HCTA Exam Prep Free practice test →

Free HCTA Practice Questions

10 free, exam-style HCTA (HCTA) practice questions with answers and explanations. No signup required. Work through them below, then take the full free HCTA practice test to study every exam domain.

Question 1

In a Terraform configuration, what determines the order in which Terraform creates resources?

  1. A dependency graph Terraform builds from references between resources
  2. The top-to-bottom order in which the resource blocks are written in the file
  3. An explicit depends_on argument that must be added to every resource
  4. The alphabetical order of each resource's type and name
Show answer & explanation

Correct answer: A - A dependency graph Terraform builds from references between resources

Question 2

A provider is constrained with ~> 1.2.0. Which provider versions is Terraform allowed to select?

  1. Only version 1.2.0, since the version is pinned exactly
  2. Any 1.x release, up to but not including 2.0.0
  3. Any release from 1.2.0 up to but not including 1.3.0
  4. Any release of 1.2.0 or higher, including 1.3.5 and 1.4.0
Show answer & explanation

Correct answer: C - Any release from 1.2.0 up to but not including 1.3.0

Question 3

An engineer runs terraform plan -out=tfplan, then later runs terraform apply tfplan. Assuming the state has not changed in between, what does Terraform do with the saved plan?

  1. It generates a fresh plan first, then applies it after you approve
  2. It prompts for confirmation, then applies the saved changes
  3. It refuses to apply because the saved plan has expired
  4. It applies exactly the saved plan, without prompting for approval
Show answer & explanation

Correct answer: D - It applies exactly the saved plan, without prompting for approval

Question 4

While reviewing the output of terraform plan, an engineer sees -/+ next to a resource. What will Terraform do to that resource?

  1. Update the resource in place without recreating it
  2. Destroy the existing resource and then create a new one
  3. Create a brand-new replacement resource first, then destroy the old one
  4. Remove the resource from state without destroying it
Show answer & explanation

Correct answer: B - Destroy the existing resource and then create a new one

Question 5

The variable region is set to us-east-1 in terraform.tfvars and is also passed on the command line as -var="region=us-west-2". Which value does Terraform use?

  1. us-west-2, because a command-line -var flag has the highest precedence
  2. us-east-1, because terraform.tfvars is loaded automatically
  3. us-east-1, because file definitions override command-line flags
  4. Neither value is used; Terraform stops with an error about the conflicting definitions
Show answer & explanation

Correct answer: A - us-west-2, because a command-line -var flag has the highest precedence

Question 6

An engineer must manage several S3 buckets that are not interchangeable, so that removing one from the middle does not change the identity of the others. Which approach is recommended?

  1. Use count with a list, referencing each bucket by its numeric index
  2. Use count together with count.index and the element() function
  3. Use for_each with a map or set, so each bucket has a stable key
  4. Write each bucket as its own separate hard-coded resource block
Show answer & explanation

Correct answer: C - Use for_each with a map or set, so each bucket has a stable key

Question 7

A team wants to pin a module to a specific release using the version argument. For which module source does the version argument actually take effect?

  1. A module sourced from a local file path
  2. A module sourced from a Git repository URL
  3. A module sourced from a direct HTTPS archive URL
  4. A module sourced from the Terraform Registry
Show answer & explanation

Correct answer: D - A module sourced from the Terraform Registry

Question 8

A database password is passed into a resource using an input variable marked sensitive = true. How is that password stored in the Terraform state file?

  1. Encrypted using the backend's encryption key
  2. In plain text
  3. Hashed, so the original value cannot be recovered
  4. Not stored at all, because it is marked sensitive
Show answer & explanation

Correct answer: B - In plain text

Question 9

An administrator created an S3 bucket manually in the cloud console, then runs terraform import aws_s3_bucket.data my-existing-bucket. What does this command do?

  1. Records the existing bucket in state, but does not write its configuration
  2. Automatically generates a complete resource configuration block for the bucket
  3. Creates a brand-new S3 bucket and adds it to the configuration
  4. Deletes the manual bucket and recreates it under Terraform's control
Show answer & explanation

Correct answer: A - Records the existing bucket in state, but does not write its configuration

Question 10

In HCP Terraform, a Sentinel policy is configured with the soft-mandatory enforcement level. What happens when a run violates that policy?

  1. The run continues and the violation is recorded only as a warning
  2. The run is blocked and can never be overridden
  3. The run is blocked, but an authorized user can override it and continue
  4. The policy is skipped entirely unless it is explicitly enabled for that individual workspace
Show answer & explanation

Correct answer: C - The run is blocked, but an authorized user can override it and continue

Ready for the real thing?

Practice hundreds more HCTA questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing