Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer commits a Terraform configuration that includes an AWS IAM policy allowing `s3:*` on all resources. The security team wants to prevent this type of overly permissive policy from being deployed. Which control should be implemented in the CI pipeline?

   • AEnable AWS IAM Access Analyzer to monitor for excessive permissions after deployment.
   • BRequire a second developer to review the IAM policy before merging.
   • CUse `terraform fmt` to ensure the code is formatted correctly.
   • DRun a static analysis tool that flags IAM policies with `Action: "*"` or `Resource: "*"`.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   What is the primary risk associated with an overly permissive IAM policy defined in an IaC template?

   • AIt may allow unauthorized users or services to access sensitive resources.
   • BIt causes the IaC template to fail validation.
   • CIt increases the deployment time of the infrastructure.
   • DIt prevents the infrastructure from being deployed in multiple regions.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   What is configuration drift in the context of IaC-managed environments?

   • AThe intentional update of infrastructure using IaC.
   • BThe automatic scaling of resources based on demand.
   • CThe divergence between the actual state of infrastructure and the desired state defined in IaC.
   • DThe process of deleting infrastructure resources.
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Why should security checks be integrated into the CI/CD pipeline for IaC deployments?

   • ATo automatically deploy security patches to production.
   • BTo ensure that the pipeline runs faster.
   • CTo eliminate the need for runtime security monitoring.
   • DTo catch security issues early in the development lifecycle, reducing the cost and impact of fixes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company wants to integrate security checks into their CI/CD pipeline for Terraform deployments. They need to ensure that every pull request is scanned for misconfigurations and that any policy violations block the merge. Which pipeline configuration best achieves this?

   • ARun a static analysis tool like tfsec and a policy check with OPA, and fail the build if any high-severity issue is found.
   • BRun `terraform fmt` and `terraform validate` only, and require a manual approval from the security team.
   • CUse a scheduled job that runs `terraform plan` nightly and sends an email if drift is detected.
   • DRun `terraform plan` and `terraform apply` on every pull request.
   Reveal Solution Discussion Select an answer first