Implement Change Management: Remote State and Version Control with Pull Requests
A team is adopting Terraform to manage infrastructure. One requirement is that all configuration changes must be reviewed and approved before being applied. The team wants to ensure that the Terraform state file reflects the actual deployed infrastructure at all times. Which practice should they implement to meet these requirements?
Quick Answer
The correct practice is to store state remotely and use a version control system with pull requests to review changes before applying. This approach is essential because remote state backends like S3 or Terraform Cloud provide state locking and versioning, preventing concurrent modifications that could corrupt the state file, while the pull request workflow enforces mandatory code review and approval before any `terraform apply` can run. On the HashiCorp Terraform Associate TF-003 exam, this question tests your understanding of combining collaboration controls with state management—a common trap is thinking local state with Git is sufficient, but that fails to prevent direct apply conflicts and lacks locking. Remember the mnemonic: “Remote locks, PRs approve, state stays true.”
⚠ Common exam trap
HashiCorp often tests the misconception that local state with manual processes is sufficient for team collaboration, but the trap here is that without remote state and version-controlled review, you cannot guarantee state consistency or enforce an approval gate, leading to drift and conflicts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store state remotely and use a version control system with pull requests to review changes before applying.
Storing state remotely (e.g., in S3, Azure Storage, or Terraform Cloud) enables state locking and versioning, which is essential for team collaboration. Using a version control system with pull requests ensures that all configuration changes are reviewed and approved before being applied, meeting the requirement for change control. This combination also ensures the state file accurately reflects deployed infrastructure by preventing concurrent modifications and providing an audit trail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store state locally and use a manual approval process outside of Terraform.
Why it's wrong here
Local state cannot be locked or shared, so concurrent applies corrupt it and it drifts from reality; an external approval step does not enforce review inside Terraform. It is tempting because it appears to add governance, but the correct practice is remote state with CI-driven plan and apply.
- ✓
Store state remotely and use a version control system with pull requests to review changes before applying.
Why this is correct
Remote state with locking plus pull-request review enforces approval before any apply, and the shared backend keeps state aligned with deployed infrastructure. This satisfies both stem constraints: reviewed changes and state reflecting reality, which local state cannot guarantee.
- ✗
Store state locally and use a shared network drive for team access.
Why it's wrong here
A shared network drive gives no locking, so concurrent applies corrupt state and it captures nothing about deployed reality; review and approval happen in version control and CI, not in state storage. Remote backends with state locking exist precisely for team collaboration, which is the scenario this option superficially resembles.
- ✗
Have each team member run terraform apply from their local machine after informal discussion.
Why it's wrong here
Local applies bypass any review gate and let each engineer's state diverge from the shared remote backend, so the state no longer reflects deployed infrastructure. It is tempting because local runs feel quick, but the correct practice is a CI pipeline with remote state and pull-request approval.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 434 original TF-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on TF-004
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A startup is adopting Terraform to manage their cloud infrastructure. They want to ensure that changes to infrastructure are reviewed and approved before being applied. Which practice aligns with Infrastructure as Code principles to achieve this?
medium- ✓ A.Implement a Git-based workflow with pull requests and automated plan reviews.
- B.Use Terraform workspaces to separate environments and manually apply changes.
- C.Store Terraform state files in a version control system to track changes.
- D.Encourage developers to run terraform apply directly on production.
Why A: It aligns with Infrastructure as Code (IaC) principles by using a Git-based workflow where changes are proposed via pull requests, reviewed by peers, and validated through automated Terraform plan runs before merging. This ensures that all infrastructure modifications are version-controlled, auditable, and require explicit approval, preventing unauthorized or erroneous changes from being applied directly.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This TF-004 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the TF-004 exam.