Terraform Associate Domain 3: Core Terraform workflow (Not published)

Overview

Core Terraform workflow covers the commands and cycle at the heart of using Terraform, and it is the most hands-on domain. It has seven objectives. Describing the workflow covers the write, plan, apply cycle. Initializing covers terraform init, which prepares a working directory and downloads providers and modules. Validating covers terraform validate, which checks configuration syntax and consistency. Planning covers terraform plan, which generates and shows the execution plan of what will change. Applying covers terraform apply, which makes the changes. Destroying covers terraform destroy, which removes managed infrastructure. Formatting covers terraform fmt, which applies standard style.

With the most objectives, this domain is heavily tested and practical. The exam rewards knowing what each command does, the order of the workflow, and how to read an execution plan, which is a core skill. These commands are used in every other practical area of the exam.

Why it matters on the exam

The core workflow is the most hands-on and heavily represented part of the exam, and it is used in every real Terraform task. The exam tests knowing precisely what each command does and the correct order. Candidates lose points by confusing what init, plan and apply do, by not understanding that plan shows proposed changes without making them while apply executes them, by forgetting that init must run first, or by misreading an execution plan's add, change and destroy indicators. Fluency with the write, plan, apply cycle and reading plans is the practical skill this domain rewards. Workflow questions ask which command comes next or what a command changes, so running init, validate, plan, apply and destroy yourself is what makes those answers automatic.

How it's tested

Terraform Associate questions in this domain ask what a workflow command does, the correct order, or how to interpret an execution plan. Workflow questions often ask about order or effect, so place each command in the init, validate, plan and apply sequence and note whether it changes infrastructure.

Which command

A task is described, and you choose the correct Terraform command.
Workflow order

A sequence need is described, and you choose the correct order of commands.
Read the plan

An execution plan is described, and you interpret what it will change.

Reasoning it through

A developer wants to see exactly what Terraform will change before anything happens to real infrastructure. Running apply would make changes immediately. Running terraform plan generates and displays the execution plan, showing what will be added, changed or destroyed without altering infrastructure, which is the safe preview the exam expects before applying.

Objectives 7

Official objectives from the HashiCorp outline, in outline order.

3a Describe the Terraform workflowThe write, plan, apply cycle.

What it means: This covers the core Terraform workflow: write the configuration, run plan to preview changes, and apply to make them, as the repeating cycle at the center of using Terraform.
What to understand: The workflow is write, plan, apply. You author configuration, Terraform shows a plan of the changes needed to reach the desired state, and apply executes them. This cycle repeats as the configuration evolves. Understanding the order and purpose of each phase is fundamental.
How it shows up: A workflow scenario is described, and you must identify the phase or the correct cycle.
Common confusion: Confusing the order or purpose of the phases, especially plan versus apply.

3b Initialize a Terraform working directoryterraform init prepares the directory and downloads providers and modules.

What it means: This covers terraform init, which initializes a working directory by downloading the required providers and modules, setting up the backend, and preparing the directory for other commands.
What to understand: terraform init must run first in a new or changed configuration, because it downloads providers and modules and configures the backend. Without initialization, plan and apply cannot run. It is safe to re-run and is needed after adding providers, modules or changing the backend.
How it shows up: A setup situation is described, and you must identify that init is required or what it does.
Common confusion: Expecting plan or apply to work before init has downloaded providers and set up the backend.

3c Validate a Terraform configurationterraform validate checks syntax and consistency.

What it means: This covers terraform validate, which checks whether the configuration is syntactically valid and internally consistent, without accessing any remote services or state.
What to understand: validate catches configuration errors such as syntax mistakes and invalid references early, before planning. It does not check against real infrastructure or require credentials. It is a fast, local correctness check used during development.
How it shows up: A configuration-checking need is described, and you must identify validate and what it checks.
Common confusion: Expecting validate to check against real infrastructure; it only checks the configuration's syntax and consistency locally.

3d Generate and review an execution plan for Terraformterraform plan previews what will change.

What it means: This covers terraform plan, which compares the configuration, state and real infrastructure to generate an execution plan showing what Terraform will add, change or destroy, without making any changes.
What to understand: plan is the preview step. It shows proposed actions, resources to create, update in place, replace, or destroy, so you can review before applying. Reading the plan's indicators correctly is a core exam skill, and a plan can be saved and applied exactly.
How it shows up: A preview or plan-reading need is described, and you must choose plan or interpret its output.
Common confusion: Thinking plan changes infrastructure; it only previews, while apply executes.

3e Apply changes to infrastructure with Terraformterraform apply executes the planned changes.

