Compliance as Code ECDE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary role of policy-as-code frameworks like Open Policy Agent (OPA) and HashiCorp Sentinel in a DevSecOps pipeline?

   • ATo manage user authentication and authorization for the CI/CD system
   • BTo compile application source code into deployable artifacts
   • CTo automate compliance checks by evaluating infrastructure and application configurations against defined policies
   • DTo monitor runtime performance of deployed applications
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   Which tool is specifically designed as a policy-as-code framework that uses a high-level declarative language to define policies for cloud-native environments?

   • ATerraform
   • BJenkins
   • COpen Policy Agent (OPA)
   • DAnsible
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A DevSecOps team wants to ensure that no container image is deployed to production unless it has passed a vulnerability scan and a license compliance check. They also want to be able to quickly disable a faulty compliance check without rewriting the pipeline. How should they implement this?

   • AUse a single script that runs both checks and always fails the pipeline if any check fails.
   • BEmbed the checks directly in the application build script and fail the build if either check fails.
   • CRun the checks only in a nightly job and manually approve the release if the checks pass.
   • DCreate separate pipeline stages for vulnerability and license checks, and configure them as required gates that can be toggled via environment variables.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A company uses Azure Policy to enforce that all storage accounts have the 'Secure transfer required' setting enabled. They want to automatically fix any storage account that becomes non-compliant. What should they configure?

   • AUse Azure CLI to manually enable the setting on each non-compliant storage account.
   • BCreate a policy assignment with a remediation task that enables the setting on non-compliant storage accounts.
   • CCreate an Azure Monitor alert that triggers when a storage account is non-compliant and sends a notification to the storage team.
   • DCreate a Logic App that runs weekly and reports non-compliant storage accounts.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A DevSecOps team has deployed a web application on Azure and uses Azure Policy to enforce that all managed disks use encryption at rest. The team wants to detect when a resource becomes non-compliant after deployment and automatically restore compliance without manual intervention. Which combination of actions should they implement?

   • AUse Azure Security Center's regulatory compliance dashboard to review non-compliant resources weekly.
   • BCreate an Azure Monitor alert that triggers when a resource is non-compliant and send an email to the operations team.
   • CEnable Azure Policy compliance monitoring and configure a remediation task that runs automatically on non-compliant resources.
   • DRun a one-time compliance scan after deployment and fix any non-compliant resources found.
   Reveal Solution Discussion Select an answer first