Integrating Configuration Orchestration DSE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A DevSecOps team uses Ansible to provision and configure application servers. They need to automatically detect when a manual change is made to the /etc/nginx/nginx.conf file on a production server and then revert it to the desired state. Which approach best integrates configuration orchestration with monitoring to achieve this?

   • ADisable SSH access to production servers so that no manual changes can be made, eliminating the need for drift detection.
   • BUse a monitoring tool to alert the operations team, who then manually SSH into the server and restore the file from a backup.
   • CSchedule a nightly cron job on the server to re-run the Ansible playbook, which will overwrite any manual changes.
   • DConfigure a monitoring agent to hash the file, compare it to the Ansible-deployed hash, and trigger an Ansible playbook run via a webhook when a mismatch is detected.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is a key security best practice when integrating configuration orchestration?

   • AEmbedding secrets in the pipeline's environment variables
   • BUsing a dedicated secrets management solution to store and inject secrets
   • CSharing secrets across all environments for simplicity
   • DStoring secrets in the orchestration tool's configuration files
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A DevSecOps team is integrating Ansible with a CI/CD pipeline to configure application servers. They need to store API keys and database passwords securely and ensure they are not exposed in logs or playbook output. Which practice is the most secure and effective?

   • AUse environment variables in the CI/CD pipeline to pass secrets to Ansible, but do not encrypt them in the playbook.
   • BStore secrets in Ansible Vault and reference them in playbooks, ensuring the vault password is provided by the CI/CD system's secret store.
   • CGenerate secrets dynamically during the playbook run and store them in a local file on the target server.
   • DEmbed secrets directly in the playbook files and restrict repository access to authorized personnel only.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A team uses Puppet to manage configuration and wants to automatically open a ticket in their IT service management (ITSM) tool when a configuration change fails or drift is detected. What is the most effective way to achieve this?

   • AHave an operator manually review Puppet reports and create tickets.
   • BConfigure Puppet to send reports to a webhook that triggers the ITSM tool's API to create a ticket.
   • CStore Puppet reports in a database and have the ITSM tool query the database periodically.
   • DUse Puppet's built-in email notification to send alerts to a shared mailbox, and have someone create tickets from emails.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company uses Terraform to manage cloud infrastructure. They want to integrate a compliance check into their pipeline so that any infrastructure change that violates a security policy (e.g., a storage bucket set to public) is automatically blocked before deployment. Which approach is most effective?

   • AManually review every Terraform plan in a change advisory board meeting.
   • BRun a policy-as-code tool (e.g., Open Policy Agent) against the Terraform plan and fail the pipeline if violations are found.
   • CApply the Terraform configuration and then run a cloud security scanner to detect misconfigurations.
   • DUse Terraform's built-in 'validate' command to check for syntax errors only.
   Reveal Solution Discussion Select an answer first