Compliance as Code ECDE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   During the build stage of a CI/CD pipeline, which action best represents automated compliance validation of infrastructure code?

   • ADeploying the infrastructure to production and then running a vulnerability scanner
   • BManually reviewing the code by a senior engineer before merging
   • CRunning a static analysis tool that checks Terraform plans against a set of security policies
   • DSending the code to an external auditor for a compliance certificate
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A company uses AWS Config to monitor its AWS account for compliance with the CIS AWS Foundations Benchmark. They have enabled the appropriate AWS Config rules and receive daily compliance reports. Recently, a developer manually modified a security group to open port 22 to the world, and the change was detected by AWS Config. The company's security policy requires that such changes be automatically reverted. However, the security group is also used by a legacy application that occasionally requires temporary SSH access, and the developer's change was intentional for a maintenance window. What is the best approach to balance automated remediation with the legitimate need for temporary changes?

   • ACreate a separate AWS account for the legacy application so that the security group is not monitored by the CIS rules.
   • BDisable the AWS Config rule for the security group to avoid false positives during maintenance windows.
   • CSet the AWS Config rule to only send an alert and rely on the operations team to manually revert unauthorized changes.
   • DConfigure the AWS Config rule to automatically remediate the security group, but require a change request with an approval workflow for any temporary exception.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A company is adopting compliance as code for the first time. They have a mix of legacy infrastructure that is manually configured and new infrastructure that is deployed via Terraform. The compliance team wants to enforce a policy that all servers must have a specific security agent installed. The policy must be enforced for both legacy and new servers. What is the best approach?

   • AMigrate all legacy servers to Terraform before implementing any compliance checks.
   • BUse a configuration management tool (e.g., Ansible) to enforce the agent on legacy servers, and use a policy-as-code check in the Terraform pipeline for new servers.
   • CUse only a policy-as-code check in the Terraform pipeline and manually install the agent on legacy servers.
   • DUse a vulnerability scanner to detect servers without the agent and alert the security team.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization uses AWS Config to monitor EC2 instances for compliance with a rule that requires instances to have specific tags. When a new instance is launched without the required tags, AWS Config marks it non-compliant. The team wants to automatically add the missing tags. What should they implement?

   • ASet up a CloudWatch Event that triggers an SNS notification to the operations team when the rule is non-compliant.
   • BCreate a Lambda function that runs once a day and tags any instance missing the required tags.
   • CUse the AWS Config console to manually add tags to each non-compliant instance.
   • DCreate an AWS Config rule with an automatic remediation action that invokes an SSM document to add the required tags.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A company uses Open Policy Agent (OPA) to enforce that all AWS S3 buckets have encryption enabled. The policy is stored in a Git repository and is used by the CI/CD pipeline to validate infrastructure-as-code templates. After a recent change to the policy, several legitimate deployments were blocked because the policy incorrectly required encryption for temporary build buckets. The team needs to quickly revert to the previous behavior while they fix the policy. What should they do?

   • ADisable the OPA policy engine in the pipeline until the policy is fixed.
   • BRevert the policy change in Git and redeploy the previous policy version to the OPA server.
   • CAdd an exception rule to the policy that allows temporary build buckets.
   • DEdit the policy directly on the OPA server to remove the encryption requirement.
   Reveal Solution Discussion Select an answer first