1.8Interview Depth Check

Question 1

Prompt: Your team is introducing infrastructure testing for the first time on a Terraform-managed AWS environment. The CTO wants full coverage but the team has limited bandwidth. How would you prioritize the rollout?

What a strong answer should cover:

• Start from the bottom of the pyramid: pre-commit hooks with terraform fmt and validate first
• Add static analysis (Checkov or tfsec) as a CI gate next -- zero cost, high value
• Introduce plan-time assertions for critical safety checks (no destroys, no public access)
• Defer integration tests (Terratest) to critical shared modules only
• Justify each layer by cost-to-value ratio

Example answer:

• "I would start with pre-commit hooks for terraform fmt and validate -- five minutes to set up, catches formatting and syntax issues on every commit"
• "Next, I would add Checkov to CI, which ships with 1000+ built-in rules and requires zero configuration. This catches security misconfigurations like public S3 buckets and unencrypted databases"
• "For plan-time analysis, I would write Python assertions against the terraform plan JSON to block resource deletions and public access patterns"
• "Integration tests with Terratest would come last, targeted only at shared modules like the VPC or RDS module that multiple teams depend on"
• "This sequence delivers increasing value at each step while keeping initial investment low"

Question 2

Prompt: A developer argues that terraform validate is sufficient for ensuring infrastructure quality. How do you respond?

What a strong answer should cover:

• terraform validate checks syntax and structure, not security or compliance
• Specific examples of what validate accepts but is dangerous (public S3, open security groups, wildcard IAM)
• The role of static analysis tools in catching semantic issues
• Framing it as complementary layers, not either/or

Example answer:

• "terraform validate confirms that HCL parses correctly and required arguments are present, but it happily accepts an S3 bucket with public-read ACL, an RDS instance without encryption, or a security group open to 0.0.0.0/0 on all ports"
• "These are all syntactically valid Terraform but represent serious security risks"
• "Static analysis tools like Checkov and tfsec check against databases of security rules that validate is not designed to enforce"
• "I frame it as layers: validate ensures your code is correct HCL, static analysis ensures it is safe HCL"

Question 3

Prompt: You are evaluating IaC testing tools for a greenfield project. Walk me through your selection criteria and which tools you would choose.

What a strong answer should cover:

• Map tools to pyramid layers (syntax, static, plan, integration)
• Consider team language preferences, cloud provider, and CI platform
• Defense in depth -- use multiple tools with different rule databases
• Cost considerations for integration testing

Example answer:

• "I map tool selection to the validation pyramid. For syntax: terraform fmt and validate plus TFLint for provider-specific rules. For static analysis: Checkov for broad built-in coverage plus OPA/Conftest for custom organizational policies"
• "For plan-time: Python scripts asserting against the plan JSON. For integration: Terratest for critical shared modules"
• "I use at least two static analysis tools because different scanners have different advisory databases -- Checkov may catch issues tfsec misses and vice versa"
• "For container scanning, Trivy covers images, filesystems, and IaC config in a single binary, which simplifies toolchain management"