Integrating Compliance as Code (CaC) DSE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company wants to codify their internal security policies as code so that they can be versioned, reviewed, and automatically enforced. They use a Git repository for infrastructure code. Which tool should they use to write and test policies?

   • AUse a shell script that checks configurations and runs in the pipeline.
   • BUse AWS CloudFormation templates with custom resources to enforce policies.
   • CUse a YAML file with a list of allowed configurations and validate it with a custom parser.
   • DUse Open Policy Agent (OPA) with Rego policies, stored in Git, and test them with OPA's test framework.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of Compliance as Code (CaC) in a DevSecOps pipeline?

   • ATo codify compliance requirements as machine-readable policies that can be automatically validated
   • BTo store compliance documents in a version control system for manual review
   • CTo replace all manual security testing with automated penetration testing
   • DTo generate human-readable compliance reports without any automation
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A large enterprise is adopting a multi-cloud strategy with workloads in AWS and Azure. They need to enforce a common set of security policies (e.g., encryption at rest, no public access to storage, specific resource tagging) across both clouds. The security team wants a single, unified policy definition that can be used for both cloud providers, and they want to avoid maintaining separate policy implementations. Which approach best meets this requirement?

   • AUse AWS Config rules for AWS resources and Azure Policy for Azure resources, and maintain a mapping document to ensure the policies are aligned.
   • BUse AWS Organizations Service Control Policies (SCPs) to enforce policies on AWS and Azure Management Groups to enforce policies on Azure.
   • CStandardize on a single cloud provider for all new workloads to simplify compliance management.
   • DUse a cross-platform policy-as-code tool like HashiCorp Sentinel or OPA that can evaluate policies against resources from both AWS and Azure.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is compliance drift in the context of Compliance as Code?

   • AThe intentional modification of compliance policies to meet new business needs
   • BThe deletion of compliance policies from the version control repository
   • CThe process of updating compliance policies to align with new regulations
   • DThe gradual deviation of actual system state from the codified compliance policies
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A government contractor must provide auditors with evidence that their AWS environment has continuously complied with FedRAMP controls over the past quarter. They currently use AWS Config with managed rules and have enabled the appropriate recording. What additional step is necessary to generate the required audit evidence?

   • AEnable AWS CloudTrail to log all API calls made to AWS Config.
   • BCreate an AWS Config aggregator to view compliance data across all accounts in the organization.
   • CExport AWS Config compliance snapshots and delivery history to an S3 bucket on a recurring schedule.
   • DSet up an Amazon EventBridge rule to trigger a Lambda function that sends a compliance report via email at the end of each month.
   Reveal Solution Discussion Select an answer first