Implementing Infrastructure as Code (IaC) DSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses Ansible for configuration management and wants to adopt IaC for provisioning cloud resources. They want to use a tool that is agentless and uses SSH for connectivity. Which tool is most appropriate?

   • ATerraform
   • BChef
   • CPuppet
   • DAnsible
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is 'drift' in the context of IaC-managed infrastructure?

   • AThe process of updating infrastructure to a new version
   • BThe error messages generated during infrastructure provisioning
   • CThe time it takes for infrastructure changes to take effect
   • DThe difference between the desired state defined in code and the actual state of the infrastructure
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A team uses Terraform to manage infrastructure on AWS. They want to ensure that no S3 bucket is created without encryption and that no security group allows SSH from 0.0.0.0/0. Which tool should they use to enforce these policies during `terraform plan`?

   • ATerraform Sentinel policies
   • BAWS Config rules
   • CAWS CloudTrail
   • DAnsible playbooks
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A startup is adopting IaC to manage AWS resources. They currently store Terraform state in a shared S3 bucket with versioning enabled, but developers often run `terraform plan` locally and sometimes apply changes directly. The security team wants to ensure that all infrastructure changes are reviewed and that the state file is protected. Which combination of practices should the team implement?

   • AStore state in a public S3 bucket to simplify access; use IAM roles for all developers.
   • BEnable S3 bucket encryption and require MFA for state deletion; restrict `terraform apply` to a CI/CD pipeline with a policy-as-code check.
   • CDisable versioning on the state bucket to reduce storage costs; rely on manual backups.
   • DUse a local state file and rely on Git history for change tracking; allow developers to apply changes after peer review.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of 'policy as code' in the context of Infrastructure as Code security?

   • ATo replace the need for security audits
   • BTo encrypt all data in transit
   • CTo define and enforce compliance and security rules programmatically
   • DTo automatically fix all security vulnerabilities in the infrastructure
   Reveal Solution Discussion Select an answer first