Integrating Compliance as Code (CaC) DSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization uses Terraform to provision Azure resources and has codified HIPAA-related security policies using Open Policy Agent (OPA). During a routine audit, they discover that a storage account in production has public network access enabled, even though the OPA policy prohibits it. The Terraform state file shows the resource was created with network access disabled. What is the most likely cause of this compliance drift?

   • AThe Terraform provider version is outdated and does not support the network access control property, so the setting was silently ignored during provisioning.
   • BThe OPA policy was not applied during the initial Terraform plan, so the resource was created without the required network restrictions.
   • CThe OPA policy was written incorrectly and allowed public network access, so the Terraform configuration was never actually enforced.
   • DA user manually changed the network access setting in the Azure portal after the resource was provisioned, and the change was not reflected in the Terraform state.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   During a security incident, a DevOps engineer needs to apply a hotfix to a production application. The hotfix involves a configuration change that is not yet covered by the organization's policy-as-code repository. The change is critical to stop the incident, but the organization has a strict policy that all changes must be compliant before deployment. What is the best course of action?

   • AApply the hotfix immediately and document it in the incident ticket, then update the policy-as-code repository after the incident is resolved.
   • BWait for the policy-as-code repository to be updated to cover the hotfix, then apply the hotfix through the normal CI/CD pipeline.
   • CApply the hotfix and then run a compliance scan to verify it does not violate any existing policies.
   • DApply the hotfix using a pre-approved 'emergency change' process that includes a temporary exception to the policy, with a plan to codify the change within a defined time frame.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a key benefit of integrating automated compliance validation into a CI/CD pipeline?

   • AIt guarantees that all security vulnerabilities are completely eliminated
   • BIt provides continuous feedback on compliance status throughout the development lifecycle
   • CIt allows compliance checks to be performed only at the end of the release cycle
   • DIt eliminates the need for external audits
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to move from manual compliance audits to an automated approach. They want to define compliance requirements as code and run checks in their CI/CD pipeline. What is the first step they should take?

   • AWrite compliance requirements as code using a policy language like Rego or a framework like InSpec.
   • BTrain the security team on compliance as code concepts.
   • CPurchase a commercial compliance scanning tool and integrate it into the pipeline.
   • DSet up a compliance dashboard to visualize check results.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise has a mix of legacy on-premises servers and cloud resources. They want to implement Compliance as Code across both environments. Which tool is best suited for this?

   • AUse Terraform with OPA to enforce policies on cloud resources only.
   • BUse Chef InSpec, which can run on both on-premises and cloud resources, and integrate with a central reporting tool.
   • CUse AWS Config for cloud resources and a separate tool for on-premises servers.
   • DUse a cloud-agnostic tool like Ansible to enforce policies on all servers.
   Reveal Solution Discussion Select an answer first