Infrastructure as Code (IaC) Security ECDE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A team stores database credentials in a Terraform variables file that is committed to the repository. They want to move to a secure approach without exposing secrets in the codebase. Which solution should they adopt?

   • AEncrypt the variables file with a password and commit the encrypted file to the repository.
   • BUse Terraform's 'sensitive' parameter on the variable to prevent it from being displayed in logs.
   • CStore the credentials in a separate Git repository with restricted access.
   • DReference secrets from a vault service (e.g., HashiCorp Vault) using data sources and pass them as environment variables during the pipeline run.
   Reveal Solution Discussion Select an answer first
2. 42foundation · medium

   Which of the following is an example of a policy-as-code framework?

   • AOpen Policy Agent (OPA)
   • BDocker
   • CGit
   • DJenkins
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A large enterprise uses Terraform Cloud for remote state and runs. They want to enforce that all workspaces use a specific version of Terraform and that no workspace can create resources outside of a defined set of AWS regions. They also want to prevent developers from bypassing the policy by using the API directly. Which approach should they take?

   • AUse Terraform Cloud's policy sets with Sentinel policies that check the plan for allowed regions and Terraform version, and enforce them at the organization level.
   • BUse a pre-commit hook to run policy checks on the Terraform code.
   • CUse AWS IAM policies to restrict regions for all users.
   • DUse OPA policies in the CI pipeline and rely on developers to run them locally.
   Reveal Solution Discussion Select an answer first
5. 44foundation · medium

   What is the recommended way to handle secrets (e.g., API keys, passwords) in IaC code?

   • AEmbed them directly in the IaC template for convenience
   • BUse the same secret for all environments to simplify management
   • CReference them from a secure secret management service or vault
   • DStore them in a separate file that is not version-controlled
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A developer writes a CloudFormation template that creates an IAM role with a policy that allows 's3:*' on all resources. The security team wants to enforce least privilege. What is the best way to catch this before deployment?

   • AManually review the IAM policy in the pull request.
   • BUse a policy-as-code tool like CloudFormation Guard to write a rule that denies wildcard actions on IAM policies.
   • CDeploy the template to a test environment and use AWS IAM Access Analyzer to detect overly permissive policies.
   • DUse cfn-lint to check for syntax errors in the IAM policy.
   Reveal Solution Discussion Select an answer first