TF-004 Understand IaC concepts Practice Question
A company uses Terraform to deploy virtual machines. They want to ensure that the same exact operating system and software versions are used every time. Which practice supports this?
⚠ Common exam trap
HashiCorp often tests the misconception that userdata scripts or configuration management tools can guarantee identical software versions, but the trap is that these methods depend on external sources (repositories, scripts) that can change over time, whereas a golden image captures a fixed, immutable state at build time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Using a golden image and referencing it in the configuration
Using a golden image—a pre-configured virtual machine template containing the exact operating system and software versions—ensures consistency across deployments. Terraform can reference this image via the `source_image` or `image_id` argument in a resource like `azurerm_virtual_machine` or `aws_instance`, guaranteeing that every provisioned VM starts from the same immutable baseline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manually installing software
Why it's wrong here
Terraform's core principle is Infrastructure as Code (IaC), aiming for automation, consistency, and repeatability across environments. Manually installing software on provisioned virtual machines directly contradicts this principle, introducing human error, making deployments non-deterministic, and hindering version control and auditability. This approach negates the benefits of using Terraform for infrastructure management, leading to configuration drift, security vulnerabilities, and significant operational inefficiencies over time.
- ✓
Using a golden image and referencing it in the configuration
Why this is correct
A golden image, pre-configured with all necessary operating system patches, required software, and security hardening, ensures that every virtual machine provisioned from it is identical and compliant from the moment it launches. By referencing this image ID within the Terraform configuration, the deployment becomes highly repeatable, consistent, and significantly faster, as no post-provisioning installation steps are required. This method aligns perfectly with immutable infrastructure principles, drastically reducing configuration drift and simplifying management and troubleshooting.
- ✗
Using inline userdata scripts
Why it's wrong here
While `user_data` scripts allow for initial configuration upon VM boot, they execute *after* the virtual machine is provisioned and rely on the guest operating system to correctly interpret and run them. This introduces a potential failure point, as script execution can be inconsistent, difficult to debug, and slower than using a pre-baked image. For complex software installations or critical dependencies, `user_data` can become unwieldy and less reliable than a fully prepared golden image, which guarantees the state of the VM from launch.
- ✗
Running configuration management after provisioning
Why it's wrong here
Integrating a separate configuration management tool (e.g., Ansible, Chef, Puppet) *after* Terraform provisions the virtual machine introduces an additional layer of complexity and a potential for race conditions or partial failures. While these tools are powerful for ongoing state management, relying on them for initial software installation means the VM is not immediately ready for use upon Terraform completion, and its configuration state is managed outside of Terraform's direct purview. This can lead to configuration drift if the CM tool fails or is not perfectly synchronized, making the infrastructure less predictable and harder to audit through Terraform alone.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.