Terraform Associate Study Guide 2026 (004 Exam Prep)

Terraform is the de facto standard for Infrastructure as Code (IaC), and the HashiCorp Certified: Terraform Associate is the credential that proves you can actually use it. It's short, it's affordable, and it lands on DevOps and platform-engineering job descriptions constantly. If you write or maintain infrastructure, this is one of the highest-return exams you can sit.

This guide covers the current version of the exam, exactly what's tested across the eight objective domains, the traps that catch first-timers, and a study plan that gets you exam-ready in two to three weeks.

What the certification is (and which version to study)

The current exam is the Terraform Associate (004). It launched January 8, 2026, replacing the older 003 version, and it's built on Terraform 1.12. If you find prep material referencing 003 or Terraform 1.3, it's out of date — study for 004.

The cert validates that you understand IaC concepts and can operate Terraform's core workflow: writing configuration, planning changes, applying them, and managing state. It is deliberately provider-agnostic — there are no AWS, Azure, or GCP-specific questions. You're being tested on Terraform itself, not on any one cloud.

Basic cloud fundamentals and comfort in a terminal help, but there are no formal prerequisites. Anyone can register and sit it.

Exam structure

• ~57 questions
• 60 minutes
• Online proctored, closed book
• Question formats: true/false, single-select multiple choice, and multiple answer (select all that apply)
• Cost: $70.50 USD
• Validity: 2 years — you recertify by retaking the current exam

One thing to set expectations on: HashiCorp does not publish a passing score. You won't find an official percentage, and anyone quoting one is guessing. Aim to be consistently strong across all domains rather than chasing a specific number.

The eight objective domains

The 004 exam is organized into eight objectives. They are not weighted equally in practice — configuration, workflow, and state are where most of your points live. Here's each one, with the highest-yield areas called out.

1. Understand Infrastructure as Code (IaC) concepts

The "why" of Terraform. Know what IaC is, the benefits (repeatability, version control, reviewable changes), and how declarative infrastructure differs from manual or imperative provisioning.

2. Understand Terraform's purpose vs other IaC

Terraform fundamentals: what providers are and how they're sourced, and the role of state. This is foundational for everything that follows.

3. Understand Terraform basics — the core workflow

Highest-yield. You must know the core commands cold:

• terraform init — initialize the working directory, download providers
• terraform validate — check configuration syntax
• terraform plan — preview changes without applying
• terraform apply — make the changes real
• terraform destroy — tear down managed infrastructure
• terraform fmt — canonically format configuration files

Expect questions on what each command does, the order they run in, and what happens when you skip one.

4. Read, generate, and modify configuration (HCL)

This is the largest domain — over-invest here. HashiCorp Configuration Language (HCL) is the heart of the exam:

• Variables and outputs
• Resources vs data sources (data sources read; resources create/manage)
• Dependencies — implicit vs explicit (depends_on)
• Complex types (lists, maps, sets, objects)
• Functions (string, numeric, collection, etc.)
• Custom condition / validation rules
• Sensitive data handling, including integration with Vault

If you master one domain, make it this one.

5. Use Terraform modules

Modules package and reuse configuration. Know module sources (local, Registry, Git), version pinning, and variable scope — how inputs and outputs pass between a root module and child modules.

6. Use Terraform state

Backends, state locking, and drift. Understand where state lives, why locking matters for teams, and how Terraform detects when real infrastructure has diverged from what state records.

7. Implement and maintain Terraform

Operational tasks: importing existing resources into state, using the terraform state CLI subcommands, and turning on verbose logging (via TF_LOG) to troubleshoot.

8. HCP Terraform capabilities

Expanded in 004. Know workspaces, projects, and governance features in HCP Terraform (the managed remote-run platform), and how remote execution differs from running locally.

Where your points are: core workflow commands, HCL configuration, state/backends/locking, modules, and HCP Terraform. Weight your study time toward those five.

Common pitfalls that sink first-timers

These are the concepts people get wrong on exam day. Learn the distinction, not just the vocabulary.

State vs config vs real infrastructure

Three separate things. Configuration is what you wrote (.tf files). State is Terraform's record of what it created. Real infrastructure is what actually exists in the cloud. Drift happens when real infrastructure no longer matches state — someone changed a resource by hand. Terraform detects drift during plan by comparing state to reality. Keep these three straight and a whole category of questions becomes easy.

