Automation and Infrastructure as Code
What this domain tests
Automation and Infrastructure as Code tests repeatable provisioning through APIs, CLIs, and orchestration: Prism Central REST APIs, Calm, Terraform, Ansible, and PowerShell. The exam values idempotency, version control, secrets handling, and safe change.
Core rules
- Automate the full object graph: category, network, image, VM, and policy. A VM created without its category or network policy is incomplete.
- Idempotent tools converge to desired state. Terraform uses state and a plan; Ansible modules should be written to avoid repeated changes.
- Never hard-code credentials. Use scoped service accounts, secret stores, and least privilege.
- Pin provider and collection versions, review plans, and keep state in a locked remote backend.
Worked example
A Terraform configuration creates a VM from an image, attaches it to a subnet, and assigns a category used by a Flow policy. The first plan shows one add. Apply creates it; a second plan should show no changes. If the plan shows a replacement, inspect the image, subnet, or category reference before applying. Drift appears when someone edits the VM in Prism, so reconcile or import deliberately.
Traps
Running apply without reading the plan; storing state locally; using personal admin credentials; ignoring API pagination or task completion; and automating a bad manual process. Also remember that API success can be asynchronous: poll the task before declaring success.