TF-004 Understand IaC concepts Practice Question
An organization is evaluating IaC tools and wants to minimize configuration drift. Which characteristic of a declarative IaC approach is most effective in preventing drift?
⚠ Common exam trap
HashiCorp often tests the misconception that drift prevention is achieved through code organization (modules) or operational controls (approvals), rather than the core declarative mechanism of automated state comparison and correction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Periodic state comparison and correction
A declarative IaC approach defines the desired end state of infrastructure, and tools like Terraform use periodic state comparison (e.g., `terraform plan` and `terraform apply`) to detect and correct any configuration drift. This automated reconciliation ensures the actual infrastructure matches the declared configuration, directly preventing drift without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Periodic state comparison and correction
Why this is correct
Periodic state comparison and correction is the core mechanism by which declarative Infrastructure as Code tools like Terraform prevent configuration drift. Terraform maintains a desired state in its configuration files and a record of the actual infrastructure state in its state file. During a `terraform plan` operation, it compares these two states, identifying any discrepancies, and then `terraform apply` can be used to reconcile the actual infrastructure with the desired configuration, effectively correcting any drift.
- ✗
Manual approval gates
Why it's wrong here
Manual approval gates are procedural controls typically integrated into CI/CD pipelines, requiring human review before infrastructure changes are deployed. While they prevent unauthorized or erroneous changes from being *introduced* via the pipeline, they do not automatically detect or correct configuration drift that occurs *outside* the IaC process, such as manual modifications made directly in the cloud console. These gates are about control over deployment, not automated state enforcement.
- ✗
Tagging resources
Why it's wrong here
Tagging resources involves applying metadata labels to cloud resources for organizational purposes, such as cost allocation, environment identification, or automation triggers. While crucial for management and governance, tagging itself is a descriptive attribute and provides no inherent mechanism to monitor resource configurations or automatically revert changes if they deviate from a desired state. It helps categorize, but does not enforce configuration.
- ✗
Using modules
Why it's wrong here
Using modules in Terraform promotes reusability and standardization of infrastructure configurations by encapsulating common resource patterns. Modules ensure that resources are initially provisioned consistently according to predefined blueprints, but they do not actively monitor the deployed infrastructure for changes or automatically correct any subsequent configuration drift. Their primary role is to define and abstract resource creation, not ongoing state enforcement.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.