TF-004 Understand IaC concepts Practice Question
A team uses Terraform to manage AWS resources. After a manual change to an S3 bucket policy through the AWS console, Terraform's next plan shows that it will revert the policy to the configuration. This is an example of which concept?
⚠ Common exam trap
Terraform certification exams often test the distinction between configuration drift correction and immutable infrastructure. Candidates may mistakenly think any automated change implies immutability, but drift correction modifies existing resources rather than replacing them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configuration drift and correction
This scenario describes configuration drift, where a manual change to an S3 bucket policy via the AWS console creates a difference between the actual state of the resource and the desired state defined in Terraform code. Terraform's next plan detects this drift and will revert the policy to match the configuration, demonstrating its correction mechanism. This is a core principle of declarative IaC tools like Terraform, which enforce the desired state and automatically remediate any out-of-band changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configuration drift and correction
Why this is correct
When a team manually alters an AWS resource managed by Terraform, it creates "configuration drift" where the actual infrastructure deviates from the defined desired state in the Terraform configuration. Terraform detects this discrepancy during a `terraform plan` operation by comparing the current state file with the live infrastructure and the configuration files. The proposed plan to revert the manual change back to the configuration's desired state exemplifies the "correction" mechanism, ensuring infrastructure consistency.
- ✗
Immutable infrastructure
Why it's wrong here
Immutable infrastructure is a paradigm where servers and other infrastructure components are never modified after deployment; instead, any change requires replacing the existing resource with a new, updated version. This approach emphasizes consistency and predictability by avoiding in-place updates that can lead to configuration drift. The scenario describes a direct manual modification to an existing resource, which is the antithesis of immutable infrastructure principles, as it involves changing a deployed component rather than replacing it.
- ✗
Resource tagging
Why it's wrong here
Resource tagging involves applying metadata labels to cloud resources for organizational, cost allocation, security, or automation purposes. Tags are key-value pairs that help categorize and manage resources, such as identifying ownership, environment, or project. While important for cloud governance, tagging is entirely unrelated to the core problem of detecting and reverting an unauthorized manual change to a resource's operational configuration, which is a matter of state management and desired state enforcement.
- ✗
Imperative provisioning
Why it's wrong here
Imperative provisioning specifies *how* to achieve a desired state through a sequence of explicit commands or steps, such as a shell script or a series of API calls. This contrasts sharply with Terraform's declarative approach, where you describe *what* the desired end state should be, and Terraform figures out the necessary steps. The scenario focuses on detecting and correcting a deviation from a *declared* desired state, not on the method by which the resource was initially provisioned or how subsequent changes are applied step-by-step.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This TF-004 question is part of Courseiva's 428-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.