HashiCorp Terraform Associate (004) Question 182
Single answer7 Maintain infrastructure with TerraformA team manages an AWS VPC with Terraform. Another administrator manually added a new route to the route table in the AWS console to quickly restore connectivity during an incident. The Terraform configuration was not updated. Before making any further changes, the team wants to detect this out-of-band change and see exactly how Terraform would reconcile it with the current configuration, without modifying infrastructure. Which action should they take?
- A
Run
terraform refreshand review the updated state file to identify the drift - B
Run
terraform planto compare the configuration, current state, and real infrastructure - C
Run
terraform validateto detect differences between the route table in AWS and the Terraform configuration - D
Run
terraform fmtand thenterraform apply -refresh-onlyto view the drift without changing anything
Show answer and explanation
Correct answer: B
Explanation
This question tests drift detection and safe maintenance workflows. When infrastructure is changed outside Terraform, the recommended first step is typically terraform plan. The plan operation refreshes Terraform's understanding of remote objects and then compares the refreshed state to the configuration, producing an execution plan that shows what Terraform would change. This allows teams to inspect drift without modifying resources. terraform validate and terraform fmt do not interact with live infrastructure. While older workflows sometimes used terraform refresh, current best practice is to use terraform plan for review, because it gives a full preview of the reconciliation actions. HashiCorp documentation on the plan command and refresh behavior supports this approach: planning is the normal mechanism for checking proposed infrastructure changes and identifying drift before apply.
- A. Incorrect.
terraform refreshupdates the state to match real infrastructure, but by itself it is not the best choice for safely reviewing how Terraform will reconcile drift. It mutates state and does not present the same execution preview thatterraform planprovides. In modern Terraform workflows, planning is the standard way to inspect drift before taking action. - B. Correct.
Correct.
terraform planrefreshes state by querying the provider, compares the real infrastructure against the configuration, and shows the proposed changes needed to bring infrastructure back in line. This is the standard, non-destructive way to detect drift and preview remediation. - C. Incorrect.
terraform validateonly checks whether the Terraform configuration is syntactically valid and internally consistent. It does not contact the provider or inspect live infrastructure, so it cannot detect a manually added AWS route. - D. Incorrect.
terraform fmtonly reformats configuration files and has nothing to do with drift detection.terraform apply -refresh-onlycan update state to reflect real infrastructure, but it is still an apply operation and not the best choice when the team's goal is to preview changes without modifying infrastructure.terraform planis the appropriate command for inspection.