Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A team uses Ansible to deploy applications. They need to pass API tokens to playbooks without exposing them in the repository or in the process list. Which method should they use?

   • AHardcode the tokens in the playbook and rely on repository access controls.
   • BUse a `debug` module to display the token during the playbook run.
   • CStore the tokens in Ansible Vault and reference them in the playbook.
   • DDefine the tokens as environment variables in the playbook and print them for debugging.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security engineer wants to scan Terraform code for misconfigurations such as open security groups and unencrypted storage. The scans should run automatically on every commit and block the merge if critical issues are found. Which tool should be used?

   • AAWS CloudTrail
   • Btfsec
   • CTerraform Cloud's run triggers
   • DAWS Config
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization wants to enforce that all AWS S3 buckets created via CloudFormation have encryption enabled and versioning turned on. They want to automate this enforcement in the CI/CD pipeline before deployment. Which tool and approach should they use?

   • AUse CloudFormation Guard to write rules that check the template for encryption and versioning properties, and run it in the pipeline.
   • BUse cfn-lint to check the template for syntax errors and best practices.
   • CWrite a shell script that greps the template for 'Encryption' and 'Versioning' keywords.
   • DUse AWS Config rules to detect non-compliant buckets after they are deployed.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A developer accidentally commits a Terraform file that contains an AWS access key ID and secret access key. The security team needs to prevent this from happening again. Which combination of controls should be implemented?

   • AUse a pre-commit hook that scans for secrets and rotate the leaked keys immediately.
   • BUse `git rm` to remove the file from the repository and force-push the branch.
   • CAdd the file to `.gitignore` and assume the leak is contained.
   • DEnable AWS CloudTrail to monitor for unauthorized use of the leaked keys.
   Reveal Solution Discussion Select an answer first
6. 20foundation · medium

   Why is it important to use environment variables for secrets in IaC rather than hardcoding them?

   • AIt makes the IaC code run faster.
   • BIt allows anyone with repository access to see the secrets.
   • CIt prevents secrets from being committed to version control and reduces exposure.
   • DEnvironment variables are automatically encrypted by the operating system.
   Reveal Solution Discussion Select an answer first