Integrating Compliance as Code (CaC) DSE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A software company is migrating its infrastructure to Google Cloud and must enforce a policy that prohibits the use of certain machine types (e.g., those with GPUs) in production projects. They want to enforce this policy automatically when a resource is created, not just after the fact. Which approach should they use?

   • AConfigure a Cloud Audit Logs sink to alert the security team when a prohibited machine type is used.
   • BUse Google Cloud's Organization Policy Service to define a custom constraint that denies the prohibited machine types.
   • CUse Cloud Asset Inventory to generate a report of all VM instances and manually review them for prohibited machine types.
   • DCreate a Cloud Function that runs every hour and terminates any VM instance using a prohibited machine type.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company needs to provide auditors with evidence that their AWS environment was compliant with the PCI DSS standard for the past six months. They have AWS Config with the PCI DSS conformance pack enabled. What is the most efficient way to generate the required audit evidence?

   • AUse AWS CloudTrail to generate a report of all API calls related to AWS Config over the past six months.
   • BTake a screenshot of the AWS Config console showing the current compliance status of all rules.
   • CUse AWS Config's 'Advanced Queries' feature to query the compliance history of all resources.
   • DExport the AWS Config configuration history and compliance snapshots to an S3 bucket and retain them for the required period.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which statement best describes the role of Compliance as Code in a DevSecOps pipeline?

   • AIt eliminates the need for any human oversight of security controls
   • BIt automates compliance checks so they can run consistently and frequently throughout the delivery process
   • CIt only applies to cloud environments and cannot be used on-premises
   • DIt replaces the need for infrastructure as code by embedding security directly into applications
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is using a combination of Terraform and OPA to enforce compliance policies on their AWS infrastructure. They have a policy that requires all S3 buckets to have server-side encryption enabled. They want to ensure that this policy is enforced even if a developer creates an S3 bucket outside of Terraform (e.g., via the AWS console or CLI). Which approach should they use?

   • AUse AWS Organizations Service Control Policies (SCPs) to deny the creation of S3 buckets without encryption.
   • BUse an OPA policy in the CI/CD pipeline to check the Terraform plan for S3 buckets without encryption.
   • CUse a combination of AWS Config for detection and remediation, and OPA in the CI/CD pipeline for preventive control on Terraform-managed resources.
   • DUse AWS Config with a managed rule to detect S3 buckets without encryption and automatically remediate them using a Systems Manager Automation document.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a security incident, a DevOps engineer needs to isolate a compromised EC2 instance by applying a security group that blocks all inbound traffic. The organization has a policy-as-code repository that defines approved security group configurations. What is the best way to ensure the remediation action remains compliant with the organization's codified policies?

   • ADetach the instance's network interface and then run a compliance scan to verify the instance is isolated.
   • BManually create a new security group in the AWS console, apply it to the instance, and document the change in the incident ticket.
   • CApply the default VPC security group to the instance, which blocks all inbound traffic by default.
   • DUse a pre-approved 'incident-isolation' security group that is already defined in the policy-as-code repository and apply it to the instance.
   Reveal Solution Discussion Select an answer first