What it means: This covers terraform apply, which executes the changes to reach the desired state, by default showing a plan and prompting for approval before making changes, and updating state afterward.
What to understand: apply makes the actual changes to infrastructure and updates state. By default it shows the plan and asks for confirmation. It can apply a previously saved plan file exactly. After applying, state reflects the new real-world infrastructure.
How it shows up: A change-execution need is described, and you must identify apply and its behavior.
Common confusion: Confusing apply with plan; apply makes changes, while plan only previews them.

3f Destroy Terraform-managed infrastructureterraform destroy removes managed resources.

What it means: This covers terraform destroy, which removes the infrastructure Terraform manages, showing what will be destroyed and prompting for approval, and updating state afterward.
What to understand: destroy tears down the resources in the configuration and state, useful for cleaning up environments. It shows a plan of what will be destroyed and asks for confirmation. It affects only Terraform-managed resources recorded in state.
How it shows up: A teardown need is described, and you must identify destroy and its behavior.
Common confusion: Expecting destroy to affect resources not managed by Terraform; it only removes what is in the configuration and state.

3g Apply formatting and style adjustments to a configurationterraform fmt applies standard style.

What it means: This covers terraform fmt, which rewrites configuration files to the standard Terraform style and formatting conventions for consistency and readability.
What to understand: fmt applies canonical formatting, indentation, alignment and spacing, so configurations are consistent and readable, which matters for collaboration. It changes only formatting, not behavior, and is commonly run before committing code.
How it shows up: A style or consistency need is described, and you must identify fmt.
Common confusion: Expecting fmt to change configuration behavior; it only adjusts formatting and style.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

Write, plan, apply

The core Terraform cycle.

Remember
Author, preview, then execute.

Tested as
Workflow questions.

Trap
Confusing the phase order.
terraform init

Initializes the working directory.

Remember
Must run first; downloads providers and modules.

Tested as
Setup questions.

Trap
Running plan or apply before init.
terraform validate

Checks syntax and consistency locally.

Remember
No remote access needed.

Tested as
Validation questions.

Trap
Expecting it to check real infrastructure.
terraform plan

Previews changes without making them.

Remember
Shows add, change, destroy.

Tested as
Plan questions.

Trap
Thinking plan changes infrastructure.
Execution plan indicators

Create, update, replace, destroy.

Remember
Read them to understand the plan.

Tested as
Plan-reading questions.

Trap
Misreading the symbols.
terraform apply

Executes the planned changes.

Remember
Prompts for approval, updates state.

Tested as
Apply questions.

Trap
Confusing it with plan.
terraform destroy

Removes managed infrastructure.

Remember
Only affects state-tracked resources.

Tested as
Teardown questions.

Trap
Expecting it to affect unmanaged resources.
terraform fmt

Applies standard formatting.

Remember
Changes style, not behavior.

Tested as
Style questions.

Trap
Expecting behavior changes.
Approval prompt

Apply and destroy confirm before acting.

Remember
Review the plan before approving.

Tested as
Workflow questions.

Trap
Approving without reading.
Saved plan file

A plan saved to apply exactly.

Remember
Ensures apply matches the preview.

Tested as
Workflow questions.

Trap
Applying a different plan than reviewed.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

plan vs. apply vs. destroy

Concept	Meaning	Key difference	Common trap
terraform plan	Previews changes	No changes made	Thinking it changes things
terraform apply	Executes changes	Updates infrastructure and state	Confusing with plan
terraform destroy	Removes infrastructure	Tears down managed resources	Expecting it to affect unmanaged ones

init vs. validate vs. fmt

Concept	Meaning	Key difference	Common trap
terraform init	Prepares the directory	Downloads providers and modules	Skipping it
terraform validate	Checks configuration	Syntax and consistency, local	Expecting a real-infrastructure check
terraform fmt	Formats configuration	Style only	Expecting behavior changes

Workflow order

Concept	Meaning	Key difference	Common trap
init first	Set up the directory	Required before plan or apply	Running plan first
plan next	Preview changes	Review before applying	Skipping the preview
apply last	Execute changes	Make and record changes	Applying without reviewing

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

Apply to preview

What candidates pick
Run terraform apply to see what would change before committing.

Why it looks right
Apply shows a plan too.

Why it's wrong
terraform plan previews changes without making them; apply executes them, even though it also shows a plan.

Clue to watch for The goal is to preview safely without changing infrastructure.
Skip init

What candidates pick
Run terraform plan in a fresh directory without initializing first.

Why it looks right
Plan seems like the first step.

Why it's wrong
terraform init must run first to download providers and modules and set up the backend; plan fails otherwise.

Clue to watch for The directory is new or providers or modules changed.
Validate checks reality

What candidates pick
Use terraform validate to confirm the deployed infrastructure matches the configuration.

Why it looks right
Validate sounds like a full check.

Why it's wrong
validate only checks configuration syntax and consistency locally; it does not inspect real infrastructure.

Clue to watch for The need is to compare against deployed resources, which is plan's job.
fmt changes behavior

What candidates pick
Avoid terraform fmt for fear it will change how the configuration works.

Why it looks right
Rewriting files sounds risky.

Why it's wrong
fmt only adjusts formatting and style, not behavior, so it is safe to run.

Clue to watch for The concern is only consistency and readability.
Destroy hits everything

What candidates pick
Expect terraform destroy to remove all cloud resources in the account.

Why it looks right
Destroy sounds total.

Why it's wrong
destroy only removes resources in the configuration and state, not resources Terraform does not manage.

Clue to watch for Only Terraform-managed resources should be removed.

Answer framework

For any Domain 3 scenario, use these steps to find the answer the exam expects.

Identify which workflow phase or command the task needs, from initialization through to teardown.
Run terraform init first in a new or changed configuration to download providers and modules and set up the backend.
Use terraform validate for a local syntax and consistency check during development.
Run terraform plan to preview what will be added, changed or destroyed, and read the indicators before acting.
Run terraform apply to execute the reviewed changes, terraform destroy to tear down managed infrastructure, and terraform fmt to standardize formatting. Where two commands seem to fit, check whether the step only reads or actually changes infrastructure; validate and plan never modify real resources.

Practice question

A developer wants to see exactly which resources Terraform would add, change, or destroy to match the current configuration, without making any changes to the real infrastructure. Which command should they run?

terraform apply terraform plan terraform destroy terraform fmt

Show the answer

Answer B. terraform plan compares the configuration, state and real infrastructure and generates an execution plan showing what would be added, changed or destroyed, without making any changes, which exactly matches the goal. terraform apply would make the changes, terraform destroy would remove managed infrastructure, and terraform fmt only adjusts formatting.

Want more like this? The Terraform Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This is the most hands-on and heavily tested domain, so practice the commands repeatedly in a demo environment rather than only reading. Learn the write, plan, apply cycle cold, and run each command to see its effect. Fix firmly what each does: init prepares the directory and must run first, validate checks configuration locally, plan previews changes, apply executes them, destroy tears down, and fmt formats.

Give special attention to reading an execution plan, since interpreting the add, change, replace and destroy indicators is a core, frequently tested skill. Practice distinguishing plan (preview, no changes) from apply (makes changes), which is the most common confusion.

Because the exam rewards practical fluency, running the full workflow several times is the best preparation. Run the full workflow on a small configuration, including a destroy, and review missed practice questions by command to find weak spots. Afterwards, move to Domain 4, Terraform configuration.

FAQ

What is the core Terraform workflow?

Write the configuration, run terraform plan to preview the changes, and run terraform apply to make them. This write, plan, apply cycle repeats as the configuration evolves.

What does terraform init do?

It initializes a working directory by downloading the required providers and modules and setting up the backend. It must run first, before plan or apply, in a new or changed configuration.

What is the difference between plan and apply?

terraform plan previews what would be added, changed or destroyed without making any changes. terraform apply executes those changes and updates state, prompting for approval by default.

What does terraform validate check?

It checks that the configuration is syntactically valid and internally consistent, locally, without accessing real infrastructure or needing credentials.

What does terraform destroy affect?

Only the resources Terraform manages, as recorded in the configuration and state. It does not remove resources that Terraform does not manage.

Does terraform fmt change how my configuration works?

No. fmt only rewrites files to the standard style and formatting. It changes appearance, not behavior, so it is safe to run before committing.

How does Domain 3 connect to the rest of the exam?

The workflow commands here are used to deploy the configuration of Domain 4, the modules of Domain 5, and to manage the state of Domain 6.

Related domains

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Terraform Associate Domain 3: Core Terraform workflow

Overview

How it's tested

Which command

Workflow order

Read the plan

Objectives 7

High-yield concepts

Write, plan, apply

terraform init

terraform validate

terraform plan

Execution plan indicators

terraform apply

terraform destroy

terraform fmt

Approval prompt

Saved plan file

Side by side

plan vs. apply vs. destroy

init vs. validate vs. fmt

Workflow order

Exam traps

Apply to preview

Skip init

Validate checks reality

fmt changes behavior

Destroy hits everything

Answer framework

Practice question

Checklist

Study strategy

FAQ

Other Cloud Computing certifications

Test your Domain 3 knowledge

Keep going