What is Infrastructure as Code (IaC), and how does it support CI/CD?

WHAT THIS TESTS: The interviewer wants to know if you understand Infrastructure as Code as a foundational DevOps practice that underpins continuous delivery, rather than viewing it as a simple tooling or scripting exercise. They are specifically looking for your grasp of declarative models, idempotence, version control, and how these concepts work together to eliminate environment drift and snowflake servers. The question also probes whether you treat infrastructure changes as first-class citizens within the same software delivery pipeline as application code, subject to review, testing, and automated deployment.

A GOOD ANSWER COVERS: First, define IaC as the practice of managing and provisioning infrastructure through machine-readable definition files rather than through manual configuration or interactive dashboards. Second, emphasize the declarative approach where you specify the desired end state, such as in JSON, YAML, or Bicep templates, and allow the underlying platform to determine the exact steps required to reach that state. Third, explain idempotence as a core principle, meaning that a deployment command produces the same environment configuration regardless of the starting state, achieved either by reconciling existing resources or by discarding and recreating them. Fourth, connect this directly to CI/CD by explaining that version-controlled infrastructure definitions can be validated, tested, and deployed through the same pipelines as application code, which enables teams to spin up production-like test environments rapidly and reliably at scale.

COMMON WRONG ANSWERS: A major red flag is describing IaC as merely writing bash or PowerShell scripts to install software on servers, which completely misses the declarative model and idempotence principles that distinguish true IaC. Another mistake is failing to mention environment drift or snowflake environments, revealing that you do not understand the core operational problem IaC was designed to solve. Candidates also err by ignoring the CI/CD integration entirely, treating infrastructure provisioning as a separate manual or ticket-driven process rather than as code that flows through automated build and release pipelines.

LIKELY FOLLOW-UPS: Expect the interviewer to ask how you handle secrets, credentials, and sensitive configuration within IaC templates without exposing them in version control. They may also probe rollback strategies when an infrastructure change fails or causes service degradation, or ask you to compare imperative versus declarative approaches with concrete trade-offs. Another common follow-up is how you test infrastructure code before it reaches production, perhaps through static analysis, policy as code, or ephemeral environments, and how you manage state and concurrency in tools like Terraform as opposed to ARM or Bicep.

ONE CONCRETE EXAMPLE: Suppose a team needs three identical environments for a microservice application. Without IaC, an engineer manually configures a staging server through a cloud portal and over time it silently diverges from production, causing a deployment failure that is difficult to reproduce. With IaC, the team stores an ARM template or Terraform configuration in a Git repository. A pull request triggers automated validation and security scanning in the CI pipeline, and upon merge the CD pipeline deploys an identical environment. When staging breaks or drifts, the team destroys and recreates it in minutes rather than debugging manual configuration, because the code defines the desired state and the tool enforces idempotence.

Source: learn.microsoft.com