HCTAO Exam Prep Free practice test →

Free HCTAO Practice Questions

10 free, exam-style HCTAO (HCTAO) practice questions with answers and explanations. No signup required. Work through them below, then take the full free HCTAO practice test to study every exam domain.

Question 1

A configuration creates five S3 buckets using `count` over a list of bucket names. After the second name is removed from the list, `terraform plan` proposes destroying and recreating buckets that were never actually changed. What is the BEST way to avoid this churn?

  1. Add `lifecycle { ignore_changes = [bucket] }` to the bucket resource
  2. Sort the list of names alphabetically before each apply
  3. Use `for_each` keyed on the bucket names instead of `count`
  4. Keep `count` but convert the list into a set of strings
Show answer & explanation

Correct answer: C - Use `for_each` keyed on the bucket names instead of `count`

Question 2

A team must bring 12 manually created EC2 instances under Terraform management. The onboarding must be reviewable in a pull request and reproducible across environments. Which approach BEST meets these requirements?

  1. Add `import` blocks to the configuration, then run `terraform plan` and `apply`
  2. Run `terraform import` once for each of the 12 instances and commit the updated state file
  3. Use `terraform state push` to merge the instances into the current state
  4. Run `terraform apply -refresh-only` so the instances are adopted automatically
Show answer & explanation

Correct answer: A - Add `import` blocks to the configuration, then run `terraform plan` and `apply`

Question 3

The variable `region` is set three ways for the same run: `us-west-2` in `terraform.tfvars`, `eu-west-1` via the `TF_VAR_region` environment variable, and `us-east-1` using `-var` on the command line. Which value does Terraform use?

  1. eu-west-1, because environment variables take precedence
  2. us-west-2, because `terraform.tfvars` is loaded automatically
  3. Terraform halts with an error because the definitions conflict with each other
  4. us-east-1, because a `-var` flag has the highest precedence
Show answer & explanation

Correct answer: D - us-east-1, because a `-var` flag has the highest precedence

Question 4

An engineer renames a resource from `aws_instance.app` to `aws_instance.web` in the configuration. `terraform plan` now shows the instance will be destroyed and recreated. Which change preserves the existing instance under its new name?

  1. Force replacement with `terraform apply -replace=aws_instance.web`
  2. Add a `moved` block from the old address to the new one
  3. Add `lifecycle { prevent_destroy = true }` to stop the destruction
  4. Add `lifecycle { create_before_destroy = true }` to the resource block
Show answer & explanation

Correct answer: B - Add a `moved` block from the old address to the new one

Question 5

In HCP Terraform, a Sentinel policy must block non-compliant runs, but an organization owner needs the ability to override the failure and proceed in exceptional cases. Which enforcement level meets this requirement?

  1. advisory
  2. soft-mandatory
  3. hard-mandatory
  4. optional
Show answer & explanation

Correct answer: B - soft-mandatory

Question 6

Configuration B reads from Configuration A's state using a `terraform_remote_state` data source. Which data from Configuration A can Configuration B actually access?

  1. Every resource attribute stored in Configuration A's state
  2. All input variables and local values defined in Configuration A
  3. Only the values Configuration A declares as outputs
  4. Only the resources that Configuration A marks as shared
Show answer & explanation

Correct answer: C - Only the values Configuration A declares as outputs

Question 7

A developer marks a database password variable with `sensitive = true` and concludes the secret is now safe. Which statement accurately describes what `sensitive = true` does?

  1. It redacts the value in CLI output, but state still stores it in plaintext
  2. It encrypts the value inside the Terraform state file automatically
  3. It removes the value from the state file entirely once applied
  4. It does nothing on its own unless you also enable encryption on the state backend
Show answer & explanation

Correct answer: A - It redacts the value in CLI output, but state still stores it in plaintext

Question 8

An engineer adds `version = "~> 2.0"` to a `module` block whose `source` is a local path such as `./modules/network`. What is the result?

  1. Terraform pulls version 2.0 of the module from the local directory
  2. Terraform treats the constraint as a no-op and uses the local module
  3. Terraform selects the highest matching 2.x tag from the local module's Git commit history
  4. Terraform errors, because version constraints are not valid for local modules
Show answer & explanation

Correct answer: D - Terraform errors, because version constraints are not valid for local modules

Question 9

A pipeline runs `terraform plan -out=tfplan`, a reviewer approves, and the pipeline then runs `terraform apply tfplan`. Adding `-var` to the apply step causes Terraform to error. Why?

  1. The `-var` flag is only accepted by `terraform init`, not `apply`
  2. `terraform apply` cannot accept variable flags at all when it runs in an automated pipeline
  3. A saved plan already contains the variable values, which cannot be overridden
  4. A saved plan ignores every command-line flag except `-auto-approve`
Show answer & explanation

Correct answer: C - A saved plan already contains the variable values, which cannot be overridden

Question 10

A configuration applies fine on a developer's macOS laptop, but the Linux CI pipeline fails during `terraform init`, reporting that the dependency lock file is missing the required provider hashes. What is the correct fix?

  1. Run `terraform providers lock -platform=...` to record hashes for every target platform
  2. Delete the `.terraform.lock.hcl` file from the repository so CI regenerates it on every pipeline run
  3. Permanently add the `-upgrade` flag to the CI `terraform init` step
  4. Set `TF_LOG=TRACE` in CI so Terraform skips provider hash verification
Show answer & explanation

Correct answer: A - Run `terraform providers lock -platform=...` to record hashes for every target platform

Ready for the real thing?

Practice hundreds more HCTAO questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing