Compliance as Code ECDE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following is an example of an automated remediation action?

   • AA weekly report listing all unencrypted storage accounts
   • BA script that automatically enables encryption on an unencrypted storage account
   • CAn alert email sent to the security team about an unencrypted storage account
   • DA ticket created in the IT service management system for a technician to fix
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses on-premises servers and wants to implement continuous compliance monitoring for CIS benchmarks. They need to detect drift, alert the security team, and produce a monthly report of compliance status. Which approach is most suitable?

   • AUse a cloud-based compliance service that scans the servers over the internet.
   • BUse a network vulnerability scanner to check for open ports and outdated software.
   • CDeploy an agent-based compliance scanner on each server that runs scheduled scans, sends results to a central SIEM, and generates reports.
   • DRun a manual checklist review quarterly and document the results in a spreadsheet.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A team manages compliance policies in a Git repository. They use a CI job to validate policies against a set of sample resources before merging. Recently, a policy change was merged that caused a critical application's pipeline to fail because the policy was too strict. The team needs to roll back the policy change quickly, but they also want to prevent this from happening again. What is the best approach?

   • AUse the CI pipeline's history to find the previous policy version and copy it back into the repository.
   • BManually edit the policy file in the repository to loosen the rule and commit directly to the main branch.
   • CDisable the policy in the CI pipeline and keep the change in the repository.
   • DRevert the policy change in Git, redeploy the previous policy version, and add a regression test with the critical application's configuration to the policy validation suite.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of generating compliance reports and audit trails from automated checks?

   • ATo automatically fix all non-compliant resources
   • BTo provide a real-time view of application performance
   • CTo replace the need for any security controls
   • DTo provide evidence of adherence to regulatory requirements for auditors and stakeholders
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company deploys a microservices application using Kubernetes. The compliance team requires that all container images be scanned for critical vulnerabilities and that images with critical findings never reach production. The DevSecOps team wants to implement this as an automated check in the CI pipeline. Which approach should they use?

   • AUse Kubernetes admission controllers to reject pods with critical vulnerabilities at deploy time.
   • BManually review the vulnerability report before each release.
   • CAdd a CI stage that runs a container image scanner and fails the pipeline if any critical vulnerability is found.
   • DRun the image scanner only in the production cluster as a cron job.
   Reveal Solution Discussion Select an answer first