Get the Preplance app for a seamless learning experience. Practice offline, get daily streaks, and stay ahead with real-time interview updates.
Get it on
Google Play
4.9/5 Rating on Store
Google · Infrastructure as Code
Practice Infrastructure as Code questions specifically asked in Google interviews – ideal for online test preparation, technical rounds and final HR discussions.
Questions
66
Tagged for this company + subject
Company
View company-wise questions
Subject
Infrastructure as Code
Explore topic-wise practice
Go through each question and its explanation. Use this page for targeted revision just before your Google Infrastructure as Code round.
Centralized logging aggregates outputs from Terraform, Ansible, and CI/CD pipelines. This helps identify the cause of failures quickly, provides audit trails for governance, and ensures consistent monitoring of automation workflows across environments.
For complete preparation, combine this company + subject page with full company-wise practice and subject-wise practice. You can also explore other companies and topics from the links below.
Google Cloud Deployment Manager is the native IaC tool for Google Cloud. It uses YAML or Jinja templates to define, configure, and deploy infrastructure resources declaratively across GCP projects and regions.
State management records the current infrastructure configuration so that IaC tools know what exists, what to create, and what to destroy. In Terraform, the state file tracks resource metadata and dependencies. If state is mishandled or corrupted, it can cause drift between actual and expected infrastructure, lead to accidental resource deletions, or break dependency chains. Secure and consistent management of state—such as using remote backends with locking—is essential for collaboration and reliability.
A typical scenario is when an organization used Terraform and Ansible to automate multi-environment cloud provisioning. Before IaC, each environment was manually configured, causing delays and inconsistencies. After implementing IaC, the same configurations were version-controlled, peer-reviewed, and applied automatically through pipelines. This reduced provisioning time from days to minutes, eliminated drift, improved compliance, and enabled quick rollback or scaling during incidents. Such outcomes demonstrate the tangible value of IaC in enterprise DevOps workflows.
The Terraform state file acts as a source of truth for the deployed infrastructure. It maps resources defined in configuration files to real-world infrastructure resources. The state file enables Terraform to detect changes, plan updates, and perform drift detection accurately. It should be secured and often stored remotely in S3 or similar backends.
Provisioners in Terraform allow executing scripts or actions on resources after they are created or destroyed. For example, you can use the remote-exec or local-exec provisioner to install software or configure settings post-deployment. However, best practice discourages heavy use of provisioners because they introduce procedural logic into declarative IaC workflows.
A multi-environment Terraform setup typically uses workspaces or separate state files for each environment. Configurations are modularized with environment-specific variable files that define distinct parameters such as instance size, region, or scaling limits. The same base modules are reused across environments, ensuring consistency. Remote backends are configured for each environment to isolate state and reduce risk, while CI/CD pipelines automate promotion from dev to production with approval gates.
Ansible provides several mechanisms for error handling, including 'ignore_errors', 'failed_when', and 'block/rescue/always' blocks. You can allow playbooks to continue execution even after a task fails or trigger specific recovery actions. For critical tasks, conditions can be set to define what constitutes failure. These options make Ansible playbooks more resilient and production-ready.
Dynamic inventory allows Ansible to fetch host information directly from external sources like AWS, Azure, or Kubernetes rather than using static files. It uses scripts or plugins that query APIs to retrieve up-to-date lists of instances and their metadata. This is particularly useful in cloud or container environments where servers frequently change, ensuring accurate targeting of hosts during automation runs.
Pulumi allows engineers to define infrastructure using real programming languages like TypeScript or Python. Benefits include strong integration with existing development workflows, use of familiar programming constructs, and enhanced testability. However, challenges include a steeper learning curve for operations teams and less simplicity compared to purely declarative tools like Terraform. Pulumi is well-suited for DevOps teams with strong software engineering backgrounds.
Secrets such as API keys and credentials should never be stored in plaintext or version control. Instead, they should be managed using secure secret vaults like HashiCorp Vault, AWS Secrets Manager, or encrypted CI/CD variables. This ensures secure automation while maintaining compliance with organizational policies.
