HashiCorp Terraform-Associate-004 HashiCorp Certified: Terraform Associate (004) (HCTA0-004) Exam Practice Test

Rationale for Correct Answer: A private registry in HCP Terraform is designed to publish and share modules within an organization (with org access controls), rather than publicly. That supports internal reuse while keeping module content and usage confined to authorized users in the org.

Analysis of Incorrect Options (Distractors):

B (False): Incorrect—confidential/internal distribution is a primary purpose of private registries.

Key Concept: Public vs private module registries and organizational access control.

Module version is optional to reference a module on the Terraform Module Registry. If you omit the version constraint, Terraform will automatically use the latest available version of the module

Detailed Explanation:Rationale for Correct Answer:When using multiple configurations of the same provider (e.g., AWS in different regions), Terraform requires the use of an aliasto distinguishalias argument:provider " aws " { alias = " west " region = " us-west-2 " }This allows resources to explicitly reference the aliased provider using:provider = aws.westThis is the standard Terraform pattern for multi-region or multi-account deployments.Analysis of Incorrect Options (Distractors):

Answer: Resource block only — Incorrect because it does not define how to use a different region; it relies on provider configuration.

Answer: provider " aws " " west " — Incorrect syntax; Terraform does not support naming providers this way. The correct method is using the alias argument.

Answer: provider " aws_west " — Incorrect because provider names must match actual providers (e.g., aws). You cannot invent a new provider name. Key Concept:Provider aliasing enables multiple configurations of the same provider (e.g., multiple AWS regions).

You should use the force-unlock command when automatic unlocking failed. Terraform will lock your state for all operations that could write state, such as plan, apply, or destroy. This prevents others from acquiring the lock and potentially corrupting your state. State locking happens automatically on all operations that could write state and you won’t see any message that it is happening. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the -lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn’t output a message, state locking is still occurring if your backend supports it. Terraform has a force-unlock command to manually unlock the state if unlocking failed. Be very careful with this command. If you unlock the state when someone else is holding the lock it could cause multiple writers. Force unlock should only be used to unlock your own lock in the situation where automatic unlocking failed. To protect you, the force-unlock command requires a unique lock ID. Terraform will output this lock ID if unlocking fails. This lock ID acts as a nonce, ensuring that locks and unlocks target the correct lock. The other situations are not valid reasons to use the force-unlock command. You should not use the force-unlock command if you have a high priority change, if apply failed due to a state lock, or if you see a status message that you cannot acquire the lock. These situations indicate that someone else is holding the lock and you should wait for them to finish theiroperation or contact them to resolve the issue. Using the force-unlock command in these cases could result in data loss or inconsistency. References = [State Locking] , [Command: force-unlock]

This is the workflow for deploying new infrastructure with Terraform, as it will create a plan and apply it to the target environment. The other options are either incorrect or incomplete.

D

Rationale for Correct Answer:A check block in Terraform is used to validate conditions and provide warnings or errors, but it does not block the execution of the operation by default. Failed checks will report issues, but Terraform continues execution unless explicitly configured otherwise. Therefore, the statement is false.

Analysis of Incorrect Options (Distractors):

A. True — Incorrect because checkwith*

Key Concept:Check blocks are used for validation and observability but do not enforce execution blocking like preconditions or postconditions.

Terraform validate reports configuration consistency errors, such as declaring a resource identifier more than once. This means that the same resource type and name combination is used for multiple resource blocks, which is not allowed in Terraform. For example, resource " aws_instance " " example " {...} cannot be used more than once in the same configuration. Terraform validate does not report errors related to module versions, state differences, or formatting issues, as these are not relevant for checking the configuration syntax and structure. References = [Validate Configuration], [Resource Syntax]

The terraform state list command lists all resources that are managed by Terraform in the current state file1. The terraform state show command shows the attributes of a single resource in the state file2. By using these two commands, you can compare the VM IDs in your list with the ones in the state file and identify which one is managed by Terraform.

B (terraform init)–Must be run firstto initialize the Terraform working directory, download providers, and configure the backend.

A (terraform apply)– Requires initialization first, so itcannotbe run before terraform init.

C (terraform plan)– Also requires terraform init first to generate a plan.

D (terraform show)– Displays the state,not relevantfor first-time deployment.

Official Terraform Documentation Reference:

terraform init - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer: HashiCorp recommends storing secrets in secure, purpose-built systems or mechanisms that avoid exposing sensitive values in plaintext or version control:

B. HashiCorp Vault is a dedicated secrets management solution designed to securely store and control access to sensitive data.

D. Environment variables (TF_VAR_) allow passing sensitive values at runtime without persisting them in configuration files or version control.

E. HCP Terraform sensitive variables are encrypted and hidden from logs and UI output, making them a secure option for managing secrets in Terraform Cloud/Enterprise environments.

These approaches align with Terraform best practices for secure secret management and protecting sensitive inputs in IaC workflows.

Analysis of Incorrect Options (Distractors):

A. Plaintext document on a shared drive is insecure and exposes secrets to unauthorized access.

C. terraform.tfvars committed to version control is explicitly discouraged because secrets would be stored in plaintext and tracked in Git history, creating a major security risk.

Key Concept: Secure handling of sensitive data in Terraform using Vault, environment variables, and sensitive input variables.

Rationale for Correct Answers:

B. View the execution plan: Correct — terraform plan shows what Terraform intends to do (create, update, or destroy).

C. Save a generated execution plan: Correct — using terraform plan -out=planfile lets you save the plan to apply later with terraform apply planfile.

Analysis of Incorrect Options:

A. Schedule runs in the future: Incorrect, Terraform does not provide scheduling; external tools (like cron, CI/CD) are required.

D. Execute a plan in a different workspace: Incorrect, execution happens in the current workspace; switching workspaces must be done before running the plan.

Key Concept:

terraform plan is used for previewing and optionally saving an execution plan for controlled and predictable infrastructure changes.

Dynamic blocks in Terraform allow you to define multiple nested blocks within a resource based on the values of a variable. This feature is particularly useful for scenarios where the number of nested blocks is not fixed and can change based on variable input.

Detailed Explanation:

Rationale for Correct Answer: To configure Terraform to use HCP Terraform for remote state storage and workspace-based runs, you add a cloud block inside the terraform block. The cloud block specifies the HCP Terraform organization and workspace configuration.

