Self-Assessment Quiz: Infrastructure as Code

Twenty questions. Aim for 16 or more. Questions 6, 7, and 17 are the ones both case studies turn on.

Question 1

Of the three things infrastructure as code buys, the most valuable is:

• A. Recreation
• B. Review
• C. Reasoning
• D. Compliance

Question 2

Terraform state is:

• A. Derived from reality on every plan
• B. A file recording what Terraform believes exists
• C. Stored in the cloud provider
• D. Regenerated from configuration

Question 3

terraform apply without a saved plan file:

• A. Applies the plan you reviewed
• B. Re-plans at apply time, so it may not do what you read
• C. Is faster
• D. Is required for locking

Question 4

The boundary is:

• A. Terraform owns everything
• B. Terraform owns what must exist before your pipeline runs; the pipeline owns what it produces
• C. Terraform owns production only
• D. There is no useful boundary

Question 5

One reason for that boundary is ownership at 05:00. Specifically:

• A. Terraform is slow
• B. Chapter 26's pre-authorized actions must be executable without an apply and a state lock
• C. State locks expire overnight
• D. On-call engineers lack permissions

Question 6

-/+ in a plan means:

• A. Update in place
• B. Destroy and then create a replacement
• C. Create then destroy the old
• D. No change

Question 7

A rename of snowflake_database.name:

• A. Updates in place
• B. Forces a replacement — the database is dropped and an empty one created
• C. Is rejected by the provider
• D. Requires a migration block

Question 8

Plan: 2 to add, 1 to change, 1 to destroy is:

• A. Sufficient to review
• B. A summary that does not say which
• C. An error
• D. Only shown on destroys

Question 9

Pinning FROM python:3.11.9-slim rather than a digest:

• A. Is fully reproducible
• B. Leaves a tag that can be re-pushed
• C. Is invalid syntax
• D. Prevents caching

Question 10

Which is not a genuine reason to run Kubernetes?

• A. Per-task resource isolation
• B. Conflicting dependencies between DAGs
• C. Throughput and scale
• D. It is already operated by your organization

Question 11

The most valuable artifact of importing existing infrastructure is:

• A. The state file
• B. The first plan after each import — a list of everything you got wrong or that changed without you
• C. The module structure
• D. The documentation

Question 12

Kestrel imported 94 resources. How many differences did nobody know about?

• A. 0
• B. 8
• C. 31
• D. 94

Question 13

A state file's real unit is:

• A. A cloud account
• B. A set of changes that must be applied together by the same person
• C. A directory
• D. An environment

Question 14

Which split should you make on day one?

• A. By cloud provider
• B. Stateful from stateless
• C. By team
• D. One file per resource

Question 15

With OIDC federation, credential rotation:

• A. Happens quarterly
• B. Stops being an event, because there is nothing to rotate
• C. Requires a runbook
• D. Is handled by the secret manager

Question 16

Which credential does a data platform most often forget?

• A. The warehouse password
• B. The Airflow metadata database, which holds every connection and often XCom values
• C. The git token
• D. The monitoring API key

Question 17

Drift is:

• A. A discipline failure to be prevented
• B. Inevitable, because Chapter 26 pre-authorizes console changes during incidents
• C. Caused by Terraform bugs
• D. Only a problem in shared accounts

Question 18

Therefore the design goals are detect, reconcile deliberately, and:

• A. Prevent
• B. Never let an unrelated apply silently revert someone's fix
• C. Audit quarterly
• D. Restrict console access

Question 19

managed_by = "terraform" as a tag is useful because:

• A. Terraform requires it
• B. It makes console-created resources findable by their absence
• C. It reduces cost
• D. It enables locking

Question 20

After an UNDROP or a restore, you must separately verify:

• A. Nothing
• B. Grants, tags, and policies — the restore returns the object, not its context
• C. The row counts only
• D. The Terraform state

Answer Key

1. B — §28.1. Review is barely mentioned in the literature and recreation is always cited, and most teams recreate their platform approximately never.

2. B — §28.2. Which is why drift exists.

3. B — §28.2. Plan to a file, review it, apply that file.

4. B — §28.3.

5. B — §28.3. Anything Terraform owns is not executable by the on-call engineer alone.

6. B — §28.3. For most resources routine; for a stateful one it means "delete the thing containing your data."

7. B — Case Study 1. ForceNew, invisible in the diff. A rename is the dangerous case because in a diff it looks like a rename.

8. B — §28.3. The count does not say which, and it has appeared above a dropped production database.

9. B — §28.4. A tag is a pointer; a digest is content-addressed.

10. C — §28.5. All three genuine reasons are about isolation, not scale.

11. B — §28.7. The value is extracted before you manage anything.

12. C — §28.7. Including a bucket believed versioned and not, two roles with s3:* on *, a warehouse at the wrong size, and a lifecycle rule sending a monthly job's data to Glacier.

13. B — §28.8. Which is why splitting by environment is universal and splitting by layer is contested.

14. B — §28.8. Retrofitting it means moving resources between states, which is the one Terraform operation with no good story.

15. B — §28.9. Which removes an entire category of runbook that goes stale.

16. B — §28.9's 🔐 callout. A high-value target treated as plumbing.

17. B — §28.10. The 05:20 resize is correct, and it creates drift.

18. B — §28.10 and Case Study 2. Convergence without notification is the defect.

19. B — §28.11.

20. B — Case Study 1's 🔎 callout. Ninety minutes of debugging permission errors reported as connection failures.

Topic map