Top 30 IAC Interview Questions and Answers
30 multiple-choice questions on IAC, drawn from 30 bites out of the 36 tagged IAC on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
What is the primary problem Infrastructure as Code (IaC) aims to solve in managing IT infrastructure?
Show the answer
Answer: a · Preventing configuration drift and ensuring consistent, repeatable environments.
The card explicitly states IaC was created to combat 'configuration drift' and ensure 'consistent, repeatable environments.' While IaC can contribute to cost efficiency, its main purpose is not cost reduction, and it does not eliminate all human involvement, but rather automates the provisioning process through code, not GUIs.
Read the full bite: Infrastructure as Code: Manage Servers with Code, Not Clicks
Question 2 of 30
What key characteristic separates Infrastructure as Code from traditional imperative server scripting?
Show the answer
Answer: d · IaC defines the desired end state and achieves idempotence through automated reconciliation
True IaC is defined by its declarative, idempotent model that lets the platform reconcile to a desired state, not by the file format used. While IaC definitions are often written in JSON or YAML, simply using those formats without declarative idempotence is still just scripting.
Read the full bite: What is Infrastructure as Code (IaC), and how does it support CI/CD?
Question 3 of 30
Which core problem in software development does a Dockerfile primarily address?
Show the answer
Answer: c · Guaranteeing that an application's runtime environment is identical everywhere it runs.
The card explicitly states Dockerfiles exist "To solve the classic 'it works on my machine' problem" and "ensure that an application and its dependencies are packaged together and run consistently everywhere." This aligns perfectly with guaranteeing an identical runtime environment. While Docker is used in CI/CD (which includes testing automation), the Dockerfile's direct role is defining the environment, not the testing process itself.
Read the full bite: The Dockerfile: A Recipe for Your Container
Question 4 of 30
What is a primary benefit of implementing Configuration as Code?
Show the answer
Answer: a · It provides a version-controlled, repeatable, and consistent way to manage system settings across environments.
Configuration as Code's core purpose is to ensure consistency and repeatability of system settings across different environments by treating them as version-controlled files. While it involves automation, it does not completely automate all system administration tasks. It is explicitly stated that CaC is not a secrets management solution; sensitive data should be handled by dedicated vaults.
Read the full bite: Configuration as Code: Version Control for Your Settings
Question 5 of 30
Which practice best describes how Infrastructure as Code prevents configuration drift across CI/CD environments?
Show the answer
Answer: d · Environments are defined by versioned declarative files that specify the desired state and can be recreated on demand
Declarative, versioned definitions ensure every environment matches the desired state and can be reproduced identically, which stops drift. Standardized shell scripts are imperative and still risk configuration drift because they depend on the server's starting state and do not enforce a unified model.
Read the full bite: What is IaC and its CI/CD benefits over manual provisioning?
Question 6 of 30
You are choosing between Terraform and Ansible for provisioning AWS VPCs and installing application packages. What is the primary decision factor?
Show the answer
Answer: d · Terraform is declarative and tracks state for infrastructure, while Ansible is imperative for procedural tasks
Terraform defines the desired end state of infrastructure and relies on a state engine for reconciliation, while Ansible executes ordered commands for procedural tasks. The distractor claiming Ansible is declarative simply because it is idempotent confuses a property of safe repetition with the desired-state paradigm, which is a common misconception.
Read the full bite: Explain the difference between declarative and imperative IaC.
Question 7 of 30
A developer runs terraform plan in a CLI-driven HCP Terraform workspace. What occurs during this step?
Show the answer
Answer: b · A remote speculative plan previews changes, validates against policies, and leaves infrastructure unchanged
terraform plan initiates a remote speculative run that shows proposed changes and checks policies without altering infrastructure. Distractor A is wrong because provisioning and state locking happen during terraform apply, not during the speculative plan phase.
Read the full bite: Describe the Terraform workflow from code to live
Question 8 of 30
When configuring Terraform for an RDS database, which approach best limits secret exposure across version history and state files?
