TF-004 State file Practice Question
Exhibit
$ terraform init Initializing the backend... Successfully configured the backend "s3"! Terraform will automatically use this backend for state storage. Initializing provider plugins... - Finding latest version of hashicorp/aws... - Installing hashicorp/aws v4.0.0... - Installed hashicorp/aws v4.0.0 (signed by HashiCorp) Terraform has been successfully initialized! $ terraform plan No changes. Your infrastructure matches the configuration. Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.
Refer to the exhibit. A developer runs terraform plan and sees "No changes". However, the developer knows that manual changes were made to the infrastructure outside Terraform. What is the most likely reason terraform plan does not detect the drift?
⚠ Common exam trap
A common mistake is assuming that `terraform plan` detects any infrastructure drift, but it only detects changes to resources that Terraform manages. Manual changes to unmanaged resources are invisible to Terraform.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The manual changes were made to resources not managed by Terraform.
Terraform plan detects drift by comparing the current configuration against the state file, but only for resources that Terraform manages. If manual changes are made to resources that are not recorded in Terraform's state (i.e., resources created outside of Terraform or not imported), then plan will not detect them because those resources are unknown to Terraform. Options B, C, and D are incorrect: B is false because plan can detect drift with refresh; C is not necessarily true as the changes may still exist; D is false because modern Terraform refreshes state by default before planning, but that refresh only applies to managed resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The manual changes were made to resources not managed by Terraform.
Why this is correct
This is the correct explanation. Terraform's `plan` command operates by comparing the desired state (from configuration files) with the actual state of *managed* resources (as recorded in the state file and refreshed from the cloud provider). If manual changes were applied to resources that were provisioned outside of Terraform's control, or to attributes of managed resources that Terraform does not explicitly track, these changes would not be reflected in the Terraform state file and thus would be invisible to `terraform plan`.
- ✗
Terraform only detects drift when running terraform apply.
Why it's wrong here
This option is incorrect. Terraform's primary mechanism for detecting configuration drift is during the `terraform plan` phase. When `terraform plan` is executed, it first refreshes the state (by default in modern versions) to identify any discrepancies between the recorded state and the real-world infrastructure for *managed* resources. The `terraform apply` command then executes the changes outlined in the plan, but the drift detection itself occurs earlier during the planning stage.
- ✗
The manual changes were reverted before the plan was run.
Why it's wrong here
This option is incorrect because the problem statement implies the developer made manual changes and is surprised `terraform plan` did not detect them. If the changes had been reverted, the infrastructure would match the Terraform state, and `terraform plan` would correctly report "no changes to apply," which would not be surprising to the developer. The scenario suggests an expectation of drift detection that isn't met, not that the drift was undone.
- ✗
Terraform plan does not refresh state by default; it uses the existing state file.
Why it's wrong here
This statement is incorrect for modern Terraform versions (0.15.4 and later). By default, `terraform plan` performs a state refresh, which involves querying the cloud provider to get the current actual state of all resources *managed* by the configuration. It then compares this refreshed actual state against the desired state defined in the configuration. Therefore, `terraform plan` *does* compare against live resources for managed infrastructure.
Go deeper
Related to this question
About these practice questions
One of 428 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.