Compliance as Code ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   An organization uses AWS Config to monitor compliance with a rule that requires S3 buckets to have versioning enabled. They have enabled automatic remediation that enables versioning on non-compliant buckets. However, they notice that the remediation action is not working for buckets that are in a different AWS account. What is the most likely reason?

   • AThe remediation action does not have cross-account permissions to modify buckets in the other account.
   • BThe S3 buckets in the other account are not versioned and cannot be versioned.
   • CThe AWS Config rule is not enabled in the other account.
   • DThe S3 buckets in the other account are not in the same region as the AWS Config rule.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A DevSecOps team manages compliance policies in a Git repository. They use a policy-as-code tool that fetches policies from the repository at the start of each pipeline run. Recently, a developer accidentally pushed a breaking change to the policy that caused all pipeline runs to fail. The team needs to restore service quickly, but they also want to prevent this from happening again. What should they do?

   • AKeep the breaking change and fix the pipeline to work with the new policy.
   • BRevert the commit, then add a branch protection rule that requires pull request reviews and a CI check that validates the policy syntax before merging.
   • CRevert the commit and ask the developer to be more careful in the future.
   • DDisable the policy-as-code tool in the pipeline until the policy is fixed.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes a typical approach to continuous compliance monitoring?

   • ARunning a penetration test once a year
   • BPerforming a one-time configuration audit before go-live
   • CScheduling periodic scans of cloud resources using tools like AWS Config or Azure Policy
   • DConducting a manual review of security logs every quarter
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary purpose of implementing compliance as code in a DevSecOps environment?

   • ATo replace manual security reviews with automated, version-controlled policy checks that run in CI/CD pipelines
   • BTo ensure that all infrastructure is deployed using a single, centralized configuration management tool
   • CTo provide a graphical dashboard for security teams to manually approve each deployment
   • DTo eliminate the need for any human oversight in the software delivery process
   Reveal Solution Discussion Select an answer first
6. 40application · medium · select all that apply

   A DevSecOps team wants to integrate compliance checks into their CI/CD pipeline as gates. They want to ensure that only artifacts that pass all checks are deployed. Which of the following practices are appropriate? Select all that apply.

   • AStore the results of compliance checks as pipeline artifacts for later auditing.
   • BRun compliance checks only on a nightly schedule and manually approve deployments.
   • CUse a 'quality gate' feature in the CI/CD platform that requires all checks to pass before allowing promotion.
   • DRun compliance checks in a separate stage before the deployment stage and fail the pipeline if any check fails.
   Check answers Discussion Select an answer first