Analysis of Incorrect Options (Distractors):

B. Add a backend block inside the terraform block. This is valid for configuring other remote backends, such as S3, AzureRM, or GCS. However, for HCP Terraform workspaces, the modern and recommended configuration is the cloud block.

C. Set the TERAFORM_CLOUD environment variable. Incorrect. This environment variable is misspelled and is not how Terraform configures remote state.

D. Set the TERRAFORM_BACKEND environment variable. Incorrect. Terraform does not use this environment variable to configure a backend.

Key Concept: HCP Terraform remote state and workspace integration are configured using the cloud block.

You can develop a custom provider to manage its resources using Terraform, as Terraform is an extensible tool that allows you to write your own plugins in Go language. You can also publish your custom provider to the Terraform Registry or use it privately.

You cannot access state stored with the local backend by using the terraform_remote_state data source. The terraform_remote_state data source is used to retrieve the root module output values from some other Terraform configuration using the latest state snapshot from the remote backend. It requires a backend that supports remote state storage, such as S3, Consul, AzureRM, or GCS. The local backend stores the state file locally on the filesystem, which terraform_remote_state cannot access.

Detailed Explanation:

Rationale for Correct Answer: HCP Terraform health assessments are part of continuous validation. They can detect resource drift and evaluate Terraform check blocks to validate infrastructure health after deployment.

Analysis of Incorrect Options (Distractors):

A. Terraform test execution. Incorrect. Terraform tests are not the core function of HCP Terraform health assessments.

C. Infrastructure cost estimation. Incorrect. Cost estimation is a run feature, not a health assessment function.

E. Sentinel policy checks. Incorrect. Sentinel policies are evaluated during the run workflow, not as the primary health assessment mechanism.

Key Concept: HCP Terraform health assessments support drift detection and check block validation.

A (✅Correct)– Providers allow Terraform tointeract with APIsof cloud/on-premises services.

B (✅Correct)– Some Terraform providers can provisionon-premises infrastructure, such as VMware, OpenStack, etc.

C (❌Incorrect)– This describesTerraform Workspaces, not providers.

D (✅Correct)– Terraform providers allow provisioning ofpublic cloud resources(AWS, Azure, GCP, etc.).

E (❌Incorrect)– Enforcing security and compliance policies isnot a direct provider function, but it can be done using Sentinel or other policy-as-code tools.

Official Terraform Documentation Reference:

Terraform Providers

terraform validateonlychecks the configuration’s syntax and internal consistency—itdoes notinteract with provider APIs or check if the infrastructure settings are correct.

It ensures that the Terraform code is syntactically correct and follows proper HCL structure.

However, it doesnotverify if resources are valid according to the provider API or if the credentials are correct.

To verify actual infrastructure settings, use terraform plan, which interacts with the provider APIs.

Official Terraform Documentation Reference:

terraform validate - HashiCorp Documentation

The terraform plan command is used to create an execution plan. It allows you to see what actions Terraform will take to reach the desired state defined in your configuration files. It evaluates the current state and configuration, showing a detailed outline of the resources that will be created, updated, or destroyed. This is a critical step in the development process as it helps you verify that the changes you are about to apply will perform as expected, without actually modifying any state or infrastructure.

Rationale for Correct Answer: To expose values from a child module to a parent module, you define an output in the child module (e.g., output " public_ip " { value = aws_instance.example.public_ip }). The parent module can then reference it via module. < child_name > .public_ip.

Analysis of Incorrect Options (Distractors):

B: A data source in the parent could look up an instance, but that’s unnecessary and brittle compared to using module outputs (and may require extra identifiers).

C: Import is for bringing existing resources into state; it doesn’t expose attributes between modules.

D: Locals are only scoped within the module; they are not accessible from the parent.

Key Concept: Module composition: outputs are the contract for passing data from child to parent.

This is the command that does not cause Terraform to refresh its state, as it only lists the resources that are currently managed by Terraform in the state file. The other commands will refresh the state file before performing their operations, unless you use the -refresh=false flag.

If you update the version constraint in your Terraform configuration, Terraform will update your lock file the next time you run terraform init3. This will ensure that you use the same provider versions across different machines and runs.

Importing Existing Resources: Theterraform importcommand brings resources already deployed in a cloud environment into Terraform’s state file, allowing Terraform to manage them.

Workflow Usage: Importing is vital when managing resources created outside of Terraform or those in place before Terraform adoption.

Refer to Terraform’s import command documentation.

You must initialize your working directory before running terraform validate, as it will ensure that all the required plugins and modules are installed and configured properly. If you skip this step, you may encounter errors or inconsistencies when validating your configuration files.

Rationale for Correct Answer: Locals are evaluated as expressions, and one local can reference another using local. < name > . This supports building up derived values cleanly:

locals {

env = " prod "

app_name = " api-${local.env} "

}

Analysis of Incorrect Options (Distractors):

B (False): Incorrect—Terraform explicitly supports local-to-local references.

Key Concept: Local values (locals) and expression references.

This is how the Terraform Cloud integration differs from other state backends such as S3, Consul, etc., as it allows you to perform remote operations on Terraform Cloud’s servers instead of your local machine. The other options are either incorrect or irrelevant.

terraform apply can runwithout explicitly running terraform plan first.

Running terraform plan before apply isrecommendedbutnot mandatory.

If no plan file is provided, terraform applyautomatically creates and executes a planbefore applying changes.

Official Terraform Documentation Reference:

terraform apply - HashiCorp Documentation

Rationale for Correct Answer: Remote state storage is configured using a backend block, which lives inside the top-level terraform block (for example, terraform { backend " s3 " { ... } }). Backends control where Terraform stores state (local vs remote), locking, and related settings—this is squarely in the Terraform configuration’s global settings area, not in resources or providers.

Analysis of Incorrect Options (Distractors):

A (The resource block): Resources define infrastructure objects (e.g., servers, buckets). They do not configure where Terraform stores state.

B (The provider block): Providers configure how Terraform talks to an API (credentials/regions/features). They don’t define state storage.

C (The data block): Data sources read existing infrastructure; they are unrelated to backend/state storage configuration.

Key Concept: Backends and remote state configuration using terraform { backend ... }.

Rationale for Correct Answer: Data sources are referenced using the address format:data. < DATA_SOURCE_TYPE > . < NAME > . < ATTRIBUTE > Here, the type is aws_ami, the name is web, and the attribute is id, so the correct reference is data.aws_ami.web.id.

