Terraform Associate · Domain 6 of 8

Terraform Associate Domain 6: Terraform state management

This domain covers managing Terraform state: the local backend, state locking, configuring remote state with the backend block, and managing resource drift and state.

Exam weight estimate
Not published
Official objectives
4
Estimated questions estimate
~6
Suggested study time estimate
5–10 hrs

About 10 min read Reviewed October 2026

Overview

Terraform state management covers how state is stored, protected and maintained. It has four objectives. Describing the local backend covers the default behavior of storing state in a local file. Describing state locking covers preventing concurrent operations from corrupting state. Configuring remote state covers the backend block and storing state remotely for collaboration and safety. Managing resource drift and state covers detecting when real infrastructure diverges from state, and using state operations to reconcile and maintain it.

Building on the state concepts from the fundamentals domain, this domain covers operating state in practice. The exam rewards understanding why remote state and locking matter for teams, how the backend block configures state storage, and how to detect and handle drift. State is one of the most important and nuanced topics on the exam, so these operational skills are high value.

How it's tested

Terraform Associate questions in this domain test backends, state locking, remote state and handling drift. State questions often describe a team or drift situation, so identify the backend, whether locking applies and which state operation, such as terraform state mv or an import, repairs the mismatch.

  • Backend choice

    A storage or collaboration need is described, and you choose local or remote state.

  • State locking

    A concurrency risk is described, and you apply state locking.

  • Handle drift

    A divergence between reality and state is described, and you choose how to reconcile it.

Reasoning it through

A team shares one Terraform configuration and sometimes two members run apply at the same time, risking a corrupted state file. Keeping state in a local file on each machine does not coordinate access. Configuring a remote backend that supports state locking stores state centrally and prevents concurrent operations from running at once, protecting the state, which is the collaboration-safe approach the exam expects for teams.

Objectives 4

Official objectives from the HashiCorp outline, in outline order.

6a Describe the local backendThe default behavior of storing state locally.
What it means
This covers the local backend, Terraform's default, which stores the state file on the local disk in the working directory, and its characteristics and limitations.
What to understand
By default Terraform uses the local backend, keeping state in a local file. This is fine for a single user experimenting, but it does not support safe collaboration, since the state is not shared or locked centrally, and a local file can be lost. Teams move to a remote backend.
How it shows up
A state-storage situation is described, and you must identify the local backend and its limits.
Common confusion
Assuming the local backend is suitable for team collaboration; it stores state locally without sharing or central locking.
6b Describe state lockingPreventing concurrent operations from corrupting state.
What it means
This covers state locking, which prevents more than one Terraform operation from writing to the state at the same time, avoiding corruption, and how supported backends implement locking automatically.
What to understand
When Terraform modifies state, it locks the state so a concurrent operation cannot run simultaneously and corrupt it. Backends that support locking do this automatically. Locking is essential when a team shares state, and the local backend does not provide shared locking.
How it shows up
A concurrency risk is described, and you must identify state locking as the protection.
Common confusion
Thinking the local backend provides shared state locking for a team; locking requires a backend that supports it.
6c Configure remote state using the backend blockStoring state remotely for collaboration and safety.
What it means
This covers configuring a remote backend using the backend block, so state is stored centrally in a remote location that supports sharing, locking and durability, enabling team collaboration.
What to understand
The backend block configures where state is stored. A remote backend keeps state centrally so a team shares one source of truth, supports locking to prevent conflicts, and is more durable than a local file. HCP Terraform and various remote backends serve this role. Changing the backend requires re-initialization.
How it shows up
A collaboration or durability need is described, and you must configure a remote backend.
Common confusion
Confusing the local and remote backends; remote backends enable shared, locked, durable state that local does not.
6d Manage resource drift and Terraform stateDetecting and reconciling divergence between reality and state.
What it means
This covers resource drift, when real infrastructure changes outside Terraform and diverges from state, detecting it through refresh and plan, and using state operations to reconcile and maintain state, such as moving, removing or importing resources in state.
What to understand
Drift happens when infrastructure is changed outside Terraform, so state no longer matches reality. Terraform detects drift by refreshing state and showing differences in a plan. State can be maintained with operations to move, remove or import resources so state accurately reflects what Terraform should manage.
How it shows up
A drift or state-maintenance need is described, and you must choose how to detect or reconcile it.
Common confusion
Confusing drift detection with a code change; drift is a change made outside Terraform, revealed by comparing state to reality.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Local backend

    Default, stores state in a local file.

    Remember
    Not for team collaboration.
    Tested as
    Backend questions.
    Trap
    Using it for a team.

  • Remote backend

    Stores state centrally.

    Remember
    Shared, locked, durable.
    Tested as
    Backend questions.
    Trap
    Confusing with local.

  • backend block

    Configures where state is stored.

    Remember
    Re-init required on change.
    Tested as
    Backend questions.
    Trap
    Forgetting to re-initialize.

  • State locking

    Prevents concurrent state writes.

    Remember
    Avoids corruption.
    Tested as
    Concurrency questions.
    Trap
    Expecting local to lock for a team.

  • Shared state

    One source of truth for a team.

    Remember
    Remote backends provide it.
    Tested as
    Collaboration questions.
    Trap
    Each member with a local file.

  • State durability

    Remote state is more durable.

    Remember
    A local file can be lost.
    Tested as
    Backend questions.
    Trap
    Relying on a single local file.

  • Resource drift

    Reality diverges from state.

    Remember
    Caused by changes outside Terraform.
    Tested as
    Drift questions.
    Trap
    Confusing it with a code change.

  • Refresh

    Updates state to match reality.

