Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 10)

Questions 46–50

1. 46foundation · medium

   What is the primary purpose of Policy as Code in an IaC pipeline?

   • ATo replace the need for manual security reviews entirely.
   • BTo automatically fix any security issues found in the infrastructure.
   • CTo encrypt all infrastructure resources automatically.
   • DTo enforce security and compliance policies programmatically during infrastructure deployment.
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A company is migrating from a mutable infrastructure model to immutable infrastructure. They currently use Ansible to configure servers and apply security patches. They want to reduce the risk of configuration drift while maintaining the ability to respond quickly to security vulnerabilities. Which strategy best balances these concerns?

   • AUse a golden image pipeline that builds a new AMI with the latest security patches, and use an auto-scaling group to replace instances with the new AMI during a rolling deployment.
   • BContinue using Ansible to apply patches in place, but add a drift detection tool to alert on changes.
   • CUse Ansible to update the golden image and then redeploy all instances from the updated image on a monthly basis.
   • DBuild a new AMI only when a critical vulnerability is announced, and manually replace instances.
   Reveal Solution Discussion Select an answer first
4. 48foundation · medium

   Which of the following is a common compliance violation that an IaC scanner might detect?

   • ADefining a security group with only necessary ports
   • BUsing a variable for the resource name
   • CAllowing public read access to a storage bucket
   • DUsing a resource name that is too long
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A DevOps engineer is writing Terraform modules for a new microservices platform. A security review found that several modules define AWS S3 buckets with `acl = "public-read"` and AWS security groups that allow SSH from `0.0.0.0/0`. The team wants to catch these issues before any infrastructure is deployed, and they want the checks to run automatically in the CI pipeline. Which approach best addresses the requirement?

   • AAdd a pipeline stage that runs `terraform plan` and manually reviews the output for public ACLs and open SSH rules.
   • BUse `terraform validate` to check the syntax and ensure the configuration is valid before applying.
   • CRun a static analysis tool like Checkov or tfsec against the Terraform code in the pipeline and fail the build on high-severity findings.
   • DDeploy to a staging environment first and run a vulnerability scanner against the running S3 buckets and security groups.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A team uses Terraform to manage their infrastructure. They notice that a developer manually changed the size of an EBS volume through the AWS console, and a security group rule was added outside of Terraform. The team wants to automatically detect and correct such drift. Which combination of actions should they implement?

   • ASet up a cron job that runs `terraform destroy` and then `terraform apply` every night.
   • BRun `terraform plan` in a scheduled CI job and, if drift is detected, run `terraform apply` to revert the changes.
   • CEnable CloudTrail and review logs weekly to identify unauthorized changes.
   • DUse AWS Config to detect changes and send an alert to the security team for manual remediation.
   Reveal Solution Discussion Select an answer first