Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · medium

   What is the primary security benefit of using Infrastructure as Code (IaC) in the release and deploy stage?

   • AIt automatically patches all operating systems and applications.
   • BIt removes the need for identity and access management controls.
   • CIt ensures that infrastructure configurations are reviewed, versioned, and consistent across environments.
   • DIt eliminates the need for runtime security monitoring.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company runs a web application on a set of EC2 instances that are updated in-place using configuration management tools. After a recent security incident, the security team wants to reduce the attack surface and ensure that any change to the base image results in a completely new instance, rather than modifying existing ones. Which strategy should the team adopt?

   • AUse AWS Systems Manager to run commands on existing instances to update the application code.
   • BUse a configuration management tool to apply security patches to the running instances on a schedule.
   • CEnable detailed monitoring on the instances and rely on CloudWatch alarms to detect unauthorized changes.
   • DCreate a new Amazon Machine Image (AMI) for each release and launch new instances from that AMI, then terminate the old ones.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A team is using Terraform to provision AWS resources. They need to pass database passwords to an EC2 instance's user data script. The security team mandates that secrets must not be stored in the Terraform state file or in the code repository. Which approach should the team use?

   • AStore the password in a Terraform variable and reference it in the user data script.
   • BUse AWS Secrets Manager to store the password and have the user data script retrieve it at instance launch.
   • CUse a `null_resource` with a local-exec provisioner to write the password to a file on the instance.
   • DHardcode the password in the user data script but encrypt the script with a KMS key.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company uses Terraform to manage a production environment. They have a scheduled job that runs 'terraform plan' and alerts on drift. Recently, the job has been alerting on a security group rule that was manually added for a temporary troubleshooting session. The team wants to maintain security posture but also avoid alert fatigue. What is the most effective approach?

   • ADisable the drift detection job because the manual change was intentional.
   • BChange the scheduled job to run 'terraform plan -detailed-exitcode' and only alert when the exit code indicates changes, then review the diff before deciding to remediate.
   • CAutomatically run 'terraform apply' whenever drift is detected to revert any manual changes.
   • DAdd the security group rule to the Terraform configuration so it is no longer considered drift.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multi-team organization wants to enforce that all Terraform deployments use approved resource types and tag standards. They want to automate this enforcement in the CI pipeline. Which tool should they choose?

   • AUse Terraform's built-in 'terraform fmt' to check formatting and enforce tag standards.
   • BUse HashiCorp Sentinel or OPA (Open Policy Agent) to write policies that validate Terraform plan output before apply.
   • CUse a custom script that greps the Terraform code for approved resource types.
   • DUse AWS Config or Azure Policy to enforce tags after deployment.
   Reveal Solution Discussion Select an answer first