Compliance as Code ECDE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium · select all that apply

   A company uses Azure Policy to enforce that all storage accounts have secure transfer required (HTTPS). They want to automatically remediate existing storage accounts that are non-compliant. Which of the following are necessary to enable automated remediation with Azure Policy? Select all that apply.

   • AA remediation task created for the policy assignment.
   • BA managed identity assigned to the policy assignment with permissions to modify storage accounts.
   • CAn Azure Monitor alert that triggers on non-compliant resources.
   • DA policy definition with the 'DeployIfNotExists' effect.
   Check answers Discussion Select an answer first
2. 2application · medium

   A DevSecOps team is building a CI/CD pipeline for a Java application. They need to ensure that the application's dependencies do not contain known vulnerabilities before the artifact is deployed. Which check should they add to the pipeline?

   • ARun an SCA (Software Composition Analysis) tool as a pipeline stage that fails the build if any dependency has a vulnerability above a defined severity threshold.
   • BRun a DAST (Dynamic Application Security Testing) tool against the deployed application.
   • CRun a SAST (Static Application Security Testing) tool that scans the source code for security flaws.
   • DManually review the dependency list before each release.
   Reveal Solution Discussion Select an answer first
4. 3application · medium · select all that apply

   A DevSecOps team is implementing automated compliance validation for a serverless application on AWS. They want to check that Lambda functions have reserved concurrency limits, that IAM roles do not have overly permissive policies, and that the deployment package does not contain secrets. Which of the following approaches are appropriate for these checks? Select all that apply.

   • AUse AWS Config rules to evaluate Lambda functions after deployment.
   • BUse Checkov to scan the Infrastructure as Code for security misconfigurations, including IAM policies.
   • CUse cfn-lint to validate the CloudFormation template for resource properties.
   • DUse a secret scanning tool like git-secrets or TruffleHog in the CI pipeline to detect secrets in the deployment package.
   Check answers Discussion Select an answer first
5. 4foundation · easy

   Which statement best describes how compliance as code integrates policy definitions, validation, and remediation into CI/CD pipelines?

   • APolicies are written in natural language, validation is performed by a compliance officer, and remediation is scheduled monthly
   • BPolicies are documented in a wiki, validation is performed manually by auditors, and remediation is done through change requests
   • CPolicies are defined in a spreadsheet, validation is done by a third-party tool, and remediation is handled by the cloud provider
   • DPolicies are defined as code, validation runs as pipeline stages, and remediation is triggered automatically when violations are detected
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevSecOps team wants to validate that Kubernetes manifests comply with internal security policies (e.g., no privileged containers, resource limits required) before they are applied to the cluster. They want to integrate this validation into their CI pipeline. Which tool and approach is most appropriate?

   • AUse kubeconform or kubeval to validate manifests against the Kubernetes schema, and then use OPA to enforce custom policies.
   • BUse only kubectl apply --dry-run=client to check if the manifest is valid.
   • CUse a Kubernetes admission controller to reject non-compliant manifests at deploy time.
   • DUse a Helm lint command to check for syntax errors.
   Reveal Solution Discussion Select an answer first