Integrating Configuration Orchestration DSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security team wants to ensure that configuration orchestration tools (e.g., Terraform, Ansible) do not expose secrets in logs or CI/CD output. They also want to rotate secrets regularly. What is the best practice?

   • AIntegrate a secrets management tool (e.g., HashiCorp Vault) with the orchestration tools and configure audit logging for secret access.
   • BStore secrets in environment variables in the CI/CD system and rotate them manually.
   • CUse a shared secret for all environments to simplify management.
   • DEncrypt secrets with a static key and store them in the repository.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security team wants to enforce that all configuration changes made by their orchestration tool (Chef) are logged and auditable. They also want to ensure that only authorized personnel can trigger changes. What is the best way to achieve this?

   • AEnable Chef's verbose logging on each node and store logs locally.
   • BRely on the cloud provider's activity logs to track all Chef changes.
   • CIntegrate Chef with a centralized logging system and use Chef's RBAC to control who can run chef-client or push changes.
   • DUse a shared admin account for all Chef operations to simplify access.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is configuration drift?

   • AThe movement of configuration data between different environments
   • BThe process of updating configuration files to new versions
   • CThe deletion of configuration files from a system
   • DThe gradual divergence of a system's actual configuration from its desired state
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company uses Terraform to manage cloud infrastructure and has a policy that any unauthorized change to a security group rule must be automatically reverted. They want to integrate this with their existing Prometheus monitoring stack. Which design best implements an automated feedback loop?

   • AUse AWS Config to detect changes and send an SNS notification to a Slack channel for visibility.
   • BTerraform runs on a schedule every hour and automatically applies any changes to the state.
   • CPrometheus scrapes a custom exporter that compares the live security group rules to the Terraform state; on mismatch, it fires an alert that triggers a webhook to run 'terraform apply'.
   • DPrometheus alerts the security team, who then run 'terraform plan' and manually approve the apply.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup is building a DevSecOps pipeline and wants to ensure that configuration changes to their Kubernetes cluster are automatically validated and rolled back if they cause application errors. Which tool or approach best fits this requirement?

   • AUse a monitoring tool to detect errors and then have an operator manually revert the last commit.
   • BUse a configuration management tool like Ansible to apply changes directly to the cluster nodes.
   • CUse GitOps with a tool like Argo CD, which continuously syncs the cluster to the desired state in Git and can automatically roll back if a sync fails health checks.
   • DUse a CI/CD pipeline that deploys configuration changes and relies on manual approval before applying them.
   Reveal Solution Discussion Select an answer first