Show the answer
Answer: a · Store the master password in AWS Secrets Manager with rotation enabled, reference the ARN in Terraform, and use an encrypted remote state backend
AWS Secrets Manager keeps the actual value out of code and enables automatic rotation and fine-grained access control, while an encrypted remote state backend prevents plaintext storage in state files. Passing the password via an environment variable is a common shortcut, but environment variables leak in process listings, crash reports, and potentially logs.
Read the full bite: How do you manage secrets within IaC configurations?
Question 9 of 30
When a live production resource drifts from its approved Terraform definition, which response best reflects mature IaC governance?
Show the answer
Answer: a · Replace the resource through an automated pipeline using the approved definition
Replacing the resource through an automated pipeline enforces immutable redeployment and treats the IaC repository as the single source of truth. Option D is a common anti-pattern because updating code to match drift validates unauthorized live changes instead of reverting them.
Read the full bite: Define configuration drift in IaC. How do you detect and remediate it?
Question 10 of 30
Which task is Terraform NOT primarily designed to handle?
Show the answer
Answer: c · Installing and configuring software packages inside a provisioned server
Terraform is an Infrastructure as Code tool focused on provisioning and managing infrastructure resources. It is explicitly stated that Terraform is not a configuration management tool for installing software or managing files inside a server once it's running.
Read the full bite: Terraform: Manage Infrastructure as Code
Question 11 of 30
What is the primary benefit of defining AWS infrastructure using CloudFormation templates?
Show the answer
Answer: c · It ensures consistent, repeatable, and version-controlled infrastructure deployments.
Option C is correct because the card emphasizes CloudFormation's role in creating "repeatable, version-controlled environments" and acting as the "single source of truth" for consistent infrastructure. Option B is a tempting distractor, but the card explicitly states CloudFormation is AWS-specific and not for multiple cloud providers.
Read the full bite: AWS CloudFormation: Your AWS Infrastructure as a Blueprint
Question 12 of 30
Which of the following is a critical reason to avoid storing Terraform state files in a version control system like Git?
Show the answer
Answer: a · State files can expose sensitive data and lack necessary locking for concurrent team operations.
The card explicitly states that state files often contain sensitive data in plain text and Git lacks the locking mechanism needed to prevent race conditions in a team environment. Option A directly addresses these two critical concerns. Other options describe less critical or incorrect reasons.
Read the full bite: Terraform State: The Map to Your Infrastructure
Question 13 of 30
What is the fundamental approach Configuration Management uses to ensure system consistency and prevent 'configuration drift'?
Show the answer
Answer: a · It continuously compares the actual system state against a codified desired state and corrects discrepancies.
The card explains that Configuration Management defines a 'desired state of a system as code' and then a CM tool 'continuously works to build and maintain your systems to match it, correcting any deviations it finds.' This active enforcement and remediation of discrepancies is its core function. Option B describes monitoring, which is related but does not include the active correction of state that CM provides.
Read the full bite: Configuration Management: Enforcing Desired State
Question 14 of 30
A team wants to ensure all newly launched servers have an identical, pre-installed software stack. Which tool is best suited for this?
Show the answer
Answer: c · Packer, to create a consistent "golden image" with the software pre-installed.
Packer is designed to create consistent, pre-configured machine images, ensuring that all newly launched instances start with an identical software stack. Tools like Ansible and Chef are primarily for configuration management of running instances, which can lead to configuration drift, while Terraform provisions the underlying infrastructure but doesn't build the image content itself.
Read the full bite: Packer: Build Identical Machine Images Everywhere
Question 15 of 30
Which advantage of declarative Infrastructure as Code is hardest to replicate with manual console provisioning?
Show the answer
Answer: d · Version-controlled, reviewable, repeatable environments free of configuration drift
IaC's core wins are repeatability, peer review, and drift-free consistency from version-controlled definitions. It does not inherently lower bills, speed individual API calls, or prevent provider outages.
Question 16 of 30
Which feature primarily contributes to Ansible's simplified setup and agentless operation on target machines?
