Implementing Infrastructure as Code (IaC) DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to monitor IaC-managed infrastructure for compliance violations, such as public S3 buckets or unencrypted EBS volumes. They want to automatically remediate any non-compliant resources. Which tool should they use?

   • ATerraform Sentinel policies
   • BAWS CloudTrail
   • CAWS Config with automatic remediation rules
   • DAnsible playbooks
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company uses Terraform to manage infrastructure and has a policy that all S3 buckets must have versioning enabled. They want to automatically detect any bucket that does not comply with this policy and alert the security team. They also want to prevent non-compliant buckets from being created in the first place. Which combination of tools should they use?

   • AUse only Terraform Sentinel policies to prevent non-compliant buckets.
   • BUse AWS CloudTrail to monitor `CreateBucket` events and alert on any bucket creation.
   • CUse only AWS Config to detect non-compliant buckets and send alerts.
   • DUse Terraform Sentinel policies to prevent non-compliant buckets during plan, and AWS Config to detect and alert on existing non-compliant buckets.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company uses both Terraform and Ansible in their infrastructure management. They want to ensure that the configuration management is consistent across all servers and that any drift is detected. Which approach should they use?

   • AUse only Ansible to provision and configure
   • BUse Ansible to enforce the desired state on a schedule and use Terraform to provision the infrastructure
   • CUse a manual process to check configuration drift
   • DUse only Terraform to manage both provisioning and configuration
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company wants to ensure that all infrastructure changes are auditable and traceable. They use Terraform and want to know who made each change and when. What should they implement?

   • AUse Terraform import to track changes
   • BUse a CI/CD pipeline that runs terraform apply with a service principal
   • CUse a local state file and rely on the file system's modification time
   • DStore Terraform state in a remote backend with versioning and enable audit logging on the backend
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a recommended security practice when handling secrets (e.g., API keys, passwords) in Infrastructure as Code templates?

   • AUse the same secret across all environments to reduce complexity
   • BStore secrets in a dedicated secret management service and reference them dynamically
   • CEmbed secrets directly in the template files for simplicity
   • DEncrypt the template files with a shared password
   Reveal Solution Discussion Select an answer first