Analysis of Incorrect Options (Distractors):

A (aws_ami.web.id): Incorrect because it omits the required data. prefix. This looks like a managed resource reference, not a data source.

B (web.id): Incorrect because Terraform references must include the full address (type and name); web alone is ambiguous.

D (data.web.id): Incorrect because it omits the data source type (aws_ami).

Key Concept: Terraform addressing and attribute references for data sources.

In Terraform, a data block is used to fetch or compute information from external sources for use elsewhere in the Terraform configuration. Unlike resource blocks that manage infrastructure, data blocks gather information without directly managing any resources. This can include querying for data from cloud providers, external APIs, or other Terraform states.References = This definition and usage of data blocks are covered in Terraform ' s official documentation, highlighting their role in fetching external information to inform Terraform configurations.

The terraform refresh-only command is intended to detect state file drift. This command synchronizes the state file with the actual infrastructure, updating the state to reflect any changes that have occurred outside of Terraform.

From terraform plan -refresh-only:

" Use this to detectdrift, i.e., changes made outside of Terraform. "

It compares actual infrastructure to what ' s recorded in the state file.

The terraform validate command is used to check for syntax errors and internal consistency within Terraform configurations, such as whether all required arguments are specified. It does not check for indentation styles, missing variable values (as variables might not be defined at validation time), or state file consistency with the current infrastructure. Therefore, none of the provided options are correct in the context of what terraform validate reports.References = Terraform ' s official documentation details the purpose and function of the terraform validate command, specifying that it focuses on syntaxand consistency checks within Terraform configurations themselves, not on external factors like the state file or infrastructure state. Direct references from the HashiCorp Terraform Associate (003) study materials to this specific detail were not found in the provided files.

You do not need to use different Terraform commands depending on the cloud provider you use. Terraform commands are consistent across different providers, as they operate on the Terraform configuration files and state files, not on the provider APIs directly.

From Terraform CLI Overview:

" Terraform provides a consistent CLI workflow regardless of which cloud or service you’re managing. "

Thesame Terraform commandswork across all providers via plugins.

Detailed Explanation:

Rationale for Correct Answer:In Terraform, an input variable is “optional” if it has a default value. Setting default = " " allows callers to omit the variable entirely, while still producing a known value (empty string) that you can conditionally include/exclude when building tags. This directly supports reusable module/config design: sensible defaults make variables optional.

Analysis of Incorrect Options (Distractors):

B: Incorrect. optional = true is not valid syntax for variable blocks in Terraform.

C: Incorrect. optional(string) is used for optional attributes in object type constraints, not as a top-level variable type declaration in this way for making a variable optional.

D: Incorrect. type = default is not valid Terraform syntax.

Key Concept:A variable becomes optional by providing a default value.

This is where Terraform cannot load a provider from, as it requires a compiled binary file that implements the provider protocol. You can load a provider from a plugins directory, a provider plugin cache, or the official HashiCorp distribution on releases.hashicorp.com.

Rationale for Correct Answer: To save an execution plan to a file, Terraform uses the -out flag: terraform plan -out=tfplan. That produces a plan file that can later be applied with terraform apply tfplan.

Analysis of Incorrect Options (Distractors):

A: This is an apply command with a variable file flag; it does not create a plan file.

B: -target expects a resource address (like aws_instance.example), not a plan filename.

C: -generate-config-out is used with configuration generation workflows (e.g., from import), not for saving a plan.

Key Concept: Creating and saving plan files with terraform plan -out=....

Terraform follows adeclarativeapproach, meaning it ensures the infrastructure matches the configuration.

If you run terraform apply againwithout any changes, Terraform willdetect that the infrastructure is already up to dateand willdo nothing.

The command will complete successfully with the message " No changes. Your infrastructure matches the configuration. "

Official Terraform Documentation Reference:

Terraform Apply - HashiCorp Documentation

Infrastructure as Code (IaC) can indeed be stored in a version control system along with application code. This practice is a fundamental principle of modern infrastructure management, allowing teams to apply software development practices like versioning, peer review, and CI/CD to infrastructure management. Storing IaC configurations in version control facilitates collaboration, history tracking, and change management.References = While this concept is a foundational aspect of IaC and is widely accepted in the industry, direct references from the HashiCorp Terraform Associate (003) study materials were not found in the provided files. However, this practice is encouraged in Terraform ' s best practices and various HashiCorp learning resources.

Detailed Explanation:

Rationale for Correct Answer: terraform init initializes the working directory. It downloads required providers, installs modules, and configures the backend. You must run it before running terraform plan or terraform apply for the first time in a new configuration directory.

Analysis of Incorrect Options (Distractors):

B. terraform workspace. Incorrect. This command manages Terraform workspaces but does not initialize providers, modules, or backends.

C. terraform validate. Incorrect. Validation is useful, but it is not the required initialization step before planning or applying.

D. terraform import. Incorrect. Import brings existing infrastructure into Terraform state. It is not required before planning or applying a new configuration.

Key Concept: Terraform working directories must be initialized with terraform init.

Rationale for Correct Answer (B):

IaC best practice is to manage infrastructure through version-controlled code. Changes should be reviewed and approved (via PRs), ensuring collaboration, traceability, and automation.

Analysis of Incorrect Options:

A, D, E: Making direct/manual changes bypasses IaC practices and causes drift.

C: Running code without PR review skips collaboration and approval.

Key Concept:

Infrastructure as Code emphasizes version control + peer review + automation.

The two steps that are required to provision new infrastructure in the Terraform workflow are init and apply. The terraform init command initializes a working directory containing Terraform configuration files. It downloads and installs the provider plugins that are needed for the configuration, and prepares the backend for storing the state. The terraform apply command applies the changes required to reach the desired state of the configuration, as described by the resource definitions in the configuration files. It shows a plan of the proposed changes and asks for confirmation before making any changes to the infrastructure. References = [The Core Terraform Workflow], [Initialize a Terraform working directory with init] , [Apply Terraform Configuration with apply]

The terraform import command is used to import existing infrastructure into your Terraform state. This command takes the existing resource and associates it with a resource defined in your Terraform configuration, updating the state file accordingly. It does not generate configuration for the resource, only the state.

Detailed Explanation:

Rationale for Correct Answer: terraform validate checks Terraform configuration syntax and internal consistency. It does not authenticate to cloud providers, query provider APIs, verify permissions, or detect access-related provider errors. Provider access checks occur during commands such as terraform plan or terraform apply.

