Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A team uses Ansible to configure servers. They want to ensure that playbooks do not contain hardcoded passwords and that the playbooks are validated for syntax and security before deployment. Which combination of practices should they adopt?

   • AUse Ansible Vault to encrypt secrets and run ansible-lint in the CI pipeline to catch security issues.
   • BStore secrets in plain text in group_vars and use ansible-playbook --syntax-check in CI.
   • CUse environment variables for secrets and run ansible-playbook --check in CI.
   • DEncrypt the entire playbook with Ansible Vault and skip linting.
   Reveal Solution Discussion Select an answer first
2. 27foundation · medium

   Which of the following is a security check that can be performed in an IaC pipeline?

   • ALinting the IaC code to ensure it is syntactically correct
   • BCompiling the IaC code to ensure it runs without errors
   • CScanning the IaC templates for known vulnerabilities and misconfigurations
   • DFormatting the IaC code to follow style guidelines
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company runs a production environment using Terraform. They have a mix of resources that are managed by Terraform and some that were created manually. A recent audit found that a manually created security group is allowing SSH from the internet, and a Terraform-managed EC2 instance was modified in the console. The team wants to detect and remediate drift, but they must avoid disrupting the manually created resources. Which approach should they take?

   • ARun `terraform destroy` and then `terraform apply` to recreate all resources, including the manually created ones.
   • BUse AWS Config to detect the open security group and automatically remediate it, while leaving the EC2 instance drift unresolved.
   • CManually edit the Terraform configuration to match the current state of the EC2 instance and security group, then run `terraform apply`.
   • DImport the manually created security group into Terraform state, then run `terraform plan` and `terraform apply` to remediate all drift.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A startup is adopting IaC for the first time. They want to ensure that security is integrated into the deployment pipeline from the start. Which practice best aligns with the security implications of IaC in the release and deploy stage?

   • AUse IaC only for development environments and manually configure production to avoid mistakes.
   • BStore IaC templates in a shared network drive and only allow senior engineers to edit them.
   • CRun security scans only after the infrastructure is deployed to production.
   • DTreat IaC templates as code and apply the same security checks (linting, scanning, policy validation) as application code in the CI/CD pipeline.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company runs a web application on EC2 instances that are managed by Ansible. After a security incident, they want to reduce the attack surface by ensuring that instances are not manually modified over time. Which strategy best aligns with the concept of immutable infrastructure?

   • AUse an auto-scaling group with a launch template that always deploys a fresh instance from a golden AMI, and terminate instances that drift from the template.
   • BContinue using Ansible to apply security patches to running instances on a weekly basis.
   • CEnable AWS Systems Manager Patch Manager to automatically patch instances on a schedule.
   • DCreate a new AMI every month and manually replace instances during maintenance windows.
   Reveal Solution Discussion Select an answer first