Which backends support locking

Not every backend locks. Know the ones that do:

• S3 — via a DynamoDB table, or S3's native lockfile support
• HCP Terraform
• Consul

The local backend does not lock across machines. If a question implies two engineers running apply at once, the answer hinges on whether the backend supports locking.

CLI workspaces vs HCP Terraform workspaces

These share a name but are not the same thing. CLI workspaces are lightweight state namespaces within a single backend. HCP Terraform workspaces are full managed environments with their own variables, runs, and access controls. Questions will try to blur the two.

Version constraints only work with the Registry

Module and provider version constraints (version = "~> 5.0") only apply when sourcing from a registry. Pull a module directly from raw Git or a local path and version constraints are ignored — you pin with a Git ref instead.

Prefer implicit dependencies over depends_on

Terraform builds a dependency graph automatically when one resource references another's attribute. That implicit dependency is preferred. Reach for explicit depends_on only when there's a relationship Terraform can't infer from references.

sensitive = true hides output — it does not encrypt state

A big one. Marking a value sensitive = true redacts it from CLI output and plan diffs. It does not encrypt the state file. Secrets can still sit in plaintext in state, which is why state files must be stored and access-controlled carefully.

Hands-on prep beats reading

You will not pass this by watching videos alone. The good news: you don't need a cloud account to practice. Install Terraform locally and drill the workflow with the null, random, and local providers.

• Run init → fmt → validate → plan → apply → destroy repeatedly until the loop is muscle memory
• Deliberately create drift (change something outside Terraform) and watch how plan reports it
• Import an existing resource into state, then inspect it with terraform state show
• Build and version a module, then consume it from a root module
• Spin up a free HCP Terraform organization and trigger a remote run so the Domain 8 material isn't abstract

Every one of these maps directly to an exam objective. Time on the CLI is the best study investment you can make.

A realistic 2-3 week study plan

Assumes you already have some technical background and can put in an hour or two most days.

Week 1 — Concepts, workflow, and HCL

Cover IaC concepts (Domain 1), Terraform fundamentals and providers/state (Domains 2, 6), and the core workflow commands (Domain 3). Then start HCL (Domain 4): variables, outputs, resources vs data sources, and dependencies. Practice the full init→apply→destroy loop daily with the null/random providers.

Week 2 — Deeper HCL, modules, and state

Finish HCL: complex types, functions, custom validation, and sensitive-data handling. Build and version a module (Domain 5). Go deep on state (Domain 6): backends, locking, and drift — deliberately create drift and import a resource. Introduce the maintenance tooling (Domain 7): terraform state subcommands and verbose logging.

Week 3 — HCP Terraform, weak spots, and review

Work through HCP Terraform (Domain 8) with a free org and a remote run. Then hammer the pitfalls above until the distinctions are automatic. Spend the back half of the week on practice questions, drilling anything you miss. If you're on a two-week timeline, fold this into the end of week 2 and lean harder on hands-on reps.

Frequently asked questions

How much does the Terraform Associate exam cost?

$70.50 USD.

How many questions are on it?

About 57 questions in 60 minutes, a mix of true/false, single-select, and multiple-answer.

How long is the certification valid?

Two years. You recertify by taking the current version of the exam.

What's the passing score?

HashiCorp does not publish a passing score. Don't trust any specific percentage you see quoted — prepare to be strong across every domain instead.

Do I need to know AWS or Azure?

No. The exam is provider-agnostic — no cloud-specific questions. You can prepare entirely with the local/null/random providers.

What if I fail?

There's a 7-day wait between attempts and a maximum of 4 attempts per 365 days. There's no free retake for the Associate, so make the first sitting count.

Is the exam worth your time?

Short answer: for most infrastructure-adjacent engineers, yes. If you want the full value case — who benefits most, why IaC skills are in demand, and how this pairs with a cloud cert — read our companion piece on whether the Terraform Associate is worth it.

---

Ready to test yourself? Run free practice questions for the Terraform Associate — no card, no email-trap, written by people who've passed HashiCorp's exams.