Analysis of Incorrect Options (Distractors):

A. Variables are only applied and validated during terraform plan, so terraform validate assumed defaults and returned a success message. Incorrect. Variable validation can be checked by terraform validate, but the issue here is provider authorization, not variable validation.

B. The working directory was not initialized, so the cloud provider plugin was unavailable when running the terraform validate command. Incorrect. If initialization were required and missing, Terraform would generally report an initialization-related error, not silently validate provider credentials.

D. The remote backend was not configured, so terraform validate could not load the state and detect the missing credentials. Incorrect. terraform validate does not need state to validate basic configuration syntax and consistency.

Key Concept: terraform validate does not contact provider APIs or verify cloud permissions.

Rationale for Correct Answer:Terraform detects drift by refreshing state during terraform apply. Since the VM no longer exists but is still declared in configuration, Terraform will plan and recreate the missing resource.

Analysis of Incorrect Options (Distractors):

B. Error: Terraform treats this as drift, not an error.

C. Remove from state: Terraform does not remove resources automatically unless instructed.

D. No changes: Incorrect because drift is detected and corrected.

Key Concept:Terraform enforces the desired state defined in configuration, correcting drift automatically.

Terraform allows usingprivate module sourceshosted in:

C (Internally hosted VCS platforms, e.g., GitLab, Bitbucket, GitHub Enterprise)✅

D (Private GitHub repositories)✅

A (Public GitHub repository)❌–GitHubis supported, but apublic repo is not " private " .

B (Public Terraform Registry)❌–The public registryis not a private source.

Official Terraform Documentation Reference:

Terraform Module Sources

The terraform init command is used to initialize a working directory containing Terraform configuration files. This command performs several different initialization steps to prepare the current working directory for use with Terraform, which includes initializing the backend, installing provider plugins, and copying any modules referenced in the configuration. However, it does not validate whether all required variables are present; that is a task performed by terraform plan or terraform apply1.

References = This information can be verified from the official Terraform documentation on the terraform init command provided by HashiCorp Developer1.

Rationale for Correct Answer (True):

Local values (locals {}) are scoped to a module and are not directly visible outside. To make them available to callers, you must define outputs in the module. Outputs act as the interface for exposing values from a child module to the root module.

Analysis of Incorrect Option:

False: Incorrect, because locals cannot be exposed directly; only via outputs.

Key Concept:

Outputs are the way to expose information outside of a module.

Detailed Explanation:

Rationale for Correct Answer: The configuration uses a data block, not a resource block. In Terraform, a data block reads information about existing infrastructure from a provider. It does not create, update, or delete infrastructure. This data source searches for an existing AWS EC2 instance with the tag Name = web.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. A new AWS instance would be created using a resource block such as resource " aws_instance " " web " { ... }, not a data source.

Key Concept: Terraform data blocks are used to query existing infrastructure, while resource blocks manage infrastructure lifecycle.

This is how you specify a module’s version when publishing it to the public Terraform Module Registry, as it uses the tags from your version control system (such as GitHub or GitLab) to identify module versions. You need to use semantic versioning for your tags, such as v1.0.0.

Detailed Explanation:

Rationale for Correct Answer: terraform force-unlock should be used only when Terraform’s normal automatic unlocking has failed and you are sure no other Terraform process is actively using the state. It manually removes a stale lock.

Analysis of Incorrect Options (Distractors):

A. When terraform apply has failed due to a state lock. Incorrect. A lock error alone does not justify force unlocking. Another valid Terraform operation may still be running.

B. When you have a high-priority change. Incorrect. Urgency is not a valid reason to bypass state locking safeguards.

D. When you see a status message stating that Terraform cannot acquire the lock. Incorrect. This may simply mean another run is active. You should investigate before using force-unlock.

Key Concept: Force unlocking is a recovery action for stale locks, not a normal operational shortcut.

Detailed Explanation:

Rationale for Correct Answer: terraform destroy destroys all resources managed by the current configuration, but it is not the only way to remove infrastructure. You can also remove a resource block from the configuration and run terraform apply; Terraform will then plan to destroy that specific resource because it is no longer declared.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. Terraform can destroy infrastructure through normal apply operations when resources are removed from configuration.

Key Concept: Terraform reconciles real infrastructure with configuration. Removing a resource from configuration and applying the change can destroy that resource.

When the state file is locked, operations that modify or depend on the state (liketerraform apply,terraform destroy, andterraform state list) are blocked.terraform fmtonly formats the configuration files and does not interact with the state, so it is allowed.

Rationale for Correct Answer:

B: Providers can manage on-premises services (e.g., vSphere, Kubernetes, GitHub, DNS, databases), not just public cloud.

C: Providers provision and manage public cloud resources (AWS, Azure, Google Cloud, etc.).

D: Providers are the plugin layer that interacts with APIs (cloud/service APIs) to create, read, update, and delete resources.

Analysis of Incorrect Options (Distractors):

A: This describes how Terraform configuration and state are organized (root module/workspace/state), not a provider function.

E: Policy enforcement is handled by separate policy-as-code systems (e.g., Sentinel/OPA integrations) rather than being a core provider responsibility.

Key Concept: Providers as plugins that implement resource/data source types and perform API interactions for many platforms.

This is the correct way to reference the volume IDs associated with the ebs_block_device blocks in this configuration, using the splat expression syntax. The other options are either invalid or incomplete.

This will enable additional logging messages to find out from which paths Terraform is loading providers referenced in your Terraform configuration files, as it will set the log level to TRACE, which is the most verbose and detailed level.

Rationale for Correct Answer:

A (State versions and run history): HCP Terraform workspaces track state versions and maintain run history for auditability and rollback/reference—this is a hosted workflow feature beyond local-only Community Edition.

C (Variable sets): HCP Terraform provides variable sets to centrally manage and share Terraform/environment variables across multiple workspaces—Community Edition does not have this workspace-level managed feature.

D (Remote execution): HCP Terraform can execute plans/applies remotely in its managed runners, instead of requiring local execution.

Analysis of Incorrect Options (Distractors):

B: Not a standard “workspace feature” guaranteed as part of HCP Terraform workspaces in the same way as state/run history/remote runs/variables; security scanning depends on additional capabilities/policies/integrations rather than being the core baseline feature described here.

