Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A DevOps team is building a CI/CD pipeline for Terraform deployments. They want to ensure that security checks are performed at multiple stages: on the code itself, on the plan, and on the deployed infrastructure. They also need to balance speed and thoroughness. Which pipeline design best achieves this?

   • ARun a policy check on the plan and skip static analysis to save time.
   • BRun static analysis on the Terraform code, then run a policy check on the plan, and finally run a compliance scan on the deployed resources.
   • CRun only a static analysis tool on the code and rely on it to catch all issues.
   • DDeploy to production first and then run a full suite of security scans.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   What is the core principle of immutable infrastructure?

   • AInfrastructure is deployed only once and never updated.
   • BInfrastructure components are never changed after deployment; they are replaced with new ones.
   • CInfrastructure components are shared across multiple environments.
   • DInfrastructure components are updated in place with configuration management tools.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security team is choosing an IaC tool for a new project that will deploy infrastructure to both AWS and on-premises VMware environments. They need a tool that supports policy-as-code integration, drift detection, and can be used in a CI/CD pipeline. Which tool is the best fit?

   • AAWS CloudFormation with a custom resource to manage on-premises resources.
   • BPulumi with AWS and vSphere providers, but it does not support policy-as-code.
   • CAnsible with modules for AWS and VMware, and use ansible-lint for policy checks.
   • DTerraform with providers for AWS and vSphere, integrated with OPA for policy checks and a scheduled 'terraform plan' for drift detection.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team notices that some EC2 instances in production have security groups that differ from the Terraform-managed configuration. They suspect manual changes were made outside of IaC. What should they implement to detect and remediate this drift automatically?

   • AEnable AWS CloudTrail to log all security group changes and review the logs weekly.
   • BUse AWS Config rules to detect non-compliant security groups and automatically apply the Terraform configuration.
   • CUse Terraform plan in a scheduled CI job to compare the current state to the desired configuration and alert on any differences.
   • DManually compare the AWS console security group settings to the Terraform code every month.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevOps team wants to integrate security checks into their GitLab CI pipeline for Terraform code. They want to run static analysis, policy checks, and secret scanning before any infrastructure is deployed. Which pipeline stage order is most effective?

   • ARun all security checks only after terraform apply has succeeded.
   • BRun secret scanning, then static analysis (tfsec/Checkov), then policy checks (OPA/Sentinel), and only if all pass, run terraform plan and apply.
   • CRun terraform plan first, then static analysis, then policy checks, and finally secret scanning.
   • DRun static analysis and policy checks in parallel, but skip secret scanning because it is not necessary.
   Reveal Solution Discussion Select an answer first