TF-004 Understand IaC concepts Practice Question
A startup is adopting Terraform to manage their cloud infrastructure. They want to ensure that changes to infrastructure are reviewed and approved before being applied. Which practice aligns with Infrastructure as Code principles to achieve this?
⚠ Common exam trap
A common misconception is that storing Terraform state files in version control is a best practice, but it is actually a security anti-pattern because state files often contain sensitive data and Terraform requires state locking for safe concurrent operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a Git-based workflow with pull requests and automated plan reviews.
It aligns with Infrastructure as Code (IaC) principles by using a Git-based workflow where changes are proposed via pull requests, reviewed by peers, and validated through automated Terraform plan runs before merging. This ensures that all infrastructure modifications are version-controlled, auditable, and require explicit approval, preventing unauthorized or erroneous changes from being applied directly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a Git-based workflow with pull requests and automated plan reviews.
Why this is correct
A Git-based workflow provides robust version control for Terraform configurations, enabling a complete audit trail of all infrastructure changes. Pull requests facilitate essential peer review and approval gates, ensuring code quality and adherence to organizational standards. Automated plan reviews, typically integrated into a CI/CD pipeline, validate syntax, enforce policies, and predict infrastructure changes, significantly reducing the risk of errors before deployment.
- ✗
Use Terraform workspaces to separate environments and manually apply changes.
Why it's wrong here
While Terraform workspaces effectively manage multiple distinct state files for different environments (e.g., dev, staging, prod) within a single configuration, manually applying changes negates crucial benefits of automation. This approach bypasses automated validation, policy enforcement, and peer review processes, introducing a high risk of human error, inconsistency, and unapproved modifications across environments.
- ✗
Store Terraform state files in a version control system to track changes.
Why it's wrong here
Storing Terraform state files directly in a version control system like Git is highly discouraged due to significant security and operational risks. State files often contain sensitive information, potentially including secrets, and committing them exposes this data. Furthermore, it creates concurrency challenges, making collaborative development difficult and increasing the likelihood of state corruption or accidental overwrites, which remote backends are designed to prevent.
- ✗
Encourage developers to run terraform apply directly on production.
Why it's wrong here
Allowing developers to directly execute `terraform apply` against production environments bypasses critical safeguards inherent in a well-designed IaC workflow. This practice eliminates opportunities for peer review, automated policy checks, and controlled deployment pipelines, drastically increasing the likelihood of misconfigurations, security vulnerabilities, and service outages due to unvetted or erroneous changes.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.