HashiCorp Terraform Associate (004) Question 4
Single answer1 Infrastructure as Code (IaC) with TerraformA platform team currently provisions cloud resources manually through a provider's web console. They frequently see configuration drift between environments, incomplete documentation of changes, and slow onboarding for new engineers. The team wants to adopt Terraform primarily to improve consistency and make infrastructure changes easier to review before deployment. Which Terraform capability most directly addresses this goal?
- A
Terraform stores application source code and binaries in the state file so teams can reproduce full environments from one artifact.
- B
Terraform lets teams define infrastructure in declarative configuration files that can be version controlled, reviewed, and executed repeatedly to create consistent environments.
- C
Terraform automatically prevents all out-of-band changes made directly in the cloud console, so drift cannot occur once Terraform is adopted.
- D
Terraform replaces the need for provider APIs by managing infrastructure directly from local configuration files without communicating with the target platform.
Show answer and explanation
Correct answer: B
Explanation
Terraform's primary IaC benefit is that infrastructure is defined declaratively in configuration files, enabling version control, peer review, repeatable provisioning, and clearer change management. In practice, teams use commands such as terraform plan to preview changes and terraform apply to enact them, making infrastructure changes more predictable than manual console work. HashiCorp documentation consistently emphasizes infrastructure as code, execution plans, and resource graphs as key Terraform concepts. State is important, but it is not the main feature described in this scenario; it supports Terraform's operation rather than serving as a replacement for version-controlled configuration. Likewise, Terraform can identify differences between configuration and real infrastructure, but it does not inherently block manual changes outside Terraform.
- A. Incorrect.
Incorrect. Terraform state does not store application source code and binaries as a packaging mechanism for full environments. State primarily maps Terraform-managed resources to real infrastructure objects and tracks metadata needed for planning and applying changes. A common misconception is that state is a general-purpose snapshot of everything required to rebuild an environment.
- B. Correct.
Correct. This is the core Infrastructure as Code value proposition of Terraform. Terraform uses declarative configuration files to describe desired infrastructure, which can be stored in version control, reviewed through normal code-review workflows, and applied repeatedly across environments. This improves consistency, auditability, and collaboration, which directly addresses the team's problems with manual console changes and poor change visibility.
- C. Incorrect.
Incorrect. Terraform can help detect drift during planning and refresh operations, but it does not automatically prevent all manual changes in the provider console. Organizations typically reduce drift through process controls, IAM restrictions, and by treating Terraform as the authoritative workflow. Candidates may choose this option because Terraform is associated with drift management, but prevention of all out-of-band changes is not a built-in guarantee.
- D. Incorrect.
Incorrect. Terraform communicates with infrastructure platforms through provider plugins that use the target platform's APIs. It does not bypass provider APIs. This option reflects a misunderstanding of how Terraform interacts with cloud and service providers.