E: Storing configuration in VCS is not unique to HCP Terraform—you can store Terraform code in VCS with Community Edition as well. (HCP Terraform can integrate with VCS-driven workflows, but it doesn’t uniquely “store” your configuration.)

F: Terraform Community Edition also supports multiple cloud providers via providers; this is not exclusive to HCP Terraform.

Key Concept: Differences between local Terraform (Community Edition) and HCP Terraform workspace capabilities: remote runs, state history, centralized variables.

A module cannot always refer to all variables declared in its parent module, as it needs to explicitly declare input variables and assign values to them from the parent module’s arguments. A module cannot access the parent module’s variables directly, unless they are passed as input arguments.

This is the kind of configuration block that will create an infrastructure object with settings specified within the block. The other options are not used for creating infrastructure objects, but for configuring providers, accessing state data, or querying data sources.

Rationale for Correct Answer: A resource block creates/updates/destroys an infrastructure object and contains the configuration settings for that managed object (e.g., a VM, bucket, network). This is how Terraform manages real infrastructure.

Analysis of Incorrect Options (Distractors):

B (provider): Configures how Terraform connects to an API (region, credentials), not an infrastructure object.

C (data): Reads existing infrastructure; it does not manage (create/update/destroy) it.

D (locals): Defines named expressions for reuse; it doesn’t manage infrastructure.

Key Concept: Managed infrastructure is defined with resource blocks.

Detailed Explanation:

Rationale for Correct Answer:In Terraform, each “provider” plugin is responsible for interacting with a specific API surface (for example: AWS, AzureRM, Google, Kubernetes). If you want to manage resources across multiple cloud platforms, you typically configure and use the corresponding provider plugins (e.g., aws, azurerm, google). This matches Terraform’s provider model: providers are the integration points to external services.

Analysis of Incorrect Options (Distractors):

B: Incorrect. While a single provider can sometimes manage multiple services within a platform, managing different cloud providers (AWS vs Azure vs GCP) requires their respective provider plugins/configurations.

Key Concept:Providers are Terraform’s integration layer to each infrastructure platform/API.

Detailed Explanation:

Rationale for Correct Answer:

C (tfe_outputs data source): This automates step #2 by allowing the example-compute workspace to read output values directly from the example-network workspace, eliminating manual copying of outputs into input variables. This aligns with Terraform objectives around using HCP Terraform capabilities to share data between workspaces safely and consistently.

E (Run trigger on example-compute): This automates step #3 by making example-compute automatically run (plan, and then apply depending on settings) after HCP Terraform successfully applies changes in example-network. Run triggers are specifically designed to orchestrate workspace dependencies so downstream infrastructure reacts to upstream changes.

Analysis of Incorrect Options (Distractors):

A: Incorrect. Health checks are not used to orchestrate cross-workspace plans/applies. They are for monitoring run status/health signals, not dependency automation.

B: Incorrect for the same reason as A—health checks don’t trigger downstream runs based on upstream applies.

D: Incorrect. The run trigger should be configured on the downstream workspace (example-compute) so it is triggered by upstream changes. Configuring it “on the network workspace” is the wrong direction for this dependency flow in typical HCP Terraform orchestration.

Key Concept:Automating dependencies between HCP Terraform workspaces using:

Cross-workspace output consumption (tfe_outputs) and

Run triggers to automatically start downstream runs after upstream applies.

You can configure a backend in your Terraform code before initializing it. Initializing a backend will store the state file remotely and enable features like locking and workspaces. References = [Terraform Backends]

Rationale for Correct Answer (True):

Variables without defaults are required inputs. If the calling module doesn’t supply a value, Terraform will fail with an error at plan time.

Analysis of Incorrect Option:

False: Incorrect, because Terraform does not assume defaults when none are provided.

Key Concept:

Terraform modules enforce required vs. optional variables depending on whether a default is set.

Environment variables and connection configurations outside of Terraform are secure options for storing secrets for connecting to a Terraform remote backend. Environment variables can be used to set values for input variables that contain secrets, such as backend access keys or tokens. Terraform will read environment variables that start with TF_VAR_ and match the name of an input variable. For example, if you have an input variable called backend_token, you can set its value with the environment variable TF_VAR_backend_token1. Connection configurations outside of Terraform are files or scripts that provide credentials or other information for Terraform to connect to a remote backend. For example, you can use a credentials file for the S3 backend2, or a shell script for the HTTP backend3. These files or scripts are not part of the Terraform configuration and can be stored securely in a separate location. The other options are not secure for storing secrets. A variable file is a file that contains values for input variables. Variable files are usually stored in the same directory as the Terraform configuration or in a version control system. This exposes the secrets to anyone who can access the files or the repository. You should not store secrets in variable files1. Inside the backend block within the Terraform configuration is where you specify the type and settings of the remote backend. The backend block is part of the Terraform configuration and is usually stored in a version control system. This exposes the secrets to anyone who can access the configuration or the repository. You should not store secrets in the backend block4. References = [Terraform Input Variables]1, [Backend Type: s3] 2, [Backend Type: http]3, [Backend Configuration] 4

Rationale for Correct Answer (C):

Credentials should not be hardcoded in Terraform files. Best practice is to configure them via environment variables or secret managers.

Analysis of Incorrect Options:

A: Shared servers introduce risk and drift.

B: Storing secrets in config/version control is insecure.

D: Incorrect since option C is valid.

Key Concept:

Separation of credentials from code is a Terraform security best practice.

Rationale for Correct Answer: Terraform lists are zero-indexed. Given [ " small " , " medium " , " large " ], index 0 is small, index 1 is medium, and index 2 is large. Therefore, medium is var.sizes[1] .

Analysis of Incorrect Options (Distractors):

A: Index 0 returns small, not medium.

C: Index 2 returns large, not medium.

D: Index 3 is out of range for a 3-element list.

Key Concept: Accessing list elements with zero-based indexing in Terraform expressions.

Detailed Explanation:

Rationale for Correct Answer:In Terraform, a data source reference follows the format:

data. < DATA_SOURCE_TYPE > . < NAME > . < ATTRIBUTE >

Here:

Data source type = vsphere_datacenter

Name = dc

Attribute = id

Therefore, the correct reference is:

data.vsphere_datacenter.dc.id

This correctly retrieves the id attribute from the declared data source and passes it to the resource argument.

Analysis of Incorrect Options (Distractors):

B. data.vsphere_datacenter.dc — Incorrect because it references the entire data object, not a specific attribute like id.

