Why CLI Exam Mistakes Trips Everyone Up
You’re staring at your score report: 687/1000. Passing is 720. You were confident on most questions. Then you hit the CLI section and suddenly you’re guessing.
This happens to almost everyone taking the HashiCorp Terraform Associate exam. The problem isn’t that you don’t understand Terraform. The problem is that the exam tests CLI commands differently than you’ve practiced them.
You’ve probably run terraform plan and terraform apply in your own environment. But the exam asks about CLI behavior in edge cases you’ve never seen. It asks about flags you’ve never used. It asks about what happens when commands fail, not when they succeed.
The CLI section represents roughly 20% of the exam. That means getting this wrong costs you 50–80 points on your 1000-point score. A 50-point swing on a test where you need 720 to pass is the difference between retaking it and moving forward.
The Specific Pattern That Causes This
The mistake follows a predictable pattern, and it happens in three stages.
Stage One: You learn CLI commands by doing. You run terraform init, then terraform plan, then terraform apply. You’ve done this dozens of times. Your muscle memory is solid. You think you know the CLI.
Stage Two: You take a practice test. You see a question that says: “A developer runs terraform plan -destroy but the command fails. The error message shows that a resource has a prevent_destroy lifecycle rule. What happens next?” You’ve never run terraform plan -destroy before. You guess.
Stage Three: You get the exam and you’re unprepared for specific flags, command behaviors, and edge cases. Questions like: What does terraform refresh actually do versus terraform apply? What’s the difference between terraform destroy and running terraform apply -destroy? When you use -auto-approve, what safety checks get skipped?
The real problem: you’ve practiced the happy path, not the CLI behavior under constraints.
How The Exam Actually Tests This
The HashiCorp Terraform Associate exam doesn’t ask “what does terraform apply do?” That’s too easy. Instead, it asks CLI questions in these specific ways:
Scenario-based CLI questions. Example: “Your CI/CD pipeline runs terraform plan -json > plan.out then later runs terraform apply -json plan.out. A team member adds a new resource to the code before the apply runs. What happens?”
The answer depends on understanding what the -json flag does (outputs machine-readable format), how plan files work (they lock the exact changes), and what happens when code changes between plan and apply (the apply fails if the plan doesn’t match the current code).
Flag combination questions. Example: “You need to apply changes without prompting the user and without saving the state file. Which command is correct?”
terraform apply -auto-approveterraform apply -auto-approve -refresh=falseterraform apply -auto-approve -state=/dev/nullterraform apply -auto-approve -lock=false
The correct answer requires knowing what each flag does and why you’d use it. Most people guess here.
Questions about what fails and why. Example: “A resource has create_before_destroy = true and prevent_destroy = true in its lifecycle block. A developer tries to modify the resource. What is the result?” The answer is: the modify fails because prevent_destroy blocks any change, even though create_before_destroy is set.
Questions about state and locking. Example: “You run terraform plan while someone else is running terraform apply. What happens?” Answer: the plan succeeds and shows current state, because reads are allowed. But if you then try to apply that plan, it will lock.
How To Recognize It Instantly
When you’re reading an exam question, flag it as a CLI edge case if you see any of these patterns:
- The question mentions a flag you haven’t used in practice (
-json,-lock,-input=false,-compact-warnings,-state) - The question describes a command failing, not succeeding
- The question asks about what happens next after a specific command runs
- The question involves combining multiple flags in one command
- The question mentions state files, locking, or refresh in the context of a CLI action
- The question includes a specific error message and asks what caused it
Real example from exam-like questions: “When running terraform plan -destroy, Terraform shows that a security group will be destroyed. However, the security group has prevent_destroy = true. What is the result of running terraform apply -destroy?”
If you immediately know the answer (the apply will fail before destroying anything), you’re solid on CLI edge cases. If you hesitate, this is your weak spot.
Practice This Before Your Exam
Stop running CLI commands in a vacuum. Instead, deliberately trigger failures and edge cases.
Exercise One: Test the -auto-approve flag. Run terraform apply -auto-approve on a small test stack. Then run it again. Understand what changed in the state file and why. Then read the docs on what -auto-approve skips (the approval prompt and the ability to review the plan).
Exercise Two: Create a prevent_destroy scenario. Build a resource with prevent_destroy = true. Try to destroy it with terraform destroy. Watch it fail. Then try terraform destroy -auto-approve. Still fails. This teaches you that -auto-approve skips prompts, not safety rules.
Exercise Three: Test plan file behavior. Run terraform plan -out=tfplan. Then change your code. Now run terraform apply tfplan. Watch it fail or warn you about the code mismatch. Understand the exact error message.
Exercise Four: Study the flag reference. Open the official Terraform CLI documentation and read every flag for plan, apply, and destroy. For each flag, write one sentence about what it does and why you’d use it. This takes 30 minutes and is worth 20+ points on the exam.
Exercise Five: Take a second practice test, but focus only on CLI questions. Don’t move past a question until you can explain why each answer is right or wrong, including what flag or behavior makes the difference.
Your Next Move
Open your score report from your last practice test. Filter for every question tagged “CLI” or “command-line.” Count how many you got wrong. If it’s more than 1 out of 5, you have a CLI weakness.
Right now, spend 20 minutes on the Terraform CLI documentation page for the apply command. Read every flag. Stop pretending you know them from practice alone.
Then schedule your retake. You’re 33 points away. The CLI section alone can get you there.