Integrating IaC with CI/CD allows infrastructure and application code to evolve together in a synchronized, automated workflow. Infrastructure changes are defined in code repositories and undergo the same lifecycle as application updates—build, test, plan, and deploy. Pipelines automatically provision infrastructure before deploying application builds. This ensures consistency, reduces drift, and enables blue-green or canary deployments with minimal downtime.
Infrastructure as Code brings automation, consistency, scalability, and traceability to infrastructure management. By treating infrastructure definitions as code, teams can version control configurations, automate provisioning, reduce human error, and ensure identical environments across development, staging, and production. It also enables faster disaster recovery, reduces manual intervention, and integrates seamlessly with CI/CD workflows, supporting true DevOps culture.
When the Terraform state diverges from actual infrastructure, running 'terraform refresh' updates it to match real-world conditions. If resources were created manually, they can be imported using 'terraform import'. This ensures Terraform's understanding of the environment stays accurate and consistent.
Configuration drift is prevented by enforcing IaC as the single source of truth. All infrastructure changes must go through code pipelines rather than manual edits. Automated drift detection tools, continuous compliance scans, and immutable infrastructure principles ensure environments remain synchronized with declared configurations.
Immutability means infrastructure components are not modified after creation. Instead, a new resource is built and swapped in. This reduces configuration drift and ensures reliable rollback, improving stability and predictability across deployments. Immutable infrastructure simplifies debugging and improves auditability.
GitOps extends IaC principles by managing infrastructure and application deployments through Git repositories. Every change to infrastructure is done through pull requests and automatically applied by CI/CD pipelines, providing traceability, security, and consistent automation.
The key principles of Infrastructure as Code include declarative definition, idempotency, immutability, modularity, and version control. Declarative definitions describe the desired end state of infrastructure. Idempotency ensures consistency across repeated executions. Immutability reduces configuration drift by replacing rather than mutating infrastructure. Modularity promotes reuse and maintainability. Finally, version control ensures traceability and collaboration across teams.
Teams detect drift by comparing the declared configuration files against the live infrastructure state. Tools like Terraform and CloudFormation have built-in commands to show drift or plan differences. Fixing drift involves reapplying the IaC code, enforcing immutable builds, or eliminating unauthorized manual changes. Implementing continuous compliance checks and version-controlled workflows helps maintain consistency and prevent future drift.
The 'terraform apply' command executes the actions outlined in the plan. It creates, updates, or deletes infrastructure resources to match the desired configuration. The command also updates the state file to reflect the latest deployed infrastructure state after a successful run.
The 'terraform.tfstate' file stores the current state of infrastructure managed by Terraform. It maps Terraform resources to their real cloud counterparts and tracks metadata such as resource IDs. Mishandling this file can cause Terraform to lose track of existing resources, potentially leading to accidental deletion or duplication. For collaboration, it should be stored remotely using secure backends like AWS S3 or Terraform Cloud with proper locking and encryption enabled.
A remote backend in Terraform is a configuration that stores the state file on an external service such as AWS S3, Azure Storage, or Terraform Cloud. It enables team collaboration by providing shared access to the same state file, supports state locking to avoid race conditions, and improves security through encryption. Using a remote backend is essential in production environments to ensure consistency and data safety across multiple users.
Modules in Terraform are reusable units of infrastructure code that group related resources together. They enable teams to define standard patterns such as VPCs, EC2 instances, or security groups once and reuse them across multiple projects. This promotes consistency, simplifies maintenance, and improves collaboration. Modules can be local or sourced from public registries such as the Terraform Registry.
Infrastructure as Code practices are often governed by compliance frameworks such as ISO 27001, SOC 2, GDPR, and PCI DSS. These frameworks dictate how data should be handled, who can access systems, and how configurations must be secured. IaC automation helps enforce these policies by embedding compliance checks directly into the deployment pipeline.
Terraform automatically manages the lifecycle of infrastructure resources based on dependencies it infers from the configuration. When one resource references another, Terraform creates a dependency graph to ensure proper creation and destruction order. The lifecycle meta-argument allows customization of behavior, such as creating before destroying or ignoring certain changes. This precise orchestration makes Terraform safe and reliable for managing complex infrastructure.
