Implementing Infrastructure as Code (IaC) DSE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A DevOps team uses Ansible to configure servers in a hybrid cloud environment. They want to integrate Ansible playbook execution into their Jenkins pipeline so that infrastructure changes are automatically applied after code deployment. Which approach best fits this requirement?

   • ARun `ansible-playbook` as a Jenkins build step, using credentials stored in Jenkins secrets.
   • BSchedule a cron job on the Jenkins server to run the playbook every hour.
   • CEmbed plaintext SSH keys in the playbook repository for simplicity.
   • DUse Ansible Tower's job template and trigger it manually after each deployment.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company uses Ansible for configuration management and wants to integrate it into their CI/CD pipeline. They have a requirement that playbooks must be executed only after they pass a security linting check. Which tool should they use for the linting check?

   • ABandit
   • BHadolint
   • CCheckov
   • Dansible-lint
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A team uses Terraform to manage infrastructure and wants to scan their Terraform templates for security misconfigurations before deployment. Which tool should they integrate into their CI pipeline?

   • ANessus
   • BAWS Config
   • CCheckov
   • DSplunk
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A large enterprise uses Terraform to manage infrastructure across multiple AWS accounts. They have a centralized Terraform state in an S3 bucket with DynamoDB locking. Recently, a developer accidentally deleted a production RDS instance by running `terraform destroy` on the wrong workspace. They want to prevent this from happening again without hindering the team's ability to make changes. Which combination of controls is most effective?

   • AUse `prevent_destroy` on all production resources.
   • BRemove all users' ability to run `terraform destroy` and require a break-glass account.
   • CUse separate Terraform workspaces for each environment and enforce a policy that requires MFA for destroy operations in production.
   • DEnable S3 bucket versioning and rely on state recovery.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which feedback mechanism is commonly used to detect security anomalies in IaC-managed infrastructure?

   • ADisabling all external access to the infrastructure
   • BStoring all infrastructure logs in a single file
   • CPeriodic manual reviews of the infrastructure code
   • DContinuous monitoring and alerting on infrastructure configuration changes
   Reveal Solution Discussion Select an answer first