Compliance as Code ECDE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of continuous compliance monitoring in a deployed environment?

   • ATo replace the need for periodic security audits entirely
   • BTo provide a real-time dashboard of application performance metrics
   • CTo automatically deploy new features to production without human intervention
   • DTo detect configuration drift from the desired compliant state and trigger alerts or automated remediation
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team manages compliance policies for multiple applications in a monorepo. They need to ensure that a change to a policy does not break other applications' pipelines. They also need to know which version of a policy was used for a specific build. What should they implement?

   • AVersion policies in the same repository, tag each policy release, and record the policy version in the CI pipeline metadata for each build.
   • BStore policies in a database and update them directly without versioning.
   • CUse a shared network drive for policies and rely on file timestamps for versioning.
   • DCopy the latest policy files into every application's pipeline at the start of each build.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which practice is essential for managing compliance policies as code?

   • AEmailing policy files to the security team for manual updates
   • BStoring policy files in a version control repository with a review process for changes
   • CKeeping policy files on a shared network drive with no change history
   • DStoring policies only in the memory of the compliance team
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is adopting HashiCorp Sentinel to enforce that all Terraform plans for AWS resources include appropriate tags. The DevSecOps team wants to run this check automatically whenever a developer opens a pull request that changes Terraform code. Which approach should they use?

   • AAsk developers to run 'sentinel apply' locally before pushing their code.
   • BConfigure Sentinel to automatically modify the Terraform plan to add missing tags.
   • CRun the Sentinel policy check only in the production deployment pipeline after the change is merged.
   • DAdd a pipeline job that runs 'terraform plan' and then evaluates the plan against the Sentinel policy, failing the PR if the policy is violated.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An organization uses Azure Policy to enforce that all VMs have the 'Managed Disks' property enabled. They have enabled automatic remediation for the policy. However, they notice that some VMs are repeatedly marked non-compliant even after remediation runs. The remediation task appears to succeed, but the VM becomes non-compliant again within a few hours. What is the most likely cause and what should the team do?

   • AA downstream process or configuration management tool is reverting the setting; the team should investigate and update the source of the drift.
   • BThe policy definition is incorrect; the team should rewrite the policy to use a different effect.
   • CThe VM is not in the scope of the policy assignment; the team should expand the assignment to include the VM's resource group.
   • DThe remediation task is not assigned the correct permissions; the team should grant the policy assignment a managed identity with Contributor rights.
   Reveal Solution Discussion Select an answer first