TERRAFORM ASSOCIATE (003)
Last-Minute
Cheat Sheet
A practical, exam-focused revision guide — written in plain English, with the commands,
distinctions, and traps most worth remembering.
WHAT TO FOCUS ON
Exam wording • CLI commands • HCL patterns • State • Modules • Terraform Cloud • Common traps
Use this as a final pass, not a replacement for the official learning material. The goal is to make the high-yield distinctions easy to scan
when you're short on time.
Terraform Associate (003) • Last-minute revision 1
, ---
1. IaC Concepts — what they're actually testing
The exam usually isn't looking for a textbook definition of IaC. It tests whether you know which property goes with which
word. This is the mapping worth knowing cold:
Term What it means on the exam
Idempotent Running the same config twice produces the same result — no drift, no duplication
Declarative You describe the end state, Terraform figures out the steps (Terraform, CloudFormation, Puppet)
Imperative You describe the steps to get there, in order (Bash scripts, Ansible playbooks, boto3 scripts)
Mutable infra Servers are patched/updated in place (Chef, Puppet, Ansible default behavior)
Immutable infra Nothing is changed in place — a new resource is built and the old one is destroyed/replaced
(Terraform's default philosophy, Packer images)
A common exam trap: Terraform is declarative, but it can behave imperatively during `apply` under the hood (it
computes a dependency graph and executes actions in an order). Don't let a question trick you into calling Terraform
"imperative" just because it executes steps.
Why IaC over ClickOps (pick the boring, obvious answers on these):
• Version-controlled, peer-reviewed changes
• Consistent, repeatable environments (dev/stage/prod parity)
• Reduced human error, self-documenting infra
• Cost estimation before you touch anything (esp. TFC)
---
2. Terraform's Purpose vs. Other Tools
Provisioning vs. Configuration Management vs. Orchestration
• Terraform = provisioning tool (creates/destroys/manages infra resources)
• Chef / Puppet / Ansible = configuration management (installs packages, manages files on existing servers)
• Kubernetes = orchestration (schedules containers across a cluster)
The lines can blur a little (Terraform's provisioner blocks do config-management-ish things), but for the exam, remember
that Terraform's core competency is provisioning + state tracking, which config management tools like Ansible don't do
natively (Ansible is stateless by design — it just re-runs and re-checks).
The Core Workflow — memorize the verbs and what each one touches
terraform init # downloads providers + modules, configures backend, creates .terraform/ and lock file
terraform plan # dry run — shows diff between state and desired config, writes to a plan file if -out used
terraform apply # executes the plan, updates real infra + state file
terraform destroy # terraform apply -destroy under the hood — tears down everything in state
plan and apply both refresh state first (unless you disable it) — that refresh is what lets Terraform detect drift.
Terraform Associate (003) • Last-minute revision 2
Last-Minute
Cheat Sheet
A practical, exam-focused revision guide — written in plain English, with the commands,
distinctions, and traps most worth remembering.
WHAT TO FOCUS ON
Exam wording • CLI commands • HCL patterns • State • Modules • Terraform Cloud • Common traps
Use this as a final pass, not a replacement for the official learning material. The goal is to make the high-yield distinctions easy to scan
when you're short on time.
Terraform Associate (003) • Last-minute revision 1
, ---
1. IaC Concepts — what they're actually testing
The exam usually isn't looking for a textbook definition of IaC. It tests whether you know which property goes with which
word. This is the mapping worth knowing cold:
Term What it means on the exam
Idempotent Running the same config twice produces the same result — no drift, no duplication
Declarative You describe the end state, Terraform figures out the steps (Terraform, CloudFormation, Puppet)
Imperative You describe the steps to get there, in order (Bash scripts, Ansible playbooks, boto3 scripts)
Mutable infra Servers are patched/updated in place (Chef, Puppet, Ansible default behavior)
Immutable infra Nothing is changed in place — a new resource is built and the old one is destroyed/replaced
(Terraform's default philosophy, Packer images)
A common exam trap: Terraform is declarative, but it can behave imperatively during `apply` under the hood (it
computes a dependency graph and executes actions in an order). Don't let a question trick you into calling Terraform
"imperative" just because it executes steps.
Why IaC over ClickOps (pick the boring, obvious answers on these):
• Version-controlled, peer-reviewed changes
• Consistent, repeatable environments (dev/stage/prod parity)
• Reduced human error, self-documenting infra
• Cost estimation before you touch anything (esp. TFC)
---
2. Terraform's Purpose vs. Other Tools
Provisioning vs. Configuration Management vs. Orchestration
• Terraform = provisioning tool (creates/destroys/manages infra resources)
• Chef / Puppet / Ansible = configuration management (installs packages, manages files on existing servers)
• Kubernetes = orchestration (schedules containers across a cluster)
The lines can blur a little (Terraform's provisioner blocks do config-management-ish things), but for the exam, remember
that Terraform's core competency is provisioning + state tracking, which config management tools like Ansible don't do
natively (Ansible is stateless by design — it just re-runs and re-checks).
The Core Workflow — memorize the verbs and what each one touches
terraform init # downloads providers + modules, configures backend, creates .terraform/ and lock file
terraform plan # dry run — shows diff between state and desired config, writes to a plan file if -out used
terraform apply # executes the plan, updates real infra + state file
terraform destroy # terraform apply -destroy under the hood — tears down everything in state
plan and apply both refresh state first (unless you disable it) — that refresh is what lets Terraform detect drift.
Terraform Associate (003) • Last-minute revision 2
