A cloud team deploys 50 environments from a single infrastructure-as-code template. A later review finds that the same storage bucket in every environment allows public read access, all traced to one line in the template. What does this situation BEST illustrate about infrastructure as code?
Select an answer to reveal the explanation.
Short Explanation
Infrastructure as code is a photocopier: one perfect original gives you 50 perfect copies, and one typo gives you 50 typos. That's the trade-off you're seeing here. Don't call it drift, since drift means hand-made changes pulling environments apart, and these all match exactly.
Full Explanation
Infrastructure as code defines infrastructure in machine-readable templates that are deployed automatically, which delivers consistency, repeatability, and version control. The same property cuts both ways: a misconfiguration in the template is reproduced faithfully in every environment built from it. The remedy is to treat templates like code, with peer review, policy-as-code checks, and static scanning before deployment. Configuration drift describes environments diverging from their intended baseline because of manual or out-of-band changes; here every environment matches the template exactly, which is the opposite of drift. Attributing the exposure to provider defaults contradicts the finding, because the review traced the setting to an explicit line in the template rather than to an unset value the provider filled in. Claiming that infrastructure as code removes misconfiguration risk is incorrect; it removes inconsistency introduced by humans clicking through consoles, but it cannot detect a wrong decision encoded in the template. Exam caveat: the consistency benefit of infrastructure as code also makes remediation fast, since correcting the template and redeploying fixes every environment at once. Operational check: correct the template, add an automated policy check that blocks public storage access in the deployment pipeline, redeploy, and confirm through cloud posture scanning that all 50 buckets are private.