C. data.dc.id — Incorrect because it omits the data source type (vsphere_datacenter), making the reference invalid.

D. vsphere_datacenter.dc.id — Incorrect because it is missing the data. prefix required for data sources.

Key Concept:Proper data source referencing syntax: data. < type > . < name > . < attribute > .

This is the meta-argument that you must include in any non-default provider configurations, as it allows you to give a friendly name to the configuration and reference it in other parts of your code. The other options are either invalid or irrelevant for this purpose.

The command that makes your code more human readable is terraform fmt. This command is used to rewrite Terraform configuration files to a canonical format and style, following the Terraform language style conventions and other minor adjustments for readability. The command is optional, opinionated, and has no customization options, but it is recommended to ensure consistency of style across different Terraform codebases. Consistency can help your team understand the code more quickly and easily, making the use of terraform fmt very important. You can run this command on your configuration files before committing them to source control or as part of your CI/CD pipeline. References = : Command: fmt : Using Terraform fmt Command to Format Your Terraform Code

Detailed Explanation:

Rationale for Correct Answer: In Terraform, data sources are referenced using the format:data. < DATA_SOURCE_TYPE > . < NAME > . < ATTRIBUTE >

In this case:

Data source type = aws_ami

Name = web

Attribute = id

Therefore, the correct reference is:

data.aws_ami.web.id

This follows Terraform syntax for accessing attributes from data sources, which is a key concept in configuration authoring.

Analysis of Incorrect Options (Distractors):

B. aws_ami.web.id Incorrect because this format is used for resources, not data sources.

C. web.id Incorrect because it omits both the data prefix and the resource type.

D. data.web.id Incorrect because it is missing the data source type (aws_ami).

Key Concept: Proper referencing of data sources using data. < type > . < name > . < attribute > syntax.

Rationale for Correct Answer: terraform fmt automatically rewrites .tf files to match Terraform’s canonical formatting (indentation, spacing, alignment conventions). This is the standard tool for enforcing consistent style across a team.

Analysis of Incorrect Options (Distractors):

B: Insufficient—formatting is more than tabs vs spaces; terraform fmt handles the full HCL style.

C: terraform validate checks syntax and internal consistency, not formatting.

D: Terraform does not auto-format configuration during apply.

Key Concept: Standardizing HCL formatting with terraform fmt.

Detailed Explanation:

Rationale for Correct Answer: terraform init installs and updates modules used by a Terraform configuration. After changing a module version constraint or version number, you must run terraform init so Terraform downloads the selected module version.

Analysis of Incorrect Options (Distractors):

B. terraform modules. Incorrect. There is no standard Terraform CLI command named terraform modules.

C. terraform plan. Incorrect. plan creates an execution plan but does not install updated module packages.

D. terraform apply. Incorrect. apply applies planned infrastructure changes, but module installation must be handled during initialization first.

Key Concept: Terraform modules are installed and updated during initialization.

In Terraform, the backend configuration, which includes details about where and how state is stored, is specified within the terraform block of your configuration. This block is the correct place to define the backend type and its configuration parameters, such as the location of the state file for a local backend or the bucket details for a remote backend like S3.References = This practice is outlined in Terraform ' s core documentation, which provides examples and guidelines on how to configure various aspects of Terraform ' s behavior, including state backends .

Rationale for Correct Answer: terraform graph outputs a Graphviz DOT representation of Terraform’s dependency graph, which you can pipe into Graphviz tools (e.g., dot) to visualize resource/module dependencies.

Analysis of Incorrect Options (Distractors):

B: terraform show displays state or a plan file in human-readable form (or JSON with -json), not DOT.

C: terraform refresh (deprecated as a standalone command in newer workflows) refreshes state, not graph output.

D: terraform output prints root module outputs, not dependency graphs.

Key Concept: Visualizing Terraform’s dependency graph using terraform graph.

This is the scenario that poses a challenge for this team, if they adopt AWS CloudFormation as their standardized method for provisioning public cloud resources, as CloudFormation only supports AWS services and resources, and cannot be used to provision infrastructure on other cloud platforms such as Azure.

This will trigger a run in the Terraform Cloud workspace, which will perform a plan and apply operation on the infrastructure defined by the Terraform configuration files in the VCS repository.

Terraform providers are not always installed from the Internet. There are other ways to install provider plugins, such as from a local mirror or cache, from a local filesystem directory, or from a network filesystem. These methods can be useful for offline or air-gapped environments, or for customizing the installation process. You can configure the provider installation methods using the provider_installation block in the CLI configuration file.

Detailed Explanation:

Rationale for Correct Answer:

A: terraform plan -out=planfile saves the proposed execution plan so you can later run terraform apply planfile. This supports review and controlled deployments.

B: terraform plan shows what Terraform would change (create/update/destroy) so you can verify changes before applying—this is one of the primary purposes of plan.

Analysis of Incorrect Options (Distractors):

C: Incorrect. Scheduling runs is not a capability of terraform plan (that’s handled by external schedulers/CI systems or HCP Terraform scheduling features—not the CLI plan command itself).

D: Incorrect. Workspaces are selected via terraform workspace select < name > (or by using separate working directories / automation). terraform plan itself doesn’t “execute in a different workspace” without switching context first.

Key Concept:terraform plan for previewing changes and optionally saving an execution plan file for later application.

Rationale for Correct Answer: Setting the module version (for registry modules) pins the module release Terraform will use. By pinning the version, Terraform will not “update” the module to newer releases during terraform init -upgrade or terraform get -update unless you change the version constraint. This is the standard way to control module updates and keep module code stable across runs.

Analysis of Incorrect Options (Distractors):

B (lifecycle): lifecycle is for resources, not module blocks.

C (count): count controls how many module instances are created; it doesn’t control module source updates.

D (source): source tells Terraform where the module comes from; it doesn’t prevent updates by itself (a VCS/ref pin would be done in the source string, but the module block argument that achieves this in the typical module workflow is version for registry modules).

Key Concept: Module version pinning to control module upgrades.

Detailed Explanation:

Rationale for Correct Answer: Infrastructure as Code (IaC) focuses on defining and managing infrastructure using configuration files and automation, rather than manual processes. While IaC provides benefits like automation, reusability, and version control, it does not inherently provide a GUI. In fact, IaC is typically CLI-driven and code-centric, which is the opposite of relying on graphical interfaces.

