Compliance as Code ECDE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization must demonstrate to auditors that its CI/CD pipeline enforces a policy requiring all container images to be signed. The team uses a policy-as-code tool to check image signatures during the build stage. What should they produce to provide the required evidence?

   • AA summary of the number of images signed in the last month.
   • BA screenshot of the pipeline dashboard showing the build succeeded.
   • CA report that includes the pipeline run ID, the image digest, the signature verification result, and the policy version used.
   • DA copy of the policy file stored in the repository.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A financial services company must demonstrate to auditors that their CI/CD pipeline enforces segregation of duties and that no code can be deployed without passing security and compliance checks. They need to generate a report that shows the pipeline history, who approved each stage, and the results of automated compliance checks. What is the most effective way to produce this audit evidence?

   • AEnable audit logging on the CI/CD platform and use its API to export pipeline runs, approval records, and check results into a reporting tool.
   • BHave the release manager manually compile a spreadsheet of approvals and test results after each release.
   • CUse a screen recording tool to capture the pipeline execution and store the videos.
   • DStore all pipeline logs in a shared folder and provide the folder path to auditors.
   Reveal Solution Discussion Select an answer first
4. 8application · medium · select all that apply

   A company wants to implement continuous compliance monitoring for their AWS environment. They need to detect changes to security group rules, alert on non-compliant changes, and maintain a history of changes for auditing. Which AWS services or features should they use? Select all that apply.

   • AAmazon CloudWatch Events (or EventBridge) with a rule that triggers on security group changes and sends an SNS notification.
   • BAWS Trusted Advisor
   • CAWS Config
   • DAWS CloudTrail
   Check answers Discussion Select an answer first
5. 9application · medium

   A DevSecOps team maintains a set of compliance policies as code in a Git repository. They want to ensure that any change to a policy is reviewed by the security team and that the exact policy version used in a deployment can be traced. Which practice should they adopt?

   • AUse a database to store the latest policy version and overwrite it whenever a change is approved.
   • BRequire pull requests with at least one approval from the security team, and tag each policy release with a semantic version.
   • CStore the policy files in a shared network drive and update them manually when changes are needed.
   • DAllow any developer to push directly to the main branch and rely on the CI pipeline to validate the policy syntax.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key characteristic of an effective audit trail for compliance?

   • AIt is stored only in the memory of the compliance officer
   • BIt contains only the final compliance status, not intermediate steps
   • CIt is automatically deleted after each deployment
   • DIt records who performed what action, when, and the outcome of the compliance check
   Reveal Solution Discussion Select an answer first