Show the answer
Answer: a · Its ability to leverage standard SSH for communication without needing extra software on targets
The card highlights that Ansible is 'agentless' and 'connects to your machines (usually over SSH)' without requiring 'any special software (agents) to be installed on the target nodes.' This direct use of existing SSH infrastructure is key to its simplified setup. Option D is a direct contradiction of Ansible's agentless nature.
Read the full bite: Ansible: Automating Infrastructure with Playbooks
Question 17 of 30
When infrastructure drift occurs in a Terraform-managed environment, what is the primary risk during the next terraform apply operation?
Show the answer
Answer: a · Manual changes made to resources will be overwritten, potentially causing unexpected service behavior or outages.
The card explicitly states the "footgun" of drift is that a subsequent "terraform apply may destroy your manual changes," which can lead to service disruptions. Terraform's purpose is to enforce the desired state defined in code, not to automatically adapt its code to unapproved manual changes.
Read the full bite: Infrastructure Drift: When Reality and Code Diverge
Question 18 of 30
Which statement best describes a core advantage of Pulumi's approach to Infrastructure as Code compared to DSL-based tools?
Show the answer
Answer: d · It enables the use of general-purpose programming constructs like loops and classes for resource definition.
The card highlights that Pulumi uses real programming languages, allowing for complex logic, code reuse, and constructs like loops and classes, which DSLs often limit. Option B is incorrect because while Pulumi aims for clarity, using full programming languages can lead to more complex code than a purely declarative DSL, as noted in the 'When Not To Use It' section.
Read the full bite: Pulumi: Infrastructure as Code with Real Programming Languages
Question 19 of 30
A security group was changed directly in the console outside Terraform. What is the safest way to handle the resulting drift?
Show the answer
Answer: d · Run plan to see the diff, then apply to converge or update the config if the change should stay
Running plan reveals the drift and apply reconciles infrastructure to code, or you update the config to keep an intended change. Hand-editing or deleting state risks corruption, and treating the console as authoritative defeats IaC.
Question 20 of 30
What is the primary motivation for adopting Terragrunt in a Terraform project that is experiencing growth?
Show the answer
Answer: c · To reduce configuration duplication and automate repetitive operational tasks across environments.
Terragrunt's core purpose is to solve the structural problems of growing Terraform projects by keeping configurations DRY (Don't Repeat Yourself) and automating repetitive tasks across multiple modules and environments. Option D is incorrect because Terragrunt acts as a wrapper that orchestrates the existing Terraform CLI, rather than replacing it entirely, to achieve these goals.
Read the full bite: Terragrunt: A Thin Wrapper for DRY Terraform
Question 21 of 30
What state strategy best supports many teams managing dev, staging, and prod with the same IaC codebase?
Show the answer
Answer: d · State split per environment and component, with the same versioned modules promoted via variables
Splitting state per environment and component limits blast radius and locking contention while reusing versioned modules keeps environments consistent. Shared state risks fleet-wide breakage, copies drift, and local state cannot be shared safely.
Read the full bite: Strategy for large multi-team IaC projects
Question 22 of 30
When managing Kubernetes configurations across dev, staging, and production, which tool is best for applying minor, declarative environment-specific changes to a shared base without complex templating?
Show the answer
Answer: d · Kustomize, as it uses overlays to patch a base configuration declaratively.
Kustomize is specifically designed for applying slight, declarative variations to a base configuration using overlays, which aligns with the scenario described. Helm, while powerful, is intended for configurations requiring complex logic or conditionals, which Kustomize aims to avoid.
Read the full bite: Kustomize: Template-Free Kubernetes Configuration
Question 23 of 30
Which strategy best prevents vulnerable Terraform from reaching production while maintaining developer velocity?
Show the answer
Answer: c · Embed Checkov or tfsec in pull request pipelines to fail on critical findings and offer local IDE plugins for fast feedback
This reflects shift-left security by blocking vulnerable code at the PR stage and giving developers immediate local feedback, which the card describes as essential. Option B is tempting because cloud native tools are legitimate, but relying solely on post-deploy detection allows misconfigurations to be provisioned before they are caught.