    Remember
    Reveals drift in a plan.
    Tested as
    Drift questions.
    Trap
    Ignoring refresh.

  • State operations

    Move, remove or import in state.

    Remember
    Maintain accurate state.
    Tested as
    State-maintenance questions.
    Trap
    Editing state carelessly.

  • Import

    Brings existing resources into state.

    Remember
    So Terraform manages them.
    Tested as
    State-maintenance questions.
    Trap
    Recreating instead of importing.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Local vs. remote backend

ConceptMeaningKey differenceCommon trap
Local backend State in a local file Single user, not shared Using for a team
Remote backend State stored centrally Shared, locked, durable Confusing with local

With vs. without state locking

ConceptMeaningKey differenceCommon trap
With locking Concurrent writes blocked Protects state Expecting local to lock for a team
Without locking Concurrent writes possible Risk of corruption Sharing state without locking

Drift vs. code change

ConceptMeaningKey differenceCommon trap
Drift Change made outside Terraform Reality diverges from state Confusing with a config change
Code change Change to the configuration Intended via the workflow Confusing with drift

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Local for a team

    What candidates pick
    Keep state in a local file for a team sharing one configuration.
    Why it looks right
    It is the default and simple.
    Why it's wrong
    A remote backend provides shared, locked, durable state for teams; the local backend does not coordinate access.

    Clue to watch for Multiple people share one configuration and state.

  2. No locking for concurrency

    What candidates pick
    Share state without a backend that supports locking.
    Why it looks right
    Sharing the file seems enough.
    Why it's wrong
    State locking prevents concurrent operations from corrupting state; a locking-capable backend is needed.

    Clue to watch for Two people might run apply at the same time.

  3. No re-init after backend change

    What candidates pick
    Change the backend block and run apply without re-initializing.
    Why it looks right
    The configuration already ran before.
    Why it's wrong
    Changing the backend requires terraform init again to configure the new backend.

    Clue to watch for The backend configuration changed.

  4. Drift is a code change

    What candidates pick
    Treat infrastructure changed in the console as a configuration change.
    Why it looks right
    Both cause differences.
    Why it's wrong
    Drift is a change made outside Terraform, detected by comparing state to reality; a code change is made in the configuration.

    Clue to watch for Infrastructure was modified outside Terraform.

  5. Recreate instead of import

    What candidates pick
    Delete and recreate an existing resource to bring it under Terraform.
    Why it looks right
    It is straightforward.
    Why it's wrong
    terraform import brings an existing resource into state so Terraform manages it without recreating it.

    Clue to watch for An existing resource must be managed without downtime.

Answer framework

For any Domain 6 scenario, use these steps to find the answer the exam expects.

  1. Identify whether the need is backend choice, locking, remote state, or drift and maintenance.
  2. Recognize the local backend as the default for a single user, unsuitable for team collaboration.
  3. For teams, configure a remote backend with the backend block for shared, locked and durable state, re-initializing after the change.
  4. Rely on state locking, provided by capable backends, to prevent concurrent operations from corrupting state.
  5. Detect drift by refreshing and planning, and maintain accurate state with operations such as move, remove and import. Where two backends seem to fit, prefer the remote one that supports state locking for any shared or team workflow.

Practice question

A team shares a single Terraform configuration, and occasionally two members run terraform apply at nearly the same time, risking a corrupted state file. What is the BEST way to prevent this?

Want more like this? The Terraform Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this domain focused attention, since state is one of the most important and most tested topics, building on the state concepts from the fundamentals domain. Start with the local-versus-remote backend distinction and why the local backend does not support safe team collaboration. Then learn state locking and why it prevents concurrent operations from corrupting shared state.

Practice configuring a remote backend with the backend block and remember that changing the backend requires re-initialization. Finally, learn resource drift: how it arises from changes made outside Terraform, how refresh and plan detect it, and how state operations such as move, remove and import maintain accurate state.

Hands-on practice configuring a backend and importing a resource makes these concrete. Migrate a local state to a remote backend, then change a resource outside Terraform to see drift in the plan, and review missed practice questions by objective. Afterwards, move to Domain 7, maintaining infrastructure with Terraform.

FAQ

What is the local backend and when is it unsuitable?

The local backend is Terraform's default, storing state in a local file. It suits a single user experimenting but is unsuitable for teams, because it does not share state or provide central locking, and the file can be lost.

What is state locking and why does it matter?

State locking prevents more than one Terraform operation from writing to the state at the same time, which avoids corruption. It is essential when a team shares state, and requires a backend that supports it.

How do I configure remote state?

Use the backend block to configure a remote backend that stores state centrally. This enables shared, locked and durable state for collaboration, and changing the backend requires running terraform init again.

What is resource drift?

When real infrastructure is changed outside Terraform, so the actual state diverges from Terraform's recorded state. Terraform detects it by refreshing and showing the differences in a plan.

How do I bring an existing resource under Terraform management?

Use terraform import to bring the existing resource into state so Terraform manages it, rather than deleting and recreating it, which avoids downtime and data loss.

Why is remote state better for teams than local state?

Remote state is shared as a single source of truth, supports locking to prevent concurrent corruption, and is more durable than a local file, all of which are needed for safe collaboration.

How does Domain 6 connect to the rest of the exam?

State management operates the state introduced in Domain 2, tracks the resources from Domain 4 and modules from Domain 5, and underpins the maintenance tasks in Domain 7 and HCP Terraform in Domain 8.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered backends, state locking, remote state and drift. Test whether you can manage state correctly under exam conditions.

Take the Terraform Associate practice test Check your Terraform Associate readiness

Keep going