A typical Terraform workflow begins with writing configuration files in HCL to define resources. The team initializes the working directory using 'terraform init', creates an execution plan using 'terraform plan', and reviews the changes through code review. Once approved, 'terraform apply' provisions the resources, and the state file is updated in a remote backend. The workflow often integrates with CI/CD pipelines for automated validation and deployment, ensuring traceability, collaboration, and compliance with DevOps practices.
The 'terraform import' command allows you to bring existing manually created resources under Terraform management. It imports the resource into the state file without recreating it, enabling teams to transition legacy infrastructure into codified, managed environments safely.
Terraform detects drift by comparing the state file (what Terraform believes exists) with the live infrastructure fetched through provider APIs. If any changes are detected, Terraform displays them in the plan output, allowing teams to review and reconcile differences before applying updates.
Terraform state locking prevents multiple users or processes from modifying the same state file simultaneously. When a user runs a command that modifies infrastructure, Terraform locks the state file to avoid concurrent writes. Without locking, two users could apply conflicting changes, leading to corrupted state and unpredictable results. Remote backends like AWS S3 with DynamoDB or Terraform Cloud provide automatic state locking for safety in multi-user teams.
Sensitive data should never be hardcoded directly into Terraform configuration files. Instead, teams should use environment variables, encrypted variable files, or secret management services like AWS Secrets Manager or HashiCorp Vault. Terraform also supports the 'sensitive' attribute to mask values in logs and outputs. These practices help ensure compliance and prevent accidental data leaks.
Terraform Cloud offers a managed environment for running Terraform securely at scale. It provides features such as remote state storage, secure variable management, policy enforcement, collaboration controls, and integration with CI/CD pipelines. It simplifies team workflows by offering role-based access and centralized visibility into infrastructure changes across environments.
Policy as Code tools such as Sentinel or Open Policy Agent integrate with Terraform to enforce compliance and security policies programmatically. They allow defining rules like approved instance types, region restrictions, or tag requirements that must pass before infrastructure is applied. This ensures that all deployments align with corporate governance, security, and cost management standards without manual reviews.
Ansible Galaxy is a public repository and command-line tool for discovering and sharing roles and collections. It allows teams to reuse trusted community content, saving time and ensuring consistent automation standards. Developers can publish or download reusable automation modules through the Galaxy hub.
Templates in Ansible are files that use the Jinja2 templating engine to dynamically generate configuration files based on variables and logic. They allow inserting variables, loops, and conditional statements into files before deployment. For example, you can use templates to create Nginx configuration files dynamically for different environments. This makes playbooks flexible and environment-aware while maintaining automation consistency.
Ansible Vault is a security feature that allows you to encrypt sensitive data such as passwords, keys, or API tokens. It ensures that confidential information is protected even when stored in version control. Vault files can be decrypted only with a password or key at runtime. This helps organizations maintain security compliance while automating infrastructure.
A common real-world example is automating configuration management for hundreds of web servers using Ansible. Before automation, teams manually applied patches and configuration updates, which was error-prone and time-consuming. Using Ansible playbooks, updates were applied consistently across environments within minutes. Combined with Ansible Tower, this enabled centralized control, role-based access, and automated rollback, drastically improving reliability and deployment speed in production systems.
CloudFormation StackSets enable centralized deployment of stacks across multiple accounts and regions. They allow consistent infrastructure configuration at scale and simplify enterprise-wide governance. StackSets are especially valuable for multi-account or multi-region AWS architectures.
Terraform and CloudFormation are both powerful Infrastructure as Code tools, but they differ in scope and flexibility. Terraform is cloud-agnostic and supports multiple providers such as AWS, Azure, and GCP using HashiCorp Configuration Language (HCL). CloudFormation, on the other hand, is AWS-specific and uses YAML or JSON templates. Terraform offers greater modularity, reusability, and portability across platforms, while CloudFormation provides deeper native integration with AWS services.
Drift detection in CloudFormation identifies differences between the actual state of resources and their declared configuration in the template. It ensures infrastructure remains consistent with the defined specifications. Drift can occur due to manual changes or external updates. Detecting and correcting drift maintains compliance, reliability, and predictable behavior of automated deployments.
Chef uses a procedural approach through 'recipes' and 'cookbooks' written in Ruby, describing how systems should be configured step by step. Puppet follows a declarative model, where the desired system state is defined, and the engine determines how to achieve it. Puppet's model-driven design is often easier to maintain at scale, while Chef offers more control and flexibility for complex workflows.
Enterprises often combine IaC tools based on their strengths and ecosystem compatibility. Terraform can be used for provisioning multi-cloud resources, CloudFormation for AWS-specific environments, and Ansible for configuration management after resource creation. By defining clear boundaries between provisioning, configuration, and deployment, teams maintain flexibility while ensuring unified governance and automation consistency.
Policy as Code enforces security, compliance, and operational rules within CI/CD pipelines automatically. Tools like Open Policy Agent or HashiCorp Sentinel evaluate Terraform plans against pre-defined rules before deployment. This ensures that only compliant and secure configurations are applied to production.
A typical CI/CD pipeline for Infrastructure as Code follows several automated stages. The first stage checks out code from version control and runs syntax validation. The next stage executes 'terraform plan' to generate an execution plan, followed by automated testing or peer review. Once approved, the 'apply' stage provisions infrastructure. Post-deployment, the pipeline may run drift detection, policy checks, and notifications. This structure ensures repeatable, auditable, and secure infrastructure delivery.
Rollback in Infrastructure as Code pipelines can be managed by storing previous configurations in version control and using automated redeployments. If an update fails, the pipeline reverts to the last known good configuration by applying a previous commit or state version. Additionally, Terraform workspaces or CloudFormation change sets help safely roll back infrastructure with minimal downtime.
Testing Infrastructure as Code ensures reliability and consistency before deployment. Common tests include syntax validation, policy enforcement, unit tests for modules, integration testing using test environments, and post-deployment verification using monitoring tools. Automated testing in pipelines reduces human error and ensures compliance with desired configurations.
Compliance automation ensures that infrastructure deployments follow organizational, security, and regulatory policies without manual intervention. By embedding automated checks in pipelines—such as enforcing encryption standards, tagging policies, or network restrictions—organizations can prevent misconfigurations before production deployment. This leads to faster, safer, and audit-ready infrastructure delivery aligned with DevSecOps principles.
IAM configurations such as users, roles, and policies can be codified directly in IaC definitions. By version-controlling IAM definitions, teams can standardize access permissions, track changes, and ensure least privilege principles are automatically enforced during deployment.
Encryption ensures that data at rest and in transit remains secure. In IaC workflows, encrypting Terraform state files, cloud storage, and communication channels prevents unauthorized access to configuration data or credentials. This is essential for meeting enterprise compliance standards.
Governance frameworks in IaC pipelines ensure that every infrastructure change complies with organizational and regulatory policies. This is achieved through automated validations such as Policy as Code, access control checks, naming standards, and tagging enforcement. CI/CD pipelines include pre-deployment checks to block non-compliant changes. Centralized logging and audit trails ensure accountability and traceability of all infrastructure modifications.
Audit logs record all actions taken by IaC tools and users, providing visibility into changes and access patterns. They are vital for detecting unauthorized activities, ensuring accountability, and maintaining compliance. Centralized log storage and integrations with systems like AWS CloudTrail or Azure Monitor help organizations correlate changes with users, commits, and deployments for end-to-end traceability.
DevSecOps integrates security at every phase of the DevOps lifecycle, including IaC automation. By embedding scanning tools, policy enforcement, and secret management into pipelines, DevSecOps ensures that infrastructure is continuously validated for compliance and vulnerabilities. Teams shift security left, allowing faster remediation and proactive governance instead of relying on post-deployment audits.
Incident response in IaC environments must be automated and codified for speed and consistency. Infrastructure definitions include response automation such as quarantining compromised instances, rotating credentials, and restoring secure configurations from version control. Integrating monitoring alerts with IaC pipelines allows immediate corrective actions and rollback of affected environments, reducing recovery time and limiting exposure.
Centralized policy frameworks unify governance across multiple IaC tools, teams, and environments. They define global security baselines, tagging rules, resource quotas, and compliance validations applied automatically across all pipelines. This reduces fragmentation, enforces consistency, and simplifies audits while empowering teams to innovate safely within approved boundaries.
Kubernetes uses YAML files to define the desired state of cluster resources. These configurations describe what resources should exist, their replicas, labels, and specifications. Kubernetes controllers then reconcile the current state to match the desired state automatically.
Infrastructure as Code provides the automation backbone for provisioning, scaling, and managing containerized environments. It automates setup of container orchestration tools like Kubernetes, Docker Swarm, and ECS, as well as network and storage infrastructure. IaC ensures that container clusters are consistent, version-controlled, and repeatable, making deployments fast and reliable across environments.
Terraform and Ansible can provision and configure managed Kubernetes clusters such as EKS (AWS), GKE (Google Cloud), and AKS (Azure). Terraform handles cluster creation and networking through cloud provider APIs, while Ansible configures workloads, namespaces, and security policies post-deployment. This combination ensures full lifecycle automation from cluster creation to application delivery.
Managing IaC across multiple clouds introduces challenges like tool fragmentation, inconsistent APIs, and differing resource naming conventions. To mitigate these, organizations adopt cloud-agnostic tools such as Terraform, use modular templates, maintain consistent naming and tagging standards, and enforce governance policies through central CI/CD pipelines. This provides uniform control and reduces operational complexity.
GitOps extends IaC principles by managing infrastructure and application deployments through version-controlled Git repositories. In cloud-native environments, GitOps automates Kubernetes cluster management using tools like Argo CD or Flux, which continuously reconcile Git configurations with the running state. This ensures auditability, reproducibility, and automated rollbacks of both infrastructure and workloads.
IaC provides a unified, code-driven approach to manage infrastructure spanning on-premises and cloud environments. By using tools like Terraform or Ansible, organizations can automate provisioning of both local servers and cloud resources with consistent policies and configurations. This ensures smooth integration, simplified scaling, and better compliance across hybrid infrastructures.
IaC enhances resilience by codifying recovery procedures and infrastructure states. In containerized environments, it allows automatic redeployment of clusters and workloads in new regions or zones during failures. Combined with backup automation, replicated state management, and immutable configurations, IaC enables rapid disaster recovery and minimal downtime across multi-cloud or hybrid setups.
Modular design breaks large configurations into smaller, reusable components. This promotes maintainability, reduces duplication, and improves readability. In Terraform, modules encapsulate resource logic; in Ansible, roles serve a similar purpose. Modularization enables consistent patterns, easier debugging, and faster onboarding for new team members.
Rollback strategies in IaC rely on version control, immutable infrastructure, and automated redeployments. If a deployment fails, previous configurations can be restored by reapplying earlier commits or state snapshots. Tools like Terraform Cloud and CloudFormation change sets simplify controlled rollbacks, minimizing downtime and risk during failure recovery.
IaC testing includes syntax validation, policy enforcement, and automated integration testing. Tools like Terratest and Molecule simulate infrastructure deployments, validating expected outputs before production. Continuous testing ensures early detection of errors, compliance with policies, and confidence in every code change.
Teams collaborate on IaC by using branching strategies, code reviews, and automated validation pipelines. Each change should pass peer review and CI validation before merging. Clear documentation, naming conventions, and tagging policies promote consistency and reduce merge conflicts. This approach aligns infrastructure updates with software engineering discipline.
Idempotency ensures repeated executions of IaC scripts produce the same result without unwanted side effects. It enables safe re-runs during automation failures and promotes consistency across environments. Idempotency is maintained through declarative IaC design, careful use of conditionals, and avoiding state-dependent logic within automation scripts.
Key IaC best practices include version control, modular design, idempotency, policy enforcement, and secure secret management. Organizations should implement automated testing, use remote state backends, and integrate with CI/CD pipelines. Regular audits, drift detection, and documentation ensure sustainable and secure infrastructure automation at enterprise scale.