Integrating Configuration Orchestration DSE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a DevSecOps pipeline, what is the primary purpose of configuration orchestration?

   • ATo monitor application performance and generate alerts for anomalies
   • BTo scan source code for security vulnerabilities before deployment
   • CTo automate the deployment of application code to production environments
   • DTo manage and apply desired configuration states across systems consistently
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A DevSecOps team is implementing configuration orchestration with Ansible. They need to ensure that any drift in the configuration of their web servers is automatically corrected, but they also need to avoid overwhelming the servers with constant playbook runs. Which strategy best balances these concerns?

   • ADisable drift detection and rely on manual audits to identify and correct configuration changes.
   • BUse a monitoring tool to detect drift and trigger a playbook run via webhook, but only during off-peak hours.
   • CRun the playbook continuously in a loop with no delay, ensuring immediate correction of any drift.
   • DUse Ansible's pull mode with a cron job that runs every 15 minutes, and have the playbook only apply changes when drift is detected using 'check mode' first.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A team uses Terraform to manage infrastructure and wants to implement a policy that prevents any resource from being created without proper tagging (e.g., cost center, owner). They also want to automatically remediate any untagged resources that are created outside of Terraform. What is the best approach?

   • AUse a cloud-native tagging policy that automatically tags all resources, but do not use Terraform.
   • BUse a policy-as-code tool to block untagged resources in Terraform, and use a scheduled Terraform run to add tags to any untagged resources found in the cloud.
   • CUse only a policy-as-code tool to block untagged resources in Terraform.
   • DUse a scheduled Terraform run to add tags to all resources, but do not enforce the policy in Terraform.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A DevOps team is using Terraform to manage infrastructure and wants to implement a feedback loop that automatically reverts any unauthorized change to a security group. They have a monitoring system that can trigger webhooks. However, they are concerned about the possibility of the monitoring system triggering a revert while a legitimate change is being applied by the CI/CD pipeline. How should they design the feedback loop to avoid this conflict?

   • AUse a manual approval process for all Terraform applies, including drift remediation.
   • BUse a distributed lock or a state file lock in Terraform so that only one apply can run at a time, and have the monitoring system trigger a webhook that checks the lock before running 'terraform apply'.
   • CHave the monitoring system trigger a revert immediately without checking for ongoing applies.
   • DDisable the monitoring system during CI/CD deployments.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses Ansible to manage configuration and wants to ensure that if a server's configuration drifts, it is automatically corrected, but only if the change is not intentional (e.g., a maintenance window). What is the best way to handle this?

   • AAutomatically apply the desired state on every Ansible run without any approval.
   • BDisable Ansible runs during maintenance windows and rely on manual checks.
   • CUse Ansible's 'check mode' to detect drift, then have a human approve the remediation before applying it.
   • DUse a separate Ansible playbook for maintenance changes and run it manually.
   Reveal Solution Discussion Select an answer first