Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A team manages their production environment with Terraform. A security audit reveals that a security group rule was manually added to an EC2 instance outside of Terraform, and a developer also changed the instance type through the AWS console. The team wants to detect and correct such unauthorized changes automatically. Which approach should be used?

   • ARun `terraform plan` periodically and compare the output to the live state, then apply the plan to revert any drift.
   • BEnable AWS CloudTrail to log all API calls and review the logs monthly.
   • CSet up a cron job that runs `terraform destroy` and then `terraform apply` every night.
   • DUse AWS Config rules to detect changes and send an alert to the security team.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A team uses Terraform to manage a Kubernetes cluster on AWS. They have a drift detection job that runs every hour and compares the Terraform state to the live cluster. The job frequently reports drift because the Kubernetes cluster autoscaler changes the desired capacity of node groups. The team wants to reduce false positives without losing visibility into real drift. What is the best approach?

   • AUse Terraform's 'ignore_changes' lifecycle setting on the autoscaler-managed attributes, and keep drift detection for other resources.
   • BMove the node group management out of Terraform and manage it manually.
   • CRun 'terraform apply' automatically whenever drift is detected to revert autoscaler changes.
   • DDisable the drift detection job because the autoscaler changes are expected.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A team uses Terraform to provision Azure resources. They need to pass a database password to a VM without exposing it in the Terraform state file. Which approach should they use?

   • AUse environment variables in the CI pipeline and reference them with var.db_password.
   • BPut the password in a terraform.tfvars file and mark it as sensitive in the variable definition.
   • CStore the password in Azure Key Vault and reference it from Terraform using the azurerm_key_vault_secret data source, then pass it to the VM via a protected setting.
   • DGenerate the password in Terraform using random_password and store it in the state file.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A team uses Terraform to manage infrastructure and stores state in an S3 backend. They currently have secrets in the state file because they used a resource that generates a password. They want to eliminate secrets from the state file without breaking existing infrastructure. Which approach is the most secure and practical?

   • ASet the resource attribute as sensitive in the Terraform code to hide it from state.
   • BSwitch the state backend to a local file and store it in a secure directory.
   • CEnable encryption on the S3 bucket and use a vault integration to import the existing secret into a secrets manager, then update the Terraform configuration to reference the secret from the vault instead of generating it.
   • DUse 'terraform state rm' to remove the secret resource from the state file and then re-import it.
   Reveal Solution Discussion Select an answer first
6. 40foundation · medium

   What is a key security best practice when using Ansible for infrastructure automation?

   • AUsing Ansible Vault to encrypt sensitive variables and files
   • BRunning playbooks with root privileges by default
   • CStoring plaintext passwords in playbooks for simplicity
   • DDisabling SSH host key verification to speed up connections
   Reveal Solution Discussion Select an answer first