Technical interview guide

Infrastructure as Code

Defining infrastructure in version-controlled configuration instead of clicking through a console — reproducible, reviewable, and diffable.

Read: 25 min
Practice MCQs: 25
Interview QA: 25
Edition: v6
Editorial status: Reviewed
Relevant for: AI EngineerBackend EngineerCloud ArchitectCloud Security EngineerCybersecurity EngineerDevOps EngineerForward Deployed Engineer (FDE)Full-Stack DeveloperMLOps EngineerNetwork EngineerPlatform EngineerSecurity ArchitectSite Reliability EngineerSolutions Architect

Scope: Terraform language and CLI documentation accessed 2026-08-30; OpenTofu 1.13 state encryption; current AWS CloudFormation change-set and drift behavior..

Interview QA

Treat each question like a live interview question: answer out loud first (structure, assumptions, tradeoffs), then open the model answer to spot gaps and rehearse a tighter follow-up.

Curated: 2026-10-05 · Written: 2026-09-10 · Reviewed: 2026-10-03

QA-1

Explain declarative IaC and where its convergence model stops.

QA-2

Design the state backend for a team-managed production platform.

QA-3

Walk through a production plan-and-apply pipeline.

QA-4

How do you review a plan that replaces a stateful service?

QA-5

How would you structure reusable modules for several teams?

QA-6

Design environment isolation for development, staging, and production.

QA-7

How do you detect and reconcile infrastructure drift?

QA-8

How would you bring an existing manually created resource under IaC?

QA-9

How do you refactor resource addresses without recreating infrastructure?

QA-10

Explain why rollback is usually a forward operation in IaC.

QA-11

What should an IaC test strategy cover?

QA-12

How should provider and tool versions be managed?

QA-13

How do you keep secrets out of IaC configuration and artifacts?

QA-14

How would you split a growing monolithic state safely?

QA-15

How do you handle concurrent IaC changes to the same environment?

QA-16

How would you respond to a failed apply that changed some resources?

QA-17

How should prevent-destroy controls be used?

QA-18

When should you use ignore-changes, and how do you govern it?

QA-19

How do you evaluate the blast radius of an IaC pull request?

QA-20

Design policy-as-code controls for an IaC platform.

QA-21

How do you estimate and control IaC-driven cost changes?

QA-22

How would you adopt IaC in an organization with heavy console usage?

QA-23

What does idempotence mean for IaC, and what does it not mean?

QA-24

How do cross-state dependencies affect platform reliability?

QA-25