` is indeed a real Terraform function, so the option claiming it is invalid is wrong, even though `try` is a legitimate but different tool for handling errors rather than empties.
Take the full practice exam
- 50 questions drawn from the bank, with a 60-minute timer
- Score by domain and a review of every question
- An AI tutor to talk through each question you miss
- What you miss feeds your study plan
Independent, unofficial practice exam. HashiCorp and the exam name are trademarks of their owners; UpSkillScore is not affiliated with them. Format and passing mark are the exam's configuration in UpSkillScore, not an official statement.
Frequently asked questions
How many questions does the HashiCorp Certified: Terraform Associate (003) practice exam have?
It has 50 questions and a 60-minute limit. The passing mark of the practice exam is 70%.
Is this the official HashiCorp Certified: Terraform Associate (003) exam?
No. It is an independent practice exam built to match the structure of the real one. It does not replace the official exam.
Do I need an account to take it?
You can read the structure and sample questions without an account. Taking the full timed exam, scoring by domain and the AI tutor need one.