TF-004 Read, generate and modify configuration Practice Question
A team is using a remote backend for Terraform state. After merging a pull request that modifies the configuration, the pipeline runs `terraform plan` and sees an unexpected diff for a resource that was not changed in the code. The state file is up-to-date with the infrastructure. What is the most likely cause?
⚠ Common exam trap
HashiCorp often tests the misconception that a stale state file is the default cause of unexpected diffs, but the key detail here is that the state is explicitly up-to-date, forcing candidates to recognize external modification as the root cause.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The actual infrastructure was modified outside of Terraform
When infrastructure is modified outside of Terraform (e.g., via the cloud console, CLI, or another tool), the next `terraform plan` will detect a drift between the actual infrastructure state and the desired configuration in the code. Since the state file is up-to-date with the infrastructure, the unexpected diff indicates that the remote state accurately reflects the live environment, but the configuration no longer matches due to external changes. This is a classic case of configuration drift, which Terraform surfaces as a plan diff even when no code changes were made.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The provider version has been updated and includes a change to the resource schema
Why it's wrong here
A provider version update that changes a resource schema would typically cause Terraform to propose changes across all instances of that resource type if the schema modification is general. If only a single resource shows a diff, it's less likely to be a broad schema change affecting its fundamental structure, unless the specific configuration of that one resource now violates a new constraint. Instead, Terraform would attempt to update the resource to conform to the *new* schema, which is distinct from detecting an *external* modification to the existing resource.
- ✗
A previous `terraform state rm` command removed the resource from state
Why it's wrong here
If a `terraform state rm` command was previously executed for a specific resource, Terraform would no longer track that resource in its state file. Consequently, when `terraform plan` is run, it would identify the resource defined in the configuration as untracked and propose to *create* a new instance of it, rather than detecting a modification or diff on an existing, tracked resource. This scenario would not result in a diff on an *unchanged* resource, but rather a proposal for recreation.
- ✗
The state file is stale and needs to be refreshed
Why it's wrong here
The `terraform plan` command inherently performs a refresh operation by querying the actual infrastructure to compare its current state against the Terraform configuration and the state file. Therefore, if `terraform plan` is showing a diff, it signifies that the state *has* been refreshed, and a discrepancy was identified between the desired configuration and the actual infrastructure. The problem statement implies the state file reflects the last known configuration, but the actual infrastructure has diverged, which `terraform plan` successfully detected.
- ✓
The actual infrastructure was modified outside of Terraform
Why this is correct
When infrastructure resources are modified directly through the cloud provider's console, API, or CLI, these changes are not automatically recorded in Terraform's state file. This discrepancy between Terraform's desired state (from configuration and state file) and the actual state of the infrastructure is known as configuration drift. Running `terraform plan` will detect this drift by comparing the actual infrastructure with the state file and configuration, proposing actions to bring the infrastructure back into alignment with the Terraform configuration.
Go deeper
Related to this question
About these practice questions
Courseiva writes every TF-004 question from scratch — 428 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.