Integrating Compliance as Code (CaC) DSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How does Compliance as Code help in detecting compliance drift?

   • ABy preventing any changes to the system after initial deployment
   • BBy storing compliance policies in a separate database that is not accessible to the CI/CD pipeline
   • CBy requiring manual audits to be performed on a quarterly basis
   • DBy periodically comparing the actual system state against the codified policies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A multi-national e-commerce company runs a hybrid infrastructure with Kubernetes clusters on-premises and in AWS. They need to enforce a consistent set of security policies (e.g., no privileged containers, required resource limits, mandatory labels) across both environments, and they want these policies to be evaluated automatically whenever a workload is deployed. Which tool combination should they choose?

   • AConfigure Kubernetes Pod Security Policies in each cluster and manually ensure the policies are identical.
   • BUse OPA with Gatekeeper as an admission controller in both the on-premises and AWS Kubernetes clusters.
   • CImplement a custom script that runs kubectl commands against both clusters after deployment and reports any policy violations.
   • DUse AWS Config rules for the AWS clusters and a separate on-premises configuration management tool for the local clusters.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A financial services firm must prove to auditors that every production deployment of their containerized trading application adheres to CIS Docker Benchmarks before it reaches the runtime environment. The team currently builds images in Jenkins and pushes them to a private registry. Which approach should the platform team implement to enforce this requirement as part of the delivery pipeline?

   • ADeploy the image to a staging environment, run a vulnerability scan there, and only promote to production if the scan report is clean.
   • BRun a container image scanner as a Jenkins post-build step and manually review the findings before promoting the image to production.
   • CConfigure a policy-as-code gate in the CI pipeline that evaluates the image against CIS Docker Benchmark rules and fails the build if any high-severity check does not pass.
   • DUse a runtime security agent on the production cluster to detect and alert on containers that violate CIS Docker Benchmarks.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization needs to provide auditors with a monthly report showing the compliance status of all their AWS resources. They want to automate this process. Which approach is most effective?

   • AUse a third-party tool like CloudCheckr to generate reports, but it requires manual configuration.
   • BUse CloudTrail logs to infer compliance status and generate a report.
   • CUse AWS Config to record resource configurations and manually export the compliance report each month.
   • DUse AWS Config with a scheduled Lambda function that generates a compliance report and sends it to a central S3 bucket.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company uses Terraform to manage its AWS infrastructure and has implemented a compliance check using OPA that runs during the CI/CD pipeline. A developer manually modifies a security group rule in the AWS console to allow SSH access from a specific IP for troubleshooting. The next time the CI/CD pipeline runs, Terraform plan shows that it will revert this change. The developer is concerned about losing the manual change. What is the best way to handle this situation while maintaining compliance?

   • AAdd a 'lifecycle' block with 'ignore_changes' to the security group resource in Terraform to prevent it from reverting the manual change.
   • BInstruct the developer to make the change directly in the Terraform configuration and submit it for review through the normal CI/CD process.
   • CAsk the developer to revert the manual change and use a bastion host for troubleshooting instead.
   • DUse the AWS CLI to import the current security group state into Terraform so that the manual change is reflected in the state file.
   Reveal Solution Discussion Select an answer first