Compliance as Code ECDE Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company uses Terraform to deploy infrastructure to AWS and Azure. They want to enforce a policy that all resources have a 'cost-center' tag. The policy must be evaluated before any resource is created, and the team wants to use a single policy-as-code tool that works across both clouds. Which approach should they use?

   • AUse AWS Config to check for the tag on AWS resources and Azure Policy to check on Azure resources.
   • BUse HashiCorp Sentinel, which is integrated with Terraform Cloud, to evaluate the plan.
   • CUse Open Policy Agent (OPA) to evaluate the Terraform plan for both AWS and Azure, since OPA is cloud-agnostic.
   • DUse a custom script that parses the Terraform configuration files and checks for the tag.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevSecOps engineer is configuring a CI/CD pipeline for a payment application that must meet PCI DSS. The compliance team wants to ensure that no container image containing a known critical vulnerability can be deployed to the production cluster. The engineer needs to add a check that runs after the image is built but before it is pushed to the registry. Which approach should the engineer take?

   • AAdd a post-deployment job that quarantines any running pod that uses an image with a critical vulnerability.
   • BSchedule a nightly scan of the production registry and send an alert if a critical vulnerability is discovered.
   • CAdd a pipeline stage that runs a vulnerability scanner against the image and fails the build if any critical CVE is found.
   • DConfigure the production cluster admission controller to reject pods that reference images with critical vulnerabilities.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A DevSecOps team is integrating compliance checks into their CI/CD pipeline. They have a policy that blocks deployment if any critical vulnerability is found. However, a critical vulnerability is discovered in a third-party library that has no fix yet. The team needs to proceed with the release to meet a regulatory deadline. They want to maintain an audit trail and ensure that the exception is temporary and reviewed. What is the best approach?

   • AImplement a vulnerability exception process where a security lead can approve a temporary waiver, and the pipeline records the waiver ID and expiry date in the build metadata.
   • BAllow the pipeline to proceed but log a warning in the console.
   • CManually deploy the artifact without running the pipeline.
   • DDisable the vulnerability check in the pipeline until the fix is available.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization must provide auditors with evidence that every infrastructure change was validated against internal security policies before being deployed. The team uses Terraform and a policy-as-code tool that runs during the CI/CD pipeline. What should the team implement to produce the required audit trail?

   • AExport the compliance report from the policy engine at the end of each month.
   • BRecord the Terraform plan output in a shared folder for each deployment.
   • CEnable verbose logging on the CI/CD server and retain logs for 90 days.
   • DStore the pipeline logs, policy check results, and the exact policy version used for each deployment in an immutable audit log.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A DevSecOps team is adopting compliance as code for a payment application. They want to enforce PCI DSS requirements (e.g., encryption in transit, no default credentials) as automated checks that run during CI. The team also needs to ensure that any change to a compliance policy is reviewed and can be rolled back if it produces false positives. Which approach best satisfies these requirements?

   • AWrite policies directly in the CI pipeline script and rely on the pipeline history for rollback.
   • BStore policies as code in a Git repository, require pull requests for changes, and run the policy checks as a CI job that fails the build on violations.
   • CStore policies in a shared network folder and have auditors manually update them before each release.
   • DUse a compliance scanner that runs only in production and emails the security team when a violation is found.
   Reveal Solution Discussion Select an answer first