Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large enterprise uses Terraform to manage infrastructure across multiple AWS accounts. The security team wants to enforce a policy that prohibits the creation of IAM users with console passwords and requires that all S3 buckets have versioning enabled. They also want to ensure that any violation is caught before the infrastructure is deployed, but they have a constraint: the policy must be maintainable by the security team without requiring changes to the Terraform code. Which approach best satisfies these requirements?

   • ARun a nightly AWS Config evaluation and alert the security team on non-compliant resources.
   • BImplement a policy-as-code solution using OPA and Rego, and integrate it into the CI pipeline to evaluate Terraform plans.
   • CCreate a Terraform module that includes the policy checks and require all teams to use it.
   • DUse AWS Service Control Policies (SCPs) to deny the creation of IAM users and require S3 versioning.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization uses Terraform to manage AWS infrastructure. The security team wants to enforce a policy that all S3 buckets must have encryption enabled and that no security group may allow inbound traffic on port 22 from anywhere. They want this policy to be automatically enforced whenever Terraform code is pushed to the repository. Which approach should be used?

   • AConfigure AWS Config rules to detect non-compliant S3 buckets and security groups after deployment.
   • BCreate a bash script that greps the Terraform files for `encryption` and `port 22` and run it in the CI pipeline.
   • CUse a policy-as-code tool like Open Policy Agent (OPA) with Terraform's `opa` provider to evaluate the plan against the policy.
   • DAdd a manual approval step in the CI pipeline where a security engineer reviews every Terraform plan.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security engineer is evaluating IaC scanning tools for a multi-cloud environment (AWS and Azure). They need to scan Terraform configurations for misconfigurations and compliance violations, and integrate the results into a Jenkins pipeline. The team also wants to enforce custom policies that are not covered by the tool's default rules. Which tool and approach best meets these requirements?

   • AUse AWS Config and Azure Policy to scan the IaC templates before deployment.
   • BUse tfsec with custom policies written in Rego, and run it in Jenkins.
   • CUse Checkov with custom policies written in Python, and run it as a Jenkins step that fails the build on any failed check.
   • DUse CloudFormation Guard for both AWS and Azure templates, and run it in Jenkins.
   Reveal Solution Discussion Select an answer first
5. 24foundation · medium

   Why is detecting configuration drift important for maintaining security posture?

   • ABecause drift increases the cost of infrastructure.
   • BBecause drift makes the IaC code harder to read.
   • CBecause drift can introduce insecure configurations that deviate from security policies.
   • DBecause drift automatically deletes security groups.
   Reveal Solution Discussion Select an answer first
6. 25foundation · medium

   What is the purpose of using static analysis tools to scan IaC templates?

   • ATo automatically deploy the infrastructure to production.
   • BTo identify security vulnerabilities and compliance violations in the code before deployment.
   • CTo encrypt the IaC templates at rest.
   • DTo monitor the runtime performance of deployed resources.
   Reveal Solution Discussion Select an answer first