HashiCorp Updated Terraform-Associate-004 Exam Questions and Answers by jace

The correct answer is A because Terraform logging is controlled primarily by environment variables. TF_LOG_PATH only tells Terraform where to write the log file; it does not enable logging or choose the log verbosity. To generate detailed logs, you must set TF_LOG. The TRACE level is the most verbose logging level and includes very detailed operational information, including debug-level messages and provider/plugin communication details. Common TF_LOG values include TRACE, DEBUG, INFO, WARN, and ERROR. There is no valid log argument inside the terraform block for enabling runtime logs. Updating the Terraform CLI configuration file is not the documented way to enable standard Terraform logging. The terraform output command only displays output values from state and is unrelated to diagnostic logging.

Detailed Explanation:

Rationale for Correct Answer:Refactoring (like moving resources into a module) changes resource addresses. Terraform will plan destroy/create unless it knows the resources were moved. The supported mechanism is a moved block, which tells Terraform how to map the old address to the new address so it updates state without recreating resources.

Analysis of Incorrect Options (Distractors):

B: Incorrect. terraform console is for evaluating expressions and inspecting values; it is not a supported state editor.

C: Incorrect. Manually editing terraform.tfstate is unsafe and not the recommended/supported approach (risk of corruption and subtle errors).

D: Incorrect. Renaming resources in a cloud console does not update Terraform state addresses and usually doesn’t solve Terraform address refactors.

Key Concept:State-aware refactoring using moved blocks to preserve resources while changing their addresses.

The best way to automatically and proactively enforce the security control that new AWS S3 buckets must be private and encrypted at rest is with a Sentinel policy, which runs before every apply. Sentinel is a policy as code framework that allows you to define and enforce logic-based policies for your infrastructure. Terraform Cloud supports Sentinel policies for all paid tiers, and can run them before any terraform plan or terraform apply operation. You can write a Sentinel policy that checks the configuration of the S3 buckets and ensures that they have the proper settings for privacy and encryption, and then assign the policy to your Terraform Cloud organization or workspace. This way, Terraform Cloud will prevent any changes that violate the policy from being applied. References = [Sentinel Policy Framework], [Manage Policies in Terraform Cloud] , [Write and Test Sentinel Policies for Terraform]

Rationale for Correct Answer: depends_on explicitly adds a dependency edge in Terraform’s graph. By adding depends_on = [azurerm_role_assignment.kv_access] to the web app resource, you force Terraform to create the role assignment first, even if Terraform can’t infer the dependency from attribute references.

Analysis of Incorrect Options (Distractors):

B: create_before_destroy is a lifecycle setting relevant to replacement behavior, not initial create ordering between independent resources.

C: File/block order does not control creation order; Terraform uses its dependency graph.

D: count controls quantity, not ordering.

Key Concept: Dependency graph and explicit dependencies via depends_on.