Analysis of Incorrect Options (Distractors):

A. Reusability of code Incorrect because IaC enables reusable modules and templates, which is a key benefit.

B. Automation Incorrect because IaC automates infrastructure provisioning and management.

D. Versioning Incorrect because IaC configurations can be stored in version control systems (e.g., Git), enabling tracking and rollback.

Key Concept: IaC emphasizes automation, consistency, reusability, and version control, not graphical interfaces.

Sentinel policies are checked after the plan stage of a Terraform run, but before it can be confirmed or the terraform apply is executed3. This allows you to enforce rules on your infrastructure before it is created or modified.

Detailed Explanation:

Rationale for Correct Answer:Setting version = " 3.1.4 " pins the module to that exact version, preventing Terraform from selecting any newer version. This is the strongest guard against unexpected changes (including potential breaking changes) because it does not allow upgrades unless you explicitly change the version constraint.

Analysis of Incorrect Options (Distractors):

A: Incorrect. This allows any version < 3.2 (including 3.1.5, 3.1.9, etc.). Those may still introduce behavioral changes you want to avoid.

B: Incorrect. This forces Terraform to use 3.1.5 or newer, the opposite of what you want.

D: Incorrect. ~ > 3.1.4 allows patch-level updates (e.g., 3.1.5, 3.1.9) and could still introduce changes your team wants to avoid.

Key Concept:Module version constraints and pinning to avoid unexpected upgrades.

Not all standard backend types support state locking and remote operations like plan, apply, and destroy. For example, the local backend does not support remote operations and state locking. State locking is a feature that ensures that no two users can make changes to the state file at the same time, which is crucial for preventing race conditions. Remote operations allow running Terraform commands on a remote server, which is supported by some backends like remote or consul, but not all.

From the Terraform Output Docs – Sensitive:

" Marking an output as sensitive prevents Terraform from showing its value in the CLI output,but it will still bestored in the state file. "

Thus, it protects display, not storage.

To make Terraform ' s logging more verbose for troubleshooting purposes, you must configure the TF_LOG environment variable. This variable controls the level of logging and can be set to TRACE, DEBUG, INFO, WARN, or ERROR, with TRACE providing the most verbose output.References = Detailed debugging instructions and the use of environment variables like TF_LOG for increasing verbosity are part of Terraform ' s standard debugging practices

Rationale for Correct Answer:By default, terraform fmt modifies files in place to match Terraform’s canonical formatting. The -check flag is required to only check formatting without making changes.

Analysis of Incorrect Options (Distractors):

A: Incorrect because formatting changes are applied automatically by default.

Key Concept:terraform fmt enforces consistent formatting by rewriting files unless instructed otherwise.

Rationale for Correct Answer:

C: Securely managed .tfvars files are acceptable if not committed to version control.

D: HCP Terraform provides secure storage for sensitive variables.

E: HashiCorp Vault is designed for secrets management and integrates with Terraform.

Analysis of Incorrect Options (Distractors):

A: Plaintext storage is insecure.

B: Secrets should never be committed to version control.

Key Concept:Sensitive values must be stored using secure secret management solutions.

In Terraform, the correct way to reference a resource attribute is:

pgsql

CopyEdit

resource_type.resource_name.attribute

For example, if the resource block is:

hcl

CopyEdit

resource " kubernetes_namespace " " example " {

metadata {

name = " my-namespace "

}

}

To reference the name attribute, use:

pgsql

CopyEdit

kubernetes_namespace.example.name

Explanation of incorrect answers:

A (resource.kubernetes_namespace.example.name)– Incorrect. Terraform does not use the resource. prefix when referencing resources.

C (data.kubernetes.namespace.name)– Incorrect. This syntax is used fordata sources, not resources.

D (kubernetes_namespace.test.name)– Incorrect. The resource name is " example " , not " test " .

Official Terraform Documentation Reference:

Terraform Resource References

In Terraform, the max function can be used to select the largest number from a list of numbers. The max function takes multiple arguments and returns the highest one. For the list numcpus = [18, 3, 7, 11, 2], using max(numcpus...) will return 18, which is the largest number in the list.

To import the contents of a local file as a string in Terraform, you can use the built-in file function. By specifying file( " id_rsa.pub " ), Terraform reads the contents of the id_rsa.pub file and uses it as a string within your Terraform configuration. This function is particularly useful for scenarios where you need to include file data directly into your configuration, such as including an SSH public key for provisioning cloud instances.References = This information is a standard part of Terraform ' s functionality with built-in functions, as outlined in Terraform ' s official documentation and commonly used in various Terraform configurations.

Detailed Explanation:

Rationale for Correct Answer:Changing count changes the desired number of resource instances. To reconcile real infrastructure with the updated configuration, you run terraform apply (typically after reviewing the plan). Terraform will create/destroy instances as needed to match the new count value.

Analysis of Incorrect Options (Distractors):

A: Incorrect. terraform init is required when you add/change providers, modules, or backend configuration—not for simple variable value changes.

B: Incorrect. Outputs do not change infrastructure; they only display derived values.

C: Incorrect. You generally should not edit state to reflect intended changes; you apply configuration changes and let Terraform update state.

Key Concept:Terraform workflow: update configuration → plan/apply to converge infrastructure to desired state.

Changing the Terraform backend after performing the initial terraform apply is technically possible but strongly discouraged. This is because changing backends can lead to complexities in state management, requiring manual intervention such as state migration to ensure consistency. Terraform ' s documentation and best practices advise planning the backend configuration carefully before applying Terraform configurations to avoid such changes.References = This guidance is consistent with Terraform ' s official documentation, which recommends careful consideration and planning of backend configurations to avoid the need for changes.

Detailed Explanation:

Rationale for Correct Answer: A failed Terraform check block assertion does not block the current operation from executing. check blocks are used for non-blocking validation. If an assertion fails, Terraform reports a warning, but it does not stop the plan or apply operation. This is a common exam trap: check blocks differ from variable validation, preconditions, and postconditions, which can block execution when they fail.

Analysis of Incorrect Options (Distractors):

A. True. Incorrect. Terraform does not block execution because of a failed check block assertion.

Key Concept: Terraform check blocks perform non-blocking assertions and report failures as warnings.

