TF-004 Understand IaC concepts Practice Question
A development team is using a declarative IaC tool. They make a change to the configuration file to add a new security group rule. When they apply the configuration, the tool automatically modifies the existing security group to add the rule. What is this behavior called?
⚠ Common exam trap
Many candidates confuse the automatic correction of drift with the initial provisioning process, or they mistakenly think that any automated change is 'imperative execution' rather than recognizing the declarative reconciliation loop.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Desired state reconciliation
This behavior is called desired state reconciliation because declarative IaC tools like Terraform or AWS CloudFormation compare the current state of infrastructure against the desired state defined in the configuration file. When a new security group rule is added to the configuration, the tool automatically computes the necessary changes to reconcile the actual state with the desired state, creating, updating, or deleting resources as needed. This is a core principle of declarative IaC, where the user specifies the 'what' and the tool handles the 'how'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Desired state reconciliation
Why this is correct
Declarative IaC tools continuously perform desired state reconciliation by comparing the current actual infrastructure state with the configuration defined as the desired state. This process automatically identifies any discrepancies and applies the necessary changes, such as creating, updating, or deleting resources, to bring the infrastructure into full alignment. This ensures that the deployed environment consistently matches the specified blueprint, automating infrastructure management and preventing configuration drift.
- ✗
Provisioning
Why it's wrong here
Provisioning specifically refers to the initial setup and deployment of new infrastructure resources from scratch, establishing their baseline configuration. While declarative IaC tools certainly perform provisioning as part of their lifecycle, this term primarily describes the initial creation phase. The question implies ongoing management and modification beyond just the first deployment, which is a broader concept than mere provisioning.
- ✗
Imperative execution
Why it's wrong here
Imperative execution dictates a precise sequence of explicit commands or steps that must be followed to achieve a particular infrastructure state. Unlike declarative approaches, it requires the user to specify *how* to make changes, rather than simply defining *what* the final state should be. This method does not involve automatic state comparison or reconciliation, relying instead on direct, step-by-step instructions.
- ✗
Resource drift
Why it's wrong here
Resource drift describes the phenomenon where the actual state of deployed infrastructure resources deviates from their intended or desired state as defined in the IaC configuration. This divergence often occurs due to manual out-of-band changes or unmanaged updates, leading to inconsistencies. While declarative tools aim to detect and correct drift, drift itself is the *condition* of discrepancy, not the *action* taken by the tool to resolve it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.