AZ400-Q: Detecting configuration drift in Terraform
Q: A resource was changed out-of-band (manually in the portal) after it was provisioned by Terraform. The Terraform state file is now out of date. Which command reveals the mismatch (drift) between the real resource and the declared/recorded state without applying changes?
- A)
terraform plan✓ - B)
terraform destroy - C)
terraform importonly - D)
terraform apply
Answer: A. terraform plan refreshes the state against the actual infrastructure and shows the diff between desired state and real state — surfacing drift — without making changes. terraform apply would attempt to fix the drift; import brings existing resources into state; destroy removes resources.
Why it helps
Understanding Terraform’s plan/apply cycle and how it exposes configuration drift is a core “terraform in Azure” / desired-state AZ-400 objective.