Detect it by running a plan on a schedule in CI against every environment and alerting on any non empty diff, and by watching the cloud audit log for changes made outside the pipeline. Deal with it by fixing the cause, not just the symptom: reapply to revert unintended changes, import legitimate ones back into code, and remove standing write access from the console so the pipeline is the only path that can change production.
Why interviewers ask this
Drift is a slow failure that only hurts during an incident, when the code no longer describes reality. The interviewer wants to see that you detect it proactively rather than discovering it mid outage. They also want to hear the organizational half of the answer, because drift is usually a permissions and process problem, and a candidate who only offers a scheduled plan has solved half of it.
How to structure your answer
- Define drift as reality diverging from the committed configuration.
- Describe scheduled detection and audit log alerting.
- Explain how you resolve a diff once you find it.
- Address the root cause: who can change things outside the pipeline.
Example answer
Detection is the easy half. I run a plan on a schedule against each environment and treat a non empty diff as an alert, so drift shows up on a Tuesday morning rather than during an outage. Alongside that I watch the cloud audit trail for write actions by human identities rather than the pipeline role, which catches things that a plan will not see, like a manually attached policy on a resource nobody imported. When a diff appears, the first question is whether the change was intentional. If it was a two in the morning fix that saved us, it goes back into code and gets imported, and the person who made it is not in trouble, because otherwise nobody ever tells you. If it was accidental, we reapply and revert. But the durable fix is removing the ability to do it: humans get read only in production by default, with a time limited elevated role that is logged and reviewed. Before that change we were rediscovering the same drift every month; after it, drift became genuinely rare.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- How do you handle resources that a provider mutates on its own?
- What would you do if a plan wants to destroy a production database?
- How do you bring an existing untracked environment under management?
Related devops engineer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions