What Terraform interview questions should I expect?

Most Terraform interviews open with the workflow and move quickly to what happens underneath it. Be ready to walk the lifecycle without notes: terraform init downloads providers and configures the backend; terraform plan compares the desired configuration against the state file and the real resources, then prints the actions it would take; terraform apply executes that plan; terraform destroy removes what the configuration manages. The first follow-up is almost always why plan and apply are separate steps, and the answer is review and safety: a plan can be inspected, approved, and saved before anything changes.

• Providers. Plugins that talk to an API such as AWS, Azure, Google Cloud, or Kubernetes. Follow-up: why pin provider versions?
• Resources and data sources. Resources are things Terraform creates and owns; data sources read existing things it does not manage.
• Variables, locals, and outputs. Inputs, computed values, and exported values. Follow-up: how do you keep a secret out of a plan's output?
• The dependency graph. Terraform orders operations from references between resources; depends_on exists for dependencies the graph cannot see.

Answer with what each command reads and writes. Candidates who say that plan is read-only and apply mutates both infrastructure and state have already shown they understand the model.

You know state is important and you suspect the interviewer will find the edge of your understanding. That is fair, so this section covers the questions that reach that edge, and what a complete answer contains.

• Where does state live and why not locally? A remote backend such as an object storage bucket, Terraform Cloud, or a database gives a shared source of truth. The follow-up is locking: two people applying at once corrupt state, so backends that support locks refuse the second run.
• What is in the state file? Resource attributes, including values you may consider sensitive. Say that state must be treated as secret material, encrypted at rest, and access-controlled.
• Modules. A module is a reusable set of resources with its own inputs and outputs. Interviewers ask how you version modules, how you avoid a module that tries to do everything, and how a root module composes child modules.
• Workspaces versus separate configurations. Workspaces give one configuration several state files. The trap answer is treating them as the whole environment story; production usually deserves its own configuration, backend, and credentials rather than a workspace switch.
• Refactoring without destroying. Renaming a resource makes Terraform want to destroy and recreate it. Know that moved blocks and terraform state mv exist and what each is for.

A good discipline for every answer here: name the failure the practice prevents. Locking prevents concurrent corruption; remote state prevents divergent laptops; pinned versions prevent a surprise upgrade during a routine apply.

Senior loops swap definitions for situations. A representative one: a platform engineer interviewing for an infrastructure role at a fintech company is told that someone changed a security group by hand in the cloud console, the next plan shows a diff nobody expected, and the team is nervous about applying. The strong answer names the situation as drift, explains that plan already revealed it by refreshing real state, decides whether the manual change should be kept or reverted, and either updates the configuration to match reality or applies to restore the declared state. The interviewer is listening for the decision, not for a command.

Other scenarios that recur: an apply that failed halfway and what state looks like afterwards; resources created before Terraform existed and how terraform import brings them under management; a team of several engineers and how you structure repositories, backends, and CI so that plans run on pull requests and applies run once; secrets in variables and where they should come from instead; a provider upgrade that changes resource behaviour. In every case, say the constraint, choose the mechanism, and state what it costs.

These are easier to answer well when you have said them out loud before. The mock interview mode runs scenario questions with follow-ups, and the other role and tool banks are collected under interview questions by role and topic.

For the conversational parts, yes, with limits worth stating plainly. SubcueAI's native macOS and Windows desktop app captures system audio and your microphone and shows short suggestions in a local overlay, so when the interviewer asks what state locking protects against, the mechanism is in front of you while you explain it. The browser extension's side panel does the same for browser-tab calls on Chrome or Edge, capturing the meeting tab's audio only. No bot joins the call and nothing is injected into the meeting page; the setup steps are on the tutorial page.

Where it does not help: a proctored assessment, a recorded screen, a company-managed laptop, or a live exercise where you write HCL under observation. Aaron Cao, the founder of SubcueAI, describes the design goal as a prompt for what you already know rather than a substitute for it, which is why the assistant works from your resume and your own phrasing. The honest boundaries are mapped on the detectability cluster.