What does IaC stand for?
IaC stands for Infrastructure as Code. Managing infrastructure through versioned configuration files instead of manual setup, so environments are repeatable and changes can be reviewed and scanned before deployment.
With IaC, servers, networks, firewalls and cloud services are described in text files and created by a tool that reads those files, instead of being set up by hand in a console. The files live in version control, so every change is reviewed, recorded and can be rolled back. Running the same file twice gives the same result, which makes environments consistent. The security consequence cuts both ways: a reviewed template prevents one-off mistakes, and a mistake in a template is repeated everywhere it is used.
IaC in practice: an example
A team needs an identical test environment. Instead of clicking through forty console screens, an engineer runs the template that built production, with a different name and size. A reviewer had already caught, in the pull request, a storage rule that would have been open to the internet.
What IaC is confused with
IaC vs configuration management: what is the difference?
IaC usually means creating the infrastructure itself: networks, virtual machines, storage. Configuration management tools set up what runs inside machines that already exist. The two overlap and are often used together.
IaC vs configuration drift: what is the difference?
Drift is the gap that appears when someone changes a live system by hand and it no longer matches its definition. IaC is the practice that makes drift visible and correctable.
Which exams cover IaC?
IaC is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 3.1 (Security Architecture).
- CySA+ CS0-004: 1.5 (Security Operations).
- Network+ N10-009: 1.0 (Networking Concepts).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. What is a security benefit of defining infrastructure as code?
- Changes are reviewed and recorded in version control before they are applied
- Passwords are no longer needed
- Firewalls become unnecessary
- Servers can no longer be patched
Show the answer
A. Changes are reviewed and recorded in version control before they are applied. Because the definition is a text file in version control, every change has an author, a review and a history, and a bad change can be reverted.
2. An administrator opens a firewall port directly in the cloud console on a system that is defined in code. What is the result called?
- Configuration drift
- Load balancing
- Key escrow
- Tokenization
Show the answer
A. Configuration drift. The live system now differs from its definition. The next deployment may remove the manual change, or the difference may go unnoticed until it causes a problem.
Sources: NIST glossary: infrastructure as code; Microsoft Learn: What is infrastructure as code (IaC)?. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.