Why is it important to integrate Compliance as Code into incident response processes?

To ensure that remediation actions do not introduce new compliance violations

To ensure that all incidents are automatically resolved without human intervention

To speed up incident response by skipping compliance checks during emergencies

To replace the incident response team with automated systems

Which tool is commonly used to enforce compliance policies on Kubernetes clusters?

Open Policy Agent (OPA) with Gatekeeper

How can Compliance as Code assist during the remediation phase of an incident?

By deleting all logs related to the incident

By automatically verifying that the remediation steps comply with codified policies

By isolating the affected systems from the network

By providing a manual checklist for responders to follow

A startup is building a new microservices application on Azure and wants to ensure that all infrastructure deployments comply with the company's security baseline (e.g., TLS version, managed disks, no public IPs on VMs). They want to enforce this as part of their CI/CD pipeline using Azure DevOps. Which approach best aligns with the principles of Compliance as Code?

Write a custom PowerShell script that checks the Azure resources after deployment and sends an email if any are non-compliant.

Use Azure Policy to define and assign the security policies, and integrate the policy evaluation into the Azure DevOps pipeline using the 'Azure Policy Compliance Scan' task.

Use Azure Security Center's regulatory compliance dashboard to monitor the subscription and manually review any recommendations.

Create an Azure Policy initiative with the required security policies and assign it to the subscription, then use Azure DevOps to run a compliance scan after deployment.

What is the main advantage of using policy-as-code tools to codify compliance requirements?

Policies are stored in a central database that only security teams can access

Policies can be written in natural language for easy reading by auditors

Policies can be versioned, reviewed, and automatically enforced across environments

Policies are compiled into binary executables that run on any operating system

EC-CouncilDevSecOps Essentials

Domain 6Objective 3

Integrating Compliance as Code (CaC) DSE Practice Questions (Page 3)

Part of the DevSecOps Monitoring and Feedback domain, which makes up ~15% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 2–2 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

7concepts

Questions 11–15

11foundation · easy
Why is it important to integrate Compliance as Code into incident response processes?
Select an answer first
12foundation · easy
Which tool is commonly used to enforce compliance policies on Kubernetes clusters?
Select an answer first
13foundation · easy
How can Compliance as Code assist during the remediation phase of an incident?
Select an answer first
14application · medium
A startup is building a new microservices application on Azure and wants to ensure that all infrastructure deployments comply with the company's security baseline (e.g., TLS version, managed disks, no public IPs on VMs). They want to enforce this as part of their CI/CD pipeline using Azure DevOps. Which approach best aligns with the principles of Compliance as Code?
Select an answer first
15foundation · easy
What is the main advantage of using policy-as-code tools to codify compliance requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DSE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DSE” is a trademark of its owner, used for identification only.