What best defines infrastructure drift and how can it be prevented?

• A. Drift occurs only in cloud accounts; use on-prem checks.
• B. Infrastructure always matches code; no drift occurs.
• C. Actual infrastructure diverges from code; prevent by frequent reconciliation, drift detection, and reapplying IaC.
• D. Prevent drift by removing IaC and manually configuring every server.

Answer: (C)

Infrastructure drift is when the actual resources in your environment diverge from what your IaC code defines as the desired state. This happens because changes can occur outside the code—manual edits, automatic updates, or external processes alter configurations without updating the IaC.

The best way to prevent drift is to continuously reconcile the live environment with the declared state: regularly detect any differences and reapply the IaC so the real resources match the code. This approach keeps your infrastructure in sync, catches changes early, and enforces the intended configuration through automated remediation.

Drift isn’t limited to cloud accounts or to on-prem setups; it can happen anywhere there’s manual or out-of-band modification. Saying that infrastructure always matches the code is incorrect, and removing IaC in favor of manual configuration is a sure path to drift and instability.