Compliance as Code ECDE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An organization has deployed a web application on AWS. The security team wants to continuously monitor for compliance drift, such as security groups allowing SSH from 0.0.0.0/0 or S3 buckets becoming public. They also want to automatically remediate these issues and generate an audit trail of what was fixed. Which solution best meets these requirements?

   • AUse AWS Trusted Advisor to check for security issues and manually fix them.
   • BUse CloudTrail to monitor API calls and alert on any security group changes.
   • CRun a nightly script that checks for non-compliant resources and sends an email to the security team.
   • DUse AWS Config rules with auto-remediation via Systems Manager Automation documents, and enable AWS Config recording for audit history.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company must provide auditors with evidence that its CI/CD pipeline enforces a policy requiring all infrastructure changes to be reviewed and approved. The pipeline uses a policy-as-code tool that checks for an approval record in the change management system. The auditors want to see that the policy was actually enforced for each deployment. What is the best way to provide this evidence?

   • AShow the auditors the policy source code in the Git repository.
   • BStore the pipeline execution logs, including the policy evaluation result and the approval record reference, in an immutable audit log.
   • CExport the change management system's approval records for the audit period.
   • DProvide a signed statement from the DevSecOps team confirming that the policy is enforced.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary benefit of integrating compliance checks as gates in the CI/CD pipeline?

   • AIt prevents non-compliant artifacts from being deployed to production
   • BIt eliminates the need for any security testing
   • CIt speeds up the pipeline by skipping manual reviews
   • DIt automatically rolls back any non-compliant deployment
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company uses Azure Policy to enforce tagging on all resources. They notice that some resources are created without required tags, and they want to automatically add the missing tags without manual intervention. They also need a record of when the remediation occurred for auditing. What should they configure?

   • AEnable the 'DeployIfNotExists' effect on the policy and assign a managed identity with permission to modify tags.
   • BCreate a custom Azure Monitor alert that triggers a Logic App to add tags.
   • CUse Azure Automation runbook that runs every hour to find untagged resources and add tags.
   • DConfigure the policy with 'Deny' effect to prevent creation of untagged resources.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is an example of an automated compliance check that can be run during the deploy stage?

   • AReviewing the application's user interface for usability issues
   • BVerifying that a newly provisioned virtual machine has the required encryption settings
   • CChecking the project's Git commit history for proper commit messages
   • DEstimating the cost of the deployed resources
   Reveal Solution Discussion Select an answer first