Detailed Explanation:

Rationale for Correct Answer: In Terraform, a resource type usually follows the format < provider > _ < resource_type > . In the exhibit, the resource type is aws_vpc. The prefix aws identifies the provider, and vpc identifies the resource type within that provider. Therefore, the provider is aws.

Analysis of Incorrect Options (Distractors):

A. test Incorrect. test is the value assigned to the name argument.

B. vpc Incorrect. vpc is the resource type, not the provider.

D. main Incorrect. main is the local resource name used to reference this resource in Terraform configuration, such as aws_vpc.main.

Key Concept: Terraform resource type naming convention: < provider > _ < resource_type > .

These are some of the ways that a ticket-based system can slow down infrastructure provisioning and limit the ability to scale, as they introduce delays, bottlenecks, and manual interventions in the process of creating and modifying infrastructure.

Sensitive values such as API tokens should be stored in a secure way, either in Terraform Cloud variables marked as sensitive or in HashiCorp Vault. Storing secrets in version control systems or plaintext files is not recommended.

Detailed Explanation:

Rationale for Correct Answer: The Terraform Registry provides module documentation, including required inputs, optional inputs with default values, outputs, dependencies, resources, and usage examples.

Analysis of Incorrect Options (Distractors):

A. Required input variables. Correct but incomplete.

B. Outputs. Correct but incomplete.

C. Optional input variables and default values. Correct but incomplete.

Key Concept: Terraform Registry module documentation exposes inputs, outputs, versions, and usage details.

Detailed Explanation:

Rationale for Correct Answer: terraform init installs required provider plugins declared in the Terraform configuration. These providers can come from HashiCorp, partner publishers, or community publishers through the Terraform Registry or another configured provider source.

Analysis of Incorrect Options (Distractors):

B. False. Incorrect. Terraform is not limited to only HashiCorp-maintained providers. It can initialize and install third-party provider plugins.

Key Concept: Terraform providers are installed during initialization with terraform init.

The -replace flag is used with the terraform apply command when there is a need to explicitly force Terraform to destroy and then recreate a specific resource during the next apply. This can be necessary in situations where a simple update is insufficient or when a resource must be re-provisioned to pick up certain changes.

The terraform fmt command is used to rewrite Terraform configuration files to a canonical format and style. This command applies a subset of the Terraform language style conventions, along with other minor adjustments for readability. Running this command on your configuration files before committing them to source control can help ensure consistency of style between different Terraform codebases, and can also make diffs easier to read. You can also use the -check and -diff options to check if the files are formatted and display the formatting changes respectively2. Running the terraform fmt command during the code linting phase of your CI/CD process can help automate this process and enforce the formatting standards for your team. References = [Command: fmt]2

 This is the command that can add existing resources into Terraform state, by matching them with the corresponding configuration blocks in your files. 

This is a secure way to protect sensitive data in the state file, as it will be encrypted at rest and in transit2. The other options are not recommended, as they could lead to data loss, errors, or security breaches.

Detailed Explanation:

Rationale for Correct Answer: The terraform init command is used to initialize a working directory containing Terraform configuration files. It performs tasks such as downloading providers, initializing backends, and setting up modules. It does not create any configuration files, including main.tf. Users must create .tf files manually.

Analysis of Incorrect Options (Distractors):

A. True Incorrect because Terraform does not automatically generate configuration files during initialization. It only prepares the environment for execution.

Key Concept: Understanding the role of terraform init in initializing the working directory, not generating configuration files.

Terraform state files are not automatically encrypted by default. Sensitive values are stored in plaintext within the state file. However, you can protect the state file by using remote backends that support encryption, such as AWS S3 with server-side encryption enabled or Terraform Cloud, which offers encrypted state storage.

Rationale for Correct Answer:terraform destroy removes all resources currently tracked in the Terraform state file by issuing destroy requests to the configured providers. It does not delete configuration files or providers themselves.

Analysis of Incorrect Options (Distractors):

B: Terraform never deletes configuration files.

C: Terraform only destroys resources it manages, not all provider infrastructure.

D: Terraform does not delete the state file by default.

Key Concept:terraform destroy enforces removal of all managed infrastructure.

terraform state listonly displays resources stored in the state filebut doesnot interact with the cloud provideror refresh the state.

terraform plan, terraform apply, and terraform destroycompare or modify the infrastructure, so theyrefresh the stateto ensure accuracy.

Official Terraform Documentation Reference:

terraform state list - HashiCorp Documentation

Detailed Explanation:

Rationale for Correct Answer:Terraform requires provider aliases when you configure the same provider multiple times in one configuration. You must define the second AWS provider with an alias, then explicitly tell the resource to use it with the provider meta-argument:

provider " aws " {

region = " us-east-1 "

}

provider " aws " {

alias = " west "

region = " us-west-2 "

}

resource " aws_instance " " example_us_west_2 " {

provider = aws.west

ami = data.aws_ami.ubuntu.id

instance_type = " t3.micro "

}

This is a core Terraform objective: selecting the correct provider configuration for a resource when multiple instances exist.

Analysis of Incorrect Options (Distractors):

B: Incorrect. Provider blocks do not support the syntax provider " aws " " west " { ... }. Aliasing is done with alias = " west " .

C: Incorrect. You cannot invent a new provider type name like aws_west. The provider remains aws; you differentiate configurations via alias.

D: Incorrect. Terraform will not automatically choose between multiple provider configurations for the same provider; you must disambiguate using aliases and provider = ....

Key Concept:Provider aliases and the provider meta-argument for multi-region (or multi-account) deployments.

Terraform providers are not part of the Terraform core binary. Providers are distributed separately from Terraform itself and have their own release cadence and version numbers. Providers are plugins that Terraform uses to interact with various APIs, such as cloud providers, SaaS providers, and other services. You can find and install providers from the Terraform Registry, which hosts providers for most major infrastructure platforms. You can also load providers from a local mirror or cache, or develop your own custom providers. To use a provider in your Terraform configuration, you need to declare it in the provider requirements block and optionally configure its settings in the provider block. References = : Providers - Configuration Language | Terraform : Terraform Registry - Providers Overview | Terraform

The Terraform collection type that should be used to store key/value pairs is map. A map is a collection of values that are accessed by arbitrary labels, called keys. The keys and values can be of any type, but the keys must be unique within a map. For example, var = { key1 = " value1 " , key2 = " value2 " } is a map with two key/value pairs. Maps are useful for grouping related values together, such as configuration options or metadata. References = [Collection Types], [Map Type Constraints]