Read the full bite: How would you integrate automated security scanning for Terraform in CI/CD?
Question 24 of 30
Which scenario is NOT an appropriate application of Configuration as Code (CasC) principles?
Show the answer
Answer: a · Storing sensitive API keys and database credentials directly in your code repository.
CasC explicitly advises against storing sensitive secrets like API keys or passwords directly in a code repository, even if private, recommending dedicated secrets management tools instead. The other options are all core use cases for CasC, covering pipeline, application, and infrastructure configuration.
Read the full bite: Configuration as Code: Treat Your Settings Like Source Code
Question 25 of 30
Which scenario best illustrates configuration drift in a production environment?
Show the answer
Answer: b · An engineer manually applies a hotfix to a live server without updating the infrastructure-as-code definition.
Configuration drift occurs when manual, out-of-band changes are made to a live server without updating the corresponding infrastructure-as-code, causing the actual state to diverge from the desired state. Option D describes a mechanism to correct drift, not the drift itself.
Read the full bite: Configuration Drift: When Servers Go Rogue
Question 26 of 30
Which task is generally considered an inappropriate use case for .ebextensions?
Show the answer
Answer: d · Provisioning and managing the lifecycle of a shared Amazon RDS database instance.
The card explicitly states to "Avoid using .ebextensions for ... managing resources with a lifecycle independent of your application, like a shared database." .ebextensions are designed for customizations tied to the application's lifecycle, not for independent resource management. The other options are all explicitly mentioned as appropriate use cases for .ebextensions.
Read the full bite: .ebextensions: Infrastructure as Code for Elastic Beanstalk
Question 27 of 30
What is the fundamental advantage of using AWS SAM for serverless applications compared to direct AWS CloudFormation?
Show the answer
Answer: b · It offers a simplified, concise syntax specifically for serverless resources.
AWS SAM's primary advantage is its simplified, concise syntax for defining serverless resources, acting as an abstraction layer that translates into CloudFormation, rather than replacing it. Local testing is a feature, but not its fundamental advantage over CloudFormation itself.
Read the full bite: AWS SAM: A Shorthand for Serverless on AWS
Question 28 of 30
Which field within a Pod Security Context is specifically designed to manage consistent group ownership and access permissions for shared volumes across all containers in a Pod?
Show the answer
Answer: c · fsGroup
The fsGroup field in a Pod Security Context sets a special group ID for any mounted volumes, ensuring all containers in the Pod can read and write to shared storage. While runAsUser sets the user ID for processes, it does not directly manage the group ownership of volumes.
Read the full bite: Pod Security Context: Set Security Rules for Pods
Question 29 of 30
For a team managing Infrastructure as Code, what is the primary risk of storing IaC state files directly in a Git repository?
Show the answer
Answer: a · Concurrent infrastructure changes by multiple engineers can lead to state file corruption due to a lack of locking mechanisms.
The card explicitly states that Git cannot lock the state file, leading to a high risk of race conditions where concurrent changes corrupt the state. While exposing secrets is a valid concern, the lack of locking and subsequent data corruption is highlighted as the primary operational risk for team-based state management in Git.
Read the full bite: IaC State: The Map Between Your Code and the Cloud
Question 30 of 30
What is a core benefit of Policy as Code (PaC) compared to manual policy management?
Show the answer
Answer: b · It enables policies to be versioned, tested, and consistently applied across varied infrastructure.
Policy as Code treats policies like application code, allowing them to be managed in version control, subjected to automated tests, and deployed consistently across diverse environments, which is a key benefit for scalability and reliability. While PaC automates enforcement, it does not eliminate the need for human expertise in defining and reviewing policies, making option D incorrect. PaC typically uses declarative languages, not graphical interfaces, and introduces a learning curve, making option A incorrect. Option C uses absolute terms like 'guarantees' and 'ever', which are generally false; PaC significantly reduces misconfigurations but doesn't eliminate all possibilities.
Read the full bite: Policy as Code: Rules as Versioned, Testable Code
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.