How to Pass HashiCorp Terraform Associate (004) in 2026: Complete Study Guide

# How to Pass HashiCorp Terraform Associate (004) in 2026: Complete Study Guide Infrastructure as Code has moved from a DevOps niche skill to a baseline requirement for cloud engineers, platform teams, and anyone who touches cloud infrastructure at scale. Terraform is the most widely adopted IaC tool on the planet, and the HashiCorp Certified Terraform Associate (004) is the certification that proves you know how to use it correctly. This guide covers everything you need to pass the exam in 2026: what changed from version 003, a breakdown of all 8 exam domains, the best study resources, a practical 6-week plan, and exam-day tips that make a real difference. ## Why This Certification Matters in 2026 The Terraform Associate is the most recognized IaC certification in the industry. Job postings for cloud engineers, DevOps roles, and platform engineers increasingly list it as preferred or required. Unlike cloud provider certifications that are siloed to AWS, Azure, or GCP, Terraform is multi-cloud by nature — a single certification that demonstrates value across every major platform. The exam is accessible. It is priced at $70.50, takes only 60 minutes, and does not require hands-on lab work during the test (unlike the CKA for Kubernetes). That said, you absolutely need real hands-on experience to pass. The questions are scenario-driven and designed to catch candidates who only memorized documentation rather than actually running `terraform plan` and `terraform apply` against real infrastructure. ## Exam Facts at a Glance | Detail | Value | |---|---| | Exam code | Terraform Associate 004 | | Questions | 57 multiple-choice and multi-select | | Duration | 60 minutes | | Passing score | ~70% | | Price | $70.50 USD | | Format | Online proctored (Pearson VUE) | | Hands-on labs | No | | Prerequisites | None (recommended: 6+ months Terraform experience) | ## What Changed from 003 to 004 If you studied for or passed the 003 version, the 004 update is not a dramatic overhaul, but there are important differences worth knowing. The biggest change is branding and scope. **Terraform Cloud has been rebranded to HCP Terraform** (HashiCorp Cloud Platform Terraform). The 004 exam explicitly tests HCP Terraform concepts as a named domain, rather than treating Terraform Cloud as a supplementary topic. This means workspace types, VCS-driven runs, the run lifecycle, and Sentinel policy frameworks are tested more deliberately. Other smaller changes include the formal deprecation of `terraform taint` (replaced by `-replace`) and `terraform refresh` (replaced by `terraform apply -refresh-only`). Both deprecated commands still appear in exam questions — but the exam now expects you to know the correct modern equivalents. The overall domain structure was also reorganized and expanded to 8 domains, with Terraform Configuration gaining significant weight at 26%. ## The 8 Exam Domains ### Domain 1: IaC Concepts (6%) This domain covers the foundational theory behind Infrastructure as Code. The exam tests your understanding of the difference between **declarative and imperative** approaches. Terraform is declarative — you describe the desired end state, and Terraform figures out how to reach it. Imperative tools like scripts require you to specify every step. Key topics: benefits of IaC (consistency, version control, automation, repeatability), when IaC is appropriate, and how Terraform fits into the broader IaC landscape alongside tools like Ansible, Pulumi, and CloudFormation. ### Domain 2: Terraform Fundamentals (10%) This domain focuses on the core building blocks of any Terraform configuration. You must understand: - **Providers**: plugins that authenticate to and interact with APIs (AWS, Azure, Google, etc.) - **Resources**: the primary unit of infrastructure (an EC2 instance, an S3 bucket, a VPC) - **Data sources**: read-only lookups that fetch information from providers without creating resources - **Variables**: parameterize configurations with `variable {}` blocks - **Outputs**: expose values from a configuration with `output {}` blocks Know how to declare each of these, the difference between `resource` and `data`, and how `terraform.tfvars` and environment variables interact with declared variables. ### Domain 3: Terraform Core Workflow (16%) The core workflow is `init → plan → apply → destroy`. You must know what each command does, in what order they must run, and what each command does or does NOT do. - `terraform init`: initializes the working directory, downloads providers, configures the backend - `terraform plan`: creates an execution plan, shows what will change — does NOT modify infrastructure - `terraform apply`: executes the plan and modifies real infrastructure - `terraform destroy`: destroys all managed infrastructure (equivalent to `terraform apply -destroy`) Common exam questions ask about the correct sequence, what happens if you skip `init`, and what `plan` output means. ### Domain 4: Terraform Configuration (26%) This is the heaviest domain and deserves the most study time. Topics include: - **Type constraints**: string, number, bool, list, map, set, object, tuple, any - **Locals**: local values computed from expressions, used to avoid repetition - **Built-in functions**: `toset()`, `tomap()`, `length()`, `lookup()`, `merge()`, `flatten()`, `file()`, `jsonencode()` - **Conditionals**: ternary expressions (`condition ? true_val : false_val`) - **Dynamic blocks**: generate repeated nested blocks programmatically - **`count` and `for_each`**: create multiple resource instances; `count` uses integer indexes, `for_each` uses named keys from a set or map - **`depends_on`**: explicit dependency declaration when implicit dependencies are insufficient - **`lifecycle` meta-arguments**: `create_before_destroy`, `prevent_destroy`, `ignore_changes`, `replace_triggered_by` ### Domain 5: Terraform Modules (10%) Modules are reusable packages of Terraform configuration. The exam distinguishes between the **root module** (the working directory) and **child modules** (modules called from the root or other modules). Key topics: how to call a module with the `module {}` block, how to pass inputs and consume outputs, and how to source modules from: - Local file paths (`source = "./modules/vpc"`) - The Terraform Registry (`source = "terraform-aws-modules/vpc/aws"`) - GitHub and other VCS systems - S3 buckets (for private module registries) Version pinning in modules is critical for reproducibility. Know that `version = "~> 5.0"` allows patch and minor updates but not major version changes. ### Domain 6: Terraform State (16%) State is how Terraform tracks what it has created. The state file (`terraform.tfstate`) maps your configuration to real-world resources. Without it, Terraform cannot determine what exists or what needs to change. Key topics: - Why state exists and what information it contains - **Remote state**: storing state in S3, Azure Blob Storage, or HCP Terraform rather than locally - **State locking**: preventing concurrent operations from corrupting state (DynamoDB with S3 backend, built into HCP Terraform) - **`terraform import`**: bring existing infrastructure under Terraform management - **State manipulation commands**: `terraform state list`, `terraform state mv`, `terraform state rm` - `terraform.tfstate.backup`: automatically created before each state modification ### Domain 7: Maintain and Update Terraform (10%) This domain covers operational tasks for managing Terraform configurations over time: - **`terraform fmt`**: formats configuration files to canonical style - **`terraform validate`**: checks syntax and internal consistency — does NOT connect to providers - **`terraform taint` (deprecated)**: formerly used to mark a resource for recreation; now use `-replace` flag with `terraform apply` - **`terraform refresh` (deprecated)**: formerly used to reconcile state with real infrastructure; now use `terraform apply -refresh-only` - **Drift**: detecting and resolving differences between state and real infrastructure - Provider and module version constraints and upgrade workflows ### Domain 8: HCP Terraform (6%) HCP Terraform (formerly Terraform Cloud) is HashiCorp's managed Terraform service. The exam tests three workspace run types: - **VCS-driven**: runs triggered automatically by commits to a connected version control repository - **CLI-driven**: runs initiated from a local terminal using `terraform apply` but executed remotely - **API-driven**: runs triggered programmatically via the HCP Terraform API The run lifecycle goes: **plan → cost estimation → policy check (Sentinel) → apply**. Know this order. Sentinel policies can be hard-mandatory (block the run), soft-mandatory (require manual override), or advisory (warn only). ## Study Resources **Free resources that are genuinely sufficient:** - **HashiCorp Developer tutorials** (developer.hashicorp.com): The official learning paths for Terraform are free and cover every exam domain with hands-on labs. - **HCP Terraform free tier**: Create a free account at app.terraform.io. The free tier supports 500 managed resources and is more than enough for exam prep. - **Terraform Registry documentation** (registry.terraform.io): Reading provider documentation is a core skill the exam tests indirectly. **Paid resources worth considering:** - **Official HashiCorp Study Guide**: Available through the HashiCorp Developer portal. Concise and exam-aligned. - **Practice exam platforms**: CertLand's Terraform Associate practice exams include 340 questions with detailed explanations — significantly more exposure than the 57 questions on the real exam. ## 6-Week Study Plan **Week 1 — Foundations**: Complete the HashiCorp Learn "Get Started" track for your preferred cloud provider. Focus on init, plan, apply, destroy. Understand providers and resources. **Week 2 — Configuration deep dive**: Work through variables, outputs, locals, and functions. Write configurations that use type constraints, conditionals, and `for_each`. This is the highest-weight domain. **Week 3 — State and backends**: Configure an S3 remote backend with DynamoDB locking. Practice `terraform import`, `terraform state mv`, and `state rm`. Understand what the state file contains by reading it. **Week 4 — Modules**: Build a reusable module from scratch. Call it from a root module with input variables and consume its outputs. Source a community module from the Terraform Registry with version pinning. **Week 5 — HCP Terraform and maintenance**: Create a free HCP Terraform account. Set up a VCS-driven workspace connected to a GitHub repository. Understand the run lifecycle. Review fmt, validate, and the deprecated commands. **Week 6 — Review and practice exams**: Take at least two full practice exam sets. Review every wrong answer. Focus your remaining time on your weakest domain based on practice results. ## Top 5 Exam Tips **1. Know the workflow order cold.** `init → plan → apply` is tested in multiple ways. Know what each step does and does not do. `plan` never modifies infrastructure. `validate` never connects to a provider. **2. Deprecation awareness is tested.** The exam expects you to know that `taint` is replaced by `-replace` and that `refresh` is replaced by `apply -refresh-only`. Both old and new forms may appear in questions. **3. `count` vs `for_each` is a recurring trap.** `count` creates indexed resources (resource[0], resource[1]). `for_each` creates named instances using keys from a map or set. If you need to remove a resource from the middle of a list, `for_each` avoids destroying and recreating other resources. **4. `sensitive = true` does not encrypt state.** A variable or output marked sensitive will be hidden in CLI output, but the value is still stored in plaintext in the state file. Secure your state backend separately. **5. Read the HCP Terraform run lifecycle diagram.** The order is: plan, cost estimation, policy check, apply. Many candidates assume policy check comes before cost estimation or that apply happens right after plan. Knowing the exact sequence will answer multiple HCP Terraform questions correctly. ## Final Thoughts The Terraform Associate 004 is achievable with 4-6 weeks of focused preparation. The exam rewards candidates who have actually used Terraform in practice — not just read about it. Stand up real infrastructure, break things intentionally, and read the error messages carefully. That hands-on experience is what separates candidates who barely pass from those who finish with time to spare. Use the practice questions on CertLand to stress-test your knowledge across all 8 domains before exam day. The more scenarios you work through, the fewer surprises you will encounter in the actual exam.