Implementing Infrastructure as Code (IaC) DSE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the context of DevSecOps, what is the primary purpose of Infrastructure as Code (IaC)?

   • ATo store infrastructure credentials in a central repository
   • BTo define and manage infrastructure through machine-readable definition files instead of manual processes
   • CTo provide a graphical interface for managing cloud resources
   • DTo replace all manual security testing with automated vulnerability scanning
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team wants to implement policy as code for their Terraform configurations. They have a requirement that all resources must have a `cost_center` tag. They also want to enforce this policy in both the CI/CD pipeline and at runtime. Which approach is most effective?

   • AUse Terraform's `validate` command to check for the tag.
   • BUse AWS Config to only detect missing tags after deployment.
   • CUse a custom shell script in the CI pipeline that greps the Terraform files for `cost_center`.
   • DUse OPA (Open Policy Agent) with Terraform's `terraform plan` JSON output to enforce the policy in CI, and use AWS Config rules to check tags on deployed resources.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does Infrastructure as Code (IaC) contribute to the security of infrastructure provisioning in a DevSecOps environment?

   • ABy providing a graphical dashboard for security alerts
   • BBy eliminating the need for security monitoring after deployment
   • CBy automatically encrypting all data stored in the infrastructure
   • DBy enabling security policies to be embedded in the provisioning process and reviewed through code reviews
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How does integrating IaC into CI/CD pipelines improve auditability?

   • ABy providing a complete history of infrastructure changes through version control and pipeline logs
   • BBy storing all infrastructure credentials in the pipeline configuration
   • CBy eliminating the need for manual code reviews
   • DBy automatically generating compliance reports for all cloud providers
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security team is integrating IaC into their CI/CD pipeline. They want to scan Terraform templates for security vulnerabilities before deployment. They also need to ensure that secrets are not exposed in the code. Which combination of tools should they use?

   • AUse Checkov for static analysis and integrate with a secrets scanner like git-secrets
   • BUse a single tool like Terraform plan with -out flag
   • CUse Terraform validate and a manual code review
   • DUse AWS Config rules and CloudTrail
   Reveal Solution Discussion Select an answer first