Compliance as Code ECDE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company uses Azure Policy to enforce that all managed disks are encrypted. They have enabled the 'Deny' effect for new resources, but they have many existing unencrypted disks. They want to automatically remediate these existing disks without manual intervention, but they are concerned about the potential impact on running VMs. They also need to document the remediation for auditors. What is the best approach?

   • ACreate a policy with 'DeployIfNotExists' effect that enables encryption on existing disks, and run a remediation task during a maintenance window.
   • BUse the 'Deny' effect only and require manual encryption of existing disks.
   • CUse Azure Security Center to recommend encryption and let the team manually approve each disk.
   • DUse a PowerShell script that encrypts all disks immediately, without scheduling.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How do compliance checks act as gates in a CI/CD pipeline?

   • AThey send a notification to the security team for manual approval
   • BThey block artifacts from progressing to the next stage if they do not meet the defined policies
   • CThey log the compliance status but allow the artifact to proceed regardless
   • DThey automatically fix any non-compliant artifacts before deployment
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company must provide auditors with evidence that all code deployments to production were approved by at least two people and passed all automated compliance checks. The CI/CD platform supports manual approval gates and stores pipeline logs. However, the auditors require a tamper-evident, exportable report. What is the best way to produce this evidence?

   • APrint the pipeline logs and store them in a binder.
   • BProvide the auditors with direct read-only access to the CI/CD platform.
   • CTake screenshots of the pipeline approval screens and save them as PDFs.
   • DExport pipeline logs and approval records from the CI/CD platform's API and generate a signed report using a separate reporting system.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is version control important for compliance policies?

   • AIt provides a history of policy changes, enabling traceability and rollback if needed
   • BIt encrypts the policies to prevent unauthorized access
   • CIt compiles policies into executable code
   • DIt automatically enforces the policies in all environments
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary goal of automated compliance remediation workflows?

   • ATo generate a report of all non-compliant resources for manual review
   • BTo prevent any changes to the infrastructure after deployment
   • CTo provide a dashboard showing compliance status
   • DTo correct non-compliant resources or configurations automatically without manual intervention
   Reveal Solution Discussion Select an answer first