Integrating Compliance as Code (CaC) DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of automated compliance reporting in a DevSecOps environment?

   • ATo automatically remediate all compliance violations without human intervention
   • BTo replace the need for any security monitoring tools
   • CTo store compliance data in a format that is only readable by machines
   • DTo provide evidence of compliance to auditors and stakeholders
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial technology company must provide its compliance team with a self-service dashboard to view the compliance status of all AWS accounts in their organization. They use AWS Organizations and have enabled AWS Config in each account. What is the most efficient way to centralize compliance visibility?

   • ACreate an AWS Config aggregator in the management account and add all member accounts as data sources.
   • BUse AWS CloudTrail to log all configuration changes and create a custom dashboard in Amazon QuickSight.
   • CHave the compliance team log into each AWS account individually and use the AWS Config console to view compliance status.
   • DExport AWS Config data to an S3 bucket in each account and have the compliance team manually combine the data.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Why is an audit trail important in Compliance as Code?

   • AIt replaces the need for version control of policy files
   • BIt records who made changes to compliance policies and when
   • CIt stores all compliance reports in a single database
   • DIt automatically enforces compliance policies in the pipeline
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does automating compliance validation in a CI/CD pipeline improve the delivery process?

   • AIt ensures that only compliant code is deployed by blocking non-compliant builds
   • BIt speeds up the pipeline by skipping security checks during development
   • CIt removes the need for any manual code review by developers
   • DIt automatically fixes all compliance issues without human intervention
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses Ansible to manage its infrastructure and has a compliance policy that requires all servers to have a specific security patch installed. The policy is codified as an Ansible playbook that checks for the patch and installs it if missing. The playbook is run nightly. A recent audit found that some servers are missing the patch, even though the playbook ran successfully. What is the most likely cause of this compliance drift?

   • AThe servers are not reachable from the Ansible control node at the time the playbook runs, so the playbook skips them.
   • BThe playbook is using the wrong package name for the patch on some servers, so it installs a different package.
   • CThe playbook is not idempotent and is failing to install the patch on some servers due to a bug in the playbook.
   • DThe patch was installed after the playbook ran, but was later removed or overwritten by another process.
   Reveal Solution Discussion Select an answer first