Infrastructure as Code & automation

Correct — reproducible, reviewable, auditable like software.

Correct — nobody can recreate it, and the code no longer matches reality.

Correct — Terraform's job; Ansible then configures it.

Correct — safe to run continuously.

Correct — always read the plan for destroys.

Correct — exposes resource types; makes Terraform cloud-agnostic.

Correct — TYPE "name" plus arguments.

Correct — Terraform's memory of what it created.

Correct — gitignore it; use an encrypted remote backend.

Correct — the dangerous one; scan plans for it.

Correct — reproducible runs; a new major could break config.

Correct — nothing to install on targets.

Correct — a playbook targets a group.

Correct — ok = already in desired state; changed = it did something.

Correct — guard it, or use a module that declares desired state.

Correct — good at large-scale continuous enforcement.

Correct — call it like a function with different inputs.

Correct — local copies diverge and get clobbered.

Correct — via a DynamoDB table or Terraform Cloud; serialize applies.

Correct — strong blast-radius boundaries.

Correct — a scale tool for many envs/components.

Correct — near drop-in; foundation-governed.

Correct — power and complexity of a full language.

Correct — Terraform spans clouds.

Correct — appeals to platform teams on K8s.

Correct — CloudFormation for deep AWS, Crossplane for K8s platforms, etc.

Correct — install/upgrade/rollback an app as one unit.

Correct — {{ .Values.replicas }} filled from values-prod.yaml.

Correct — built into kubectl (apply -k).

Correct — application-level rollback.

Correct — pin the version, helm template to review, override defaults.

Correct — guardrails in code, before apply.

Correct — deny rules fail the build.

Correct — a baseline of security knowledge for free.

Correct — warnings get ignored; gates hold.

Correct — scanners catch known patterns, not logic/design flaws.

Correct — merge to change infra.

Correct — reviewed plans, audit trail, no local prod creds.

Correct — often used alongside Atlantis.

Correct — branch protection, reviews, scoped runner creds, isolation.

Correct — detect with scheduled plan; the durable fix is preventing out-of-band changes.

Correct — strongest confidence; run for key modules/releases.

Correct — avoid orphaned resources and surprise bills.

Correct — code references it; value is not stored in code.

Correct — "keep secrets out of code" is only half; guard state.

Correct